A Bitcoin private key has roughly 256 bits of range, but a modern wallet may ask you to back up only twelve words. Does that narrow the search enough to make guessing practical? It narrows the mnemonic input space enormously. With uniform generation, the smaller space is still far beyond practical classical exhaustive search.

To see what those words protect, we need to follow the derivation. Recovering one private key and recovering the root of a wallet are different jobs.

From entropy to a key tree

Bitcoin Improvement Proposal 39 (BIP39) defines a mnemonic that encodes the initial entropy and a checksum. It then feeds a key-derivation function, whose output supplies BIP32’s hierarchical deterministic (HD) key tree:

Wallet derivation: 128–256 random bits become BIP39 recovery words with a checksum. PBKDF2-HMAC-SHA512 combines the words and optional passphrase into a 512-bit seed. BIP32 derives a master private key, chain code, and child key tree. The longer seed does not increase the original entropy.
From initial entropy to recovery words, a seed, and a key tree. View the full-size diagram.

PBKDF2 is Password-Based Key Derivation Function 2; here it uses HMAC-SHA512. The BIP39 specification defines the conversion, including UTF-8 NFKD normalization of the mnemonic and passphrase before deriving the seed.

A path such as m/44'/0'/0'/0/0 selects one child private key from that tree. Its public key and receiving address follow from that child, using the derivation in Part 1.

Each word selects one of 2,048 entries and therefore encodes 11 bits. The English list runs from abandon to zoo, with unique first four letters. The checksum length is ENT/32, where ENT is the initial entropy length. For BIP39’s allowed 128–256 bits, in steps of 32, the combined bit string gives exactly five supported word counts.

Words Initial entropy Checksum Uniform mnemonic inputs
12 128 bits 4 bits 2¹²⁸
15 160 bits 5 bits 2¹⁶⁰
18 192 bits 6 bits 2¹⁹²
21 224 bits 7 bits 2²²⁴
24 256 bits 8 bits 2²⁵⁶

The checksum supplies error detection, not entropy. Only one in 16 uniformly chosen 12-word strings passes it; for 24 words the fraction is one in 256. An enumerator can start with entropy values and calculate the checksum, so these bits do not add secret choices to search.

The optional passphrase changes the seed. It is sometimes called the “25th word,” but can be an arbitrary string. Every passphrase produces a wallet, including a typo. That makes exact recovery of the passphrase part of the backup problem.

The 512-bit output does not add entropy

Hold the passphrase and derivation path fixed. Twelve uniformly generated words supply 2¹²⁸ possible mnemonic inputs, and at most that many values for a particular child key. Twenty-four words supply 2²⁵⁶ inputs. Deterministic mappings can collide, so those counts do not prove that every scalar is reachable. Varying the path changes the question again: one mnemonic generates many child keys.

Both lengths produce a seed in the same 512-bit format. The longer output does not create more input uncertainty. A separately chosen secret passphrase can add uncertainty; more output bytes cannot. The same applies to a broken source: recording 24 words from a generator with only a few predictable inputs does not repair it.

Guessing twelve words

Part 1 used a generous rate of 10¹² raw keys per year per core. If complete mnemonic candidates could be checked at that rate, exhausting the 12-word space would take:

2^128 / 10^12 ≈ 3.4 × 10^26 years

This is a scale comparison, not a mnemonic benchmark. The scanner does not measure PBKDF2 or BIP32, and checking multiple paths adds work. Different implementations and hardware need their own measurements.

Even a trillion-fold speedup over the assumed one-core rate leaves about 3.4 × 10¹⁴ years, more than twenty thousand times the current age of the universe. Twelve uniformly generated words leave a large classical search margin. Twenty-four make root-secret guessing vastly harder still.

Recovering one child key

An exposed secp256k1 public key permits a different attack. Generic discrete-log recovery takes roughly 2¹²⁸ group operations, regardless of mnemonic length. Typical Pay-to-Public-Key-Hash (P2PKH) and Pay-to-Witness-Public-Key-Hash (P2WPKH) spends reveal public keys; Taproot exposes an output public key on receipt. Recovering the corresponding secret can compromise that output. It generally does not reveal the mnemonic or every other key.

BIP32 has a specific exception. A parent extended public key (xpub, including the chain code), together with a descendant private key connected entirely by non-hardened steps, can reveal the parent extended private key and its subtree. Hardened derivation blocks that route across its boundary. Compromising one account therefore does not automatically recover the master seed or other hardened accounts. BIP32 documents the implications.

The curve’s roughly 128-bit classical security describes the individual exposed public key. It does not erase the extra resistance that 24 words give the wallet’s root secret against mnemonic guessing.

Backup length and secret handling

Twenty-four uniformly generated words provide more margin against seed search. Some of that margin may remain after a partial leak, depending on exactly what became known. Twelve words give a shorter backup with a still large classical search space. For either length, a backup has to remain readable, recoverable, and private.

A copied complete mnemonic removes its guessing margin. The reported implant in Part 0 would not need more computing power to copy 24 words instead of 12. A separate, uncompromised passphrase changes what the words alone unlock. Its protection depends on how it was chosen and kept, rather than on calling it another word.

Before seed words: wallet.dat

A Satoshi-era wallet did not use twelve BIP39 words. The standards came later:

Date Wallet behavior or standard
2009–2010 The client stores individually generated random keys in a Berkeley DB wallet.dat. Recovery depends on backups containing the relevant keys.
October 9, 2010 Satoshi announces the key pool, defaulting to 100 pre-generated keys so a backup can cover future use.
September 23, 2011 Version 0.4.0 adds wallet encryption and upgrades Berkeley DB from 4.7 to 4.8. Encryption protects stored keys with a passphrase.
2012 BIP32 proposes hierarchical deterministic wallets.
2013 BIP39 proposes the mnemonic scheme.

A genuine Satoshi-era wallet is a bag of individually generated keys in a wallet.dat. Anyone offering “Satoshi’s 12 words” is selling a story.

Both designs depend on unpredictable generation. Neither excuses unsafe signing or a copied backup. Part 3 tests what happens when the candidate generator starts with small or human-chosen spaces.