2²⁵⁶
Private-key space
Bitcoin uses secp256k1. A private key is essentially a number selected from a set close to 2²⁵⁶ possibilities.
A visual BIP39 explainer
12 vs 24 words
Why twelve correctly generated words can already match Bitcoin’s practical cryptographic security—and what twenty-four words do and do not add.
The short answer: 12 words are sufficient when they contain a genuine 128 bits of uniform entropy. Twenty-four words increase seed-search space, but do not make Bitcoin’s elliptic curve stronger.
128
bits of security
2²⁵⁶ keysBitcoin private-key space
2¹²⁸ workBest known generic curve attack
Start here
Three numbers people mix up
Raw key length, attack difficulty, and mnemonic entropy are related—but they are not the same measurement.
2¹²⁸
Curve-attack work
Elliptic-curve attacks have a square-root shortcut. Searching a 256-bit curve takes roughly 2¹²⁸ operations, not 2²⁵⁶.
2¹²⁸
Valid 12-word seeds
Twelve BIP39 words encode 128 random bits plus a 4-bit checksum: 2¹²⁸ valid possibilities.
The useful comparison is security strength, not raw key length.
A 256-bit elliptic-curve key is commonly described as providing about 128 bits of classical security.
A 256-bit elliptic-curve key is commonly described as providing about 128 bits of classical security.
Interactive anatomy
Where the bits live
Every BIP39 word selects one of 2,048 entries. Since 2,048 = 2¹¹, each word represents 11 bits.
Illustrative public words
12 words × 11 bits
Random entropyChecksum
Random entropy
128 bits
2¹²⁸ possible seedsChecksum
4 bits
Error detection, not additional randomnessRaw word bits
132 bits
12 × 11 = 132| Mnemonic | Raw word bits | Entropy | Checksum | Valid seeds |
|---|---|---|---|---|
| 12 words | 132 | 128 | 4 | 2¹²⁸ |
| 24 words | 264 | 256 | 8 | 2²⁵⁶ |
The square-root shortcut
256-bit keys, 128-bit work
The best known generic elliptic-curve attack does not try every private key. Its work grows approximately with the square root of the key space.
2²⁵⁶
possible private keys√ →
Pollard-rho style square-root attack2¹²⁸
rough operations requiredBitcoin does not have only 2¹²⁸ private keys.
It has close to 2²⁵⁶ private keys; the strongest known generic classical attack is why we call its security roughly 128-bit.
It has close to 2²⁵⁶ private keys; the strongest known generic classical attack is why we call its security roughly 128-bit.
Think like an attacker
Attackers choose the cheaper door
Increasing one barrier beyond the other does not raise the security of the complete system. Switch between 12 and 24 words to see the bottleneck.
Door A
Guess the seed
2¹²⁸
A valid 12-word mnemonic carries 128 random bits.
Door B
Reverse a public key
≈ 2¹²⁸
Once an applicable public key is available, generic secp256k1 attacks remain around 2¹²⁸ work.
Effective classical ceiling
min(128, 128) = 128 bits
Both doors are similarly hardmin(128, 128) = 128 bits
With 24 words: the seed door rises to 2²⁵⁶, but the public-key door remains near 2¹²⁸. The system-level ceiling therefore remains about 128 bits once that public-key attack applies.
Scale simulator
How long is 2¹²⁸?
Move the slider. Even absurd guessing speeds barely make a dent. These figures are simple division, not estimates of practical wallet-testing performance.
Hypothetical attacker
10¹² / second
For perspective, this deliberately lets you choose fantastical speeds up to 10³⁰ operations per second.
Exhaust 2¹²⁸ possibilities
1.08 × 10¹⁹ years
Average success would take about half this time.Exhaust 2²⁵⁶ possibilities
3.67 × 10⁵⁷ years
Vastly larger, but not Bitcoin’s weakest classical door.The observable universe is roughly 1.38 × 10¹⁰ years old. At 10¹² attempts per second, exhausting 2¹²⁸ takes around 780 million universe-lifetimes.
For physical SeedTabs
The last word is partly random
The phrase “checksum word” is convenient but incomplete. The final word contains both remaining entropy and checksum bits.
12-word mnemonic
Draw 11 words, then add 7 random bits
11 × 11 = 121; 128 − 121 = 7
Eleven uniform tab draws supply 121 bits. A trusted offline workflow must add 7 uniformly random bits, then compute the 4 checksum bits that complete word 12.
The final bitstream
121bits from tab draws
7more random bits
4checksum bits
DrawnStill randomCalculated checksum
Do not simply choose one deterministic “valid last word” and assume you retained full entropy. For 12 words, select uniformly among the 128 valid final-word candidates; for 24 words, select uniformly among the 8 candidates—or use a trusted offline device that explicitly supplies the missing random bits.
12-word target
11 draws = 121 bits
Need 7 more random bits + 4 checksum bits
11 draws = 121 bits
Need 7 more random bits + 4 checksum bits
24-word target
23 draws = 253 bits
Need 3 more random bits + 8 checksum bits
23 draws = 253 bits
Need 3 more random bits + 8 checksum bits
Practical conclusion
Choose the workflow you can execute correctly
The best theoretical number loses to a weak random source, an exposed backup, or a restoration mistake.
12
Sufficient for BitcoinThe simpler strong default
- 128 bits of genuine entropy
- Matches Bitcoin’s approximate 128-bit classical curve security
- Half as many words to record, verify, conceal, and restore
- Requires correct generation of the final entropy and checksum bits
24
Optional marginMore seed-search space
- 256 bits of genuine entropy
- Raises direct mnemonic brute force from 2¹²⁸ to 2²⁵⁶
- Does not strengthen secp256k1 beyond its roughly 128-bit classical level
- More words to back up correctly and keep private
Neither word count fixes…
A photographed seedA weak or broken RNGA leaked digital copyA forgotten passphraseBad checksum handlingPhishing or coercion
Bottom line: Use 12 words when you can confidently produce all 128 random bits and finish BIP39 correctly offline. Use 24 when your wallet or policy requires it, or when you value extra mnemonic-search margin enough to accept the backup burden.
Check your intuition
Three quick questions
No seed phrases required—this demo never asks for secret material.
1. Approximately how many Bitcoin private keys are there?
2. How much random entropy is encoded by a valid 12-word BIP39 phrase?
3. After 11 uniform SeedTab draws, how many random bits are still needed for full 12-word strength?
Read the originals
Sources and boundaries
This explainer is educational. It is not a wallet, seed generator, or substitute for your signing device’s documented offline procedure.
BIP39 specification
Defines allowed entropy lengths, checksum construction, 11-bit word indices, and mnemonic lengths.
Foundation: 12 words are the standard
The article that motivates this visual explanation and compares seed brute force with secp256k1 attacks.
NIST SP 800-57 Part 1
General guidance relating elliptic-curve key sizes to security strength; 256-bit ECC corresponds broadly to 128-bit strength.
SeedTabs repository
Laser-ready SVGs for a physical set of all 2,048 English BIP39 words, plus verification tooling and safety guidance.
Never paste a real seed phrase into this or any webpage. This file is self-contained and performs only educational calculations, but secret recovery material belongs exclusively in a trusted offline workflow.