BIP39 passphrases
A passphrase is applied after the mnemonic. It can add an independent search, but its value depends on how it was generated and what the attacker already knows.
No code. Written to be actionable.
Coinkite recommends a strong BIP39 passphrase as a temporary mitigation for an affected mnemonic. The passphrase does not alter the mnemonic or repair the generator. It changes the wallet produced by BIP39's key-stretching step.
The advisory's passphrase section was rewritten on 1 August 2026 and now moves in two directions at once. It states more plainly that the reduced seed entropy alone is not enough to reach funds in a passphrase wallet, because an attacker must also discover the passphrase. It also hardens the instruction that follows: a strong passphrase reduces immediate exposure but does not repair the affected seed, so passphrase users should migrate as soon as practical, and anyone whose passphrase is short, common, patterned, quoted, reused, or of uncertain strength should treat the funds as at risk and migrate immediately. Both states are held in the advisory record.
Illustrative values for randomly generated passphrases
For a construction with N equally likely passphrases, the ideal
strength is log2(N) bits. The displayed time is
N / (2 × rate), which assumes a uniformly positioned target and
no better ordering. It also assumes the attacker knows the construction,
length, alphabet or word list, and separator convention. The letter rows use
a fixed 26-character lowercase alphabet, the alphanumeric rows use 62
characters, Diceware uses 7,776 words, and the BIP39 English list uses 2,048.
A day is 86,400 seconds and a year is 365.25 days in the displayed conversions.
| Passphrase generation method | Candidate expression | Ideal entropy | 4,000/s | 2 million/s | 1 billion/s |
|---|---|---|---|---|---|
| 8 uniformly random lowercase letters | 26^8 | 37.60 bits | 302 days | 14.5 hours | 1.74 minutes |
| 10 uniformly random lowercase letters | 26^10 | 47.00 bits | 559 years | 408 days | 19.6 hours |
| 12 uniformly random lowercase letters | 26^12 | 56.41 bits | 378,000 years | 756 years | 552 days |
| 12 uniformly random alphanumeric characters | 62^12 | 71.45 bits | 12.8 billion years | 25.6 million years | 51,100 years |
| 16 uniformly random alphanumeric characters | 62^16 | 95.27 bits | 189 quadrillion years | 378 trillion years | 755 billion years |
| 3 uniformly random Diceware words | 7,776^3 | 38.77 bits | 680 days | 1.36 days | 3.92 minutes |
| 4 uniformly random Diceware words | 7,776^4 | 51.70 bits | 14,500 years | 29 years | 21.2 days |
| 5 uniformly random Diceware words | 7,776^5 | 64.62 bits | 113 million years | 225,000 years | 450 years |
| 6 uniformly random Diceware words | 7,776^6 | 77.55 bits | 876 billion years | 1.75 billion years | 3.5 million years |
| 7 uniformly random Diceware words | 7,776^7 | 90.47 bits | 6.81 quadrillion years | 13.6 trillion years | 27.2 billion years |
| 8 uniformly random Diceware words | 7,776^8 | 103.40 bits | 52.9 quintillion years | 106 quadrillion years | 212 trillion years |
| 8 uniformly random BIP39 English-list words, used as a passphrase | 2,048^8 | 88.00 bits | 1.23 quadrillion years | 2.45 trillion years | 4.9 billion years |
Use the in-browser estimator to change the construction, length and candidate-check rate, or conditionally combine an independent passphrase with one of the published device-search scenarios.
These values do not apply to a phrase chosen from memory, a quotation, a reused password, a patterned modification or words selected without dice or another uniform random process. Human-chosen passphrases do not have a single defensible entropy value, and targeted information can make them easier to test than their length suggests.
No universal word-count threshold follows from this table. A suitable margin depends on the attack rate, whether the mnemonic is known, how long the wallet must remain protected and the risk of losing or mistyping the passphrase. Coinkite presents a passphrase as a stopgap while migrating, not as a repair to an affected seed.
Praveen Perera's emergency guidance recommended more than seven BIP39 words as a passphrase, while still advising migration. That is preserved as an attributed recommendation from the incident response, not adopted here as a universal threshold. The recommendation does not state how those words are selected, while the table above applies only to uniformly random choices and separates the 7,776-word Diceware construction from the 2,048-word BIP39-list example.
The eight-word BIP39-list row above shows the conditional arithmetic behind
that kind of construction: 2,048^8 = 2^88 only when all eight
words are selected independently and uniformly. They are passphrase text, not
a second checksummed mnemonic. Human selection does not inherit the word
list's ideal 11 bits per word.
The typo and recovery risk
flowchart TB
WORDS["BIP39 mnemonic"] --> BASE["PBKDF2 with empty passphrase\nbase wallet"]
WORDS --> WITH["PBKDF2 with chosen passphrase\ndifferent wallet"]
KNOWN["known target address or xpub"] --> TEST["offline candidate comparison"]
WITH --> TEST
PIN["device PIN"] -. "protects device access,\nnot key derivation" .-> WORDS
The optional BIP39 passphrase is part of key derivation. The device PIN is a separate access-control mechanism.
What a passphrase does not change
- The no-passphrase wallet remains derived from the same mnemonic. Funds previously received there do not gain passphrase protection.
- Reuse remains reuse. A phrase present in breach corpora or otherwise known should be treated as known, regardless of length.
- The device PIN is unrelated. It protects access to the device and does not enter BIP39 derivation.
- The mnemonic remains affected. Installing fixed firmware or adding a passphrase later does not change how the original words were generated.