Can You Guess a Seed Phrase? Probability and Real Risks

No: nobody can guess a seed phrase that was generated properly. A 12-word BIP39 phrase is one of 2¹²⁸, about 3.4 × 10³⁸, possible phrases, and a 24-word phrase one of 2²⁵⁶. Even at a trillion guesses per second, finding a random 12-word phrase would take on average about 400 million times the age of the universe. Seed phrases are lost to weak random number generators, words people chose themselves and phrases handed to scammers, not to guessing. This article works through the mathematics and then the real-world attacks that do succeed.

A BIP39 seed phrase is 12 to 24 words from a fixed list of 2,048 that encode a random number of 128 to 256 bits, so guessing the phrase means guessing that number. For how the words then become your private keys, see what a seed phrase is and how it works.

Guessing Odds at a Glance

The Mathematics of Entropy: How 2²⁵⁶ Defines Security

To understand the security of seed phrases, we must grasp the concept of entropy – a measure of randomness or unpredictability. In cryptography, higher entropy corresponds to greater security.

A 24-word seed phrase derived from BIP39 provides 256 bits of entropy. This means there are 2²⁵⁶ possible combinations – a number so vast it defies intuitive understanding. Let’s put this in perspective:

Quantum computers don’t change this picture much. The National Institute of Standards and Technology (NIST) notes that Grover’s algorithm speeds up brute-force key search at best quadratically, and probably by less in practice. NIST considers it quite likely that Grover-style attacks give no real advantage against even 128-bit keys in an attack that has to finish within years or decades, which suggests that guessing a properly generated seed stays out of reach too. The real quantum risk lies elsewhere: NIST’s key-management guidance, SP 800-57 Part 1, warns that large-scale quantum computers are expected to break today’s public-key algorithms, including the elliptic-curve signature schemes of the kind crypto wallets use.

Even if 2 billion computers could each check 1 trillion seed phrase combinations per second, exhausting all possibilities of a 256-bit seed would take more than 10³⁸ times the age of the universe.

Cryptographers call this computational security: guessing is not ruled out in principle, but the number of possibilities is so large that no realistic amount of computing power could search a meaningful share of it.

Do the Wordlist and Word Count Matter?

The wordlist does not. BIP39 has a single fixed English list of 2,048 words, so there is no “best” or “more secure” list to pick. Each word stands for an 11-bit number, its position in the list counted from zero, and that number, not the word itself, is what the phrase encodes:

Short words are therefore exactly as strong as long ones. The list was designed for reliable writing rather than secrecy: the first four letters identify every word, and it never contains both words of a look-alike pair such as “build” and “built”. BIP39 also publishes official lists in other languages, but it strongly discourages using them because most wallets support only English.

The word count does matter, because it sets the amount of entropy: 12 words carry 128 bits, 24 words carry 256 bits, and the 15-, 18- and 21-word lengths fall in between. The last word also holds a checksum of 4 to 8 bits, but that adds no secrecy: it is computed from the entropy, so there are 2¹²⁸ valid 12-word phrases, not 2,048¹². Our BIP39 visualizer lets you watch the checksum being computed and appended to the entropy. As the table above shows, even 128 bits puts brute force out of reach; 24 words add a safety margin rather than fix a weakness.

Guessing Probability: Can Your Seed Phrase Be Compromised?

In theory, someone could guess your exact seed phrase on their first try. However, the probability is so infinitesimally small that it can be considered effectively impossible. For a 24-word phrase, the chance of a correct random guess is 1 in 2²⁵⁶, or approximately 1 in 10⁷⁷.

// Visualization: Guessing 1 million seed phrases per second
const seedsPerSecond = 1_000_000;
const totalSeeds24Word = BigInt(2) ** BigInt(256);
// Time to guess all combinations in years
const secondsToGuessAll = totalSeeds24Word / BigInt(seedsPerSecond);
const yearsToGuessAll = secondsToGuessAll / BigInt(60 * 60 * 24 * 365);
console.log(yearsToGuessAll.toString().length); // 64 digits: about 3.7 × 10⁶³ years

To contextualize this further, even if a powerful adversary could check one trillion seed phrases per second (far beyond current capabilities), finding a specific 24-word phrase would take on average about 10⁴⁷ times the age of the universe, and a 12-word phrase about 400 million times.

Important: These calculations assume properly generated random seed phrases. If your phrase wasn’t generated using a cryptographically secure random number generator, the actual security could be significantly lower.

While the mathematical protection is robust, most successful attacks on cryptocurrency wallets don’t involve brute-forcing seed phrases. Instead, they exploit human error, poor security practices, and vulnerabilities in the handling of seed phrases. It pays to test your own wallet the way an attacker would before someone else does.

Examples of “Weak” Seed Phrases and Why They’re Vulnerable

Despite the theoretical strength of seed phrases, several scenarios can dramatically reduce their effective security. Here are examples of compromised seed phrase security:

1. Patterns and Sequences

Some wallet implementations have had flaws that generated predictable patterns, and some people build phrases from patterns themselves. A phrase that follows a recognizable sequence, such as one word or a group of words repeated over and over, did not come from random bits. A single repeated word is normal, though: random phrases often contain one, as the official 24-word test vector does with “private” and “delay”.

// Example of a weak pattern (DO NOT USE)
"abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about"
// Or sequences with internal patterns
"word1 word2 word3 word1 word2 word3 word1 word2 word3 word1 word2 word3"

Such patterns reduce the effective entropy from 128 or 256 bits to a handful of guesses. The first example is the public all-zero BIP39 test vector, so anyone can open its wallet.

2. Predictable Sources of Randomness

If a wallet uses weak entropy sources for generation, the resulting seed phrases could be vulnerable. Flawed random number generators have a long history in cryptocurrency: in 2023, the wallet-recovery firm Unciphered disclosed Randstorm, a weakness in the randomness used by BitcoinJS-based browser wallets that potentially affects millions of wallets created between 2011 and 2015.

In 2017, the ROCA vulnerability (CVE-2017-15361) in Infineon’s RSA key generation library made keys created on its smart cards, security tokens and TPMs, including Estonian ID cards, factorable: a 2048-bit key could be broken with at most about 100 CPU-years of computation, tens of thousands of dollars of cloud time, instead of being out of reach. Similar flaws in seed phrase generation would be catastrophic for wallet security.

3. Self-Created or Modified Phrases

Some users attempt to create “memorable” seed phrases by selecting words themselves or modifying randomly generated ones. This drastically reduces entropy and creates vulnerability.

4. Brain Wallets and Passphrases

A particularly dangerous practice is the creation of “brain wallets” – where users derive private keys from memorable phrases or quotations rather than proper random generation. These are extraordinarily vulnerable to dictionary attacks.

In 2015, security researcher Ryan Castellucci reported in his DEF CON 23 talk that money sent to brain wallets whose passphrases appeared on common word lists, in song lyrics or on Wikiquote was swiped within seconds by thieves using precomputed lookup tables.

Real-World Attack Vectors: Beyond Pure Mathematics

While the mathematical security of properly generated seed phrases is overwhelming, real-world attacks target much more vulnerable aspects of the cryptocurrency storage ecosystem.

Social Engineering and Physical Security

The most common successful attacks involve no advanced mathematics but rather exploit human psychology and behavior:

• Phishing attacks: Fraudulent websites or applications that trick users into entering their seed phrases

• Fake recovery services: Scammers posing as wallet recovery specialists who request seed phrases

• Physical theft or observation: Seed phrases written on paper or stored insecurely

• Malicious support personnel: Fake customer service representatives requesting recovery information

None of these attacks needs to break the cryptography: each one gets the phrase from its owner instead.

Software Vulnerabilities and Faulty Generation

Several technical vulnerabilities can compromise seed phrase security:

Hardware wallets are not immune. In July 2026, Coinkite disclosed in a technical write-up that since a March 2021 firmware change, its COLDCARD devices had been generating seeds with a general-purpose software pseudo-random generator instead of their hardware random number generator, and that attackers had regenerated affected seeds offline and stolen funds. Coinkite’s preliminary estimate put the effective search space at about 40 bits for the older Mk2 and Mk3 and about 72 bits for the Mk4, Mk5 and Q, instead of the expected 128. Coinkite says seeds that mixed in at least 50 private dice rolls are not at risk from the bug alone, and that a strong, unique BIP39 passphrase reduces the immediate exposure but does not repair an affected seed.

• Compromised wallet software: Malicious or flawed wallet applications that deliberately or accidentally generate predictable seed phrases

• Screenshot and clipboard malware: Software that monitors for patterns resembling seed phrases in clipboard contents or screen captures; clipper malware also swaps copied addresses for the attacker’s own

• Flawed RNG implementations: Cryptocurrency wallets that use insufficient entropy sources when generating seed phrases

• Side-channel attacks: Advanced techniques that extract information about private keys from physical signals like power consumption or electromagnetic emissions

Even if the theoretical security of a seed phrase is 256 bits, implementation flaws can reduce this to an attackable level. A well-documented software case is Libbitcoin Explorer’s bx seed command (versions 3.0.0 to 3.6.0): asked for 256 bits of entropy, it used a Mersenne Twister generator seeded with only 32 bits, so there were at most about 4.29 billion possible seeds, a space the researchers who disclosed the flaw say an average gaming PC can search in a few days. Attackers did exactly that, sweeping around 29.65 BTC from affected wallets on 12 July 2023 (Milk Sad disclosure, CVE-2023-39910).

Best Practices for Securing Your Seed Phrase

Given the challenges outlined above, here are evidence-based practices for maximizing seed phrase security:

Essential Security Measures

• Use only trusted, open-source wallet implementations with robust security audits

• Treat any website, app, chat or “support” agent that asks for your seed phrase as a phishing attempt

• Store recovery phrases using durable, physical mediums (metal storage preferred)

• Before sending funds to a new wallet, check that your written copy matches the words the wallet showed you

• Consider distributing partial backups across multiple secure locations with Shamir’s Secret Sharing, the method behind cold sharding

• Add a passphrase (sometimes called a “25th word”) to create additional security beyond the seed phrase

The addition of a custom passphrase (implemented in BIP39 as an optional security layer) can provide significant additional protection even if your seed phrase is compromised. This effectively adds your own entropy to the mathematically generated entropy of the seed phrase.

Modern best practices increasingly recommend using multisignature wallets or Shamir’s Secret Sharing schemes that distribute security across multiple points, removing single points of failure. Put your effort into proper generation, safe storage and resisting social engineering: that is where seed phrases are actually lost.