Why You Should Never Create Your Own Seed Phrase

You should never create your own seed phrase because words a person chooses are far easier to guess than words picked at random. A wallet will still accept them if they are on the BIP39 list and pass the checksum, but the standard was built to carry computer-generated randomness: the BIP39 specification says it is “not a way to process user-created sentences (also known as brainwallets) into a wallet seed”. Brain wallets built from phrases people made up were found by attackers and emptied, usually within a day. Let a wallet or a seed phrase generator create the words, or, if you don’t trust the generator, roll dice.

Made-Up and Random Phrases at a Glance

Can You Make Up Your Own Seed Phrase?

Technically, yes. A BIP39 phrase is 12 to 24 words from a list of 2048, and the last word carries a checksum computed from the others, as How BIP39 works shows step by step. Twelve words chosen at will pass that check about one time in 16, and 24 words one time in 256; the last word calculator and some signing devices will find a closing word that makes any 11 words valid. The wallet then opens without complaint, because it cannot tell where the words came from.

Validity is not the problem; guessability is. Wallet makers say so plainly. Trezor’s guide to entropy says “Never choose your own wallet backup” and notes that user-chosen backups have much less entropy than device-generated ones, and Ledger advises users to always let a compliant hardware signer generate the seed phrase.

Why Are Words You Choose Easy to Guess?

People are poor random number generators. Ledger’s guide to entropy notes that research on people trying to produce random sequences keeps finding a heavy bias toward certain patterns. When people make up a phrase, they tend to:

• choose words that mean something to them or are easy to remember;
• follow a theme or tell a small story;
• put the words in grammatical order, such as noun, verb, noun;
• draw on a few hundred familiar words rather than all 2048;
• borrow from songs, books, films or quotations;
• use names, places and dates from their own lives, which helps anyone who targets them personally.

Each habit shrinks the space an attacker has to search. If all twelve words come from a pool of 500 familiar words, each word carries about 9 bits instead of 11, and the number of possible phrases shrinks by a factor of roughly 20 million, even before counting the fact that people don’t pick from that pool at random either.

Password research shows how far this goes. In a 2005 study, Arvind Narayanan and Vitaly Shmatikov of the University of Texas at Austin used Markov models of natural language to build “smart dictionaries” and recovered 96 of 142 real users’ passwords (67.6%) from a search space of just 2 × 10⁹ candidates. Their conclusion: as long as passwords remain human-memorable, they are vulnerable to such attacks even when the space of possible passwords is large.

Have Made-Up Phrases Actually Been Cracked?

Yes. Victims rarely publish the exact phrase they lost, so the best-documented cases involve brain wallets: keys derived directly from a phrase the owner made up. A BIP39 wallet adds a checksum and 2,048 rounds of PBKDF2, but the weak point is the same, a phrase a person thought of.

Literary References

At DEF CON 23 in 2015, security researcher Ryan Castellucci described what he found after running phrase lists scraped from song lyric sites, Wikiquote, Project Gutenberg and forums against the addresses on the Bitcoin blockchain (talk slides). His hits included “Down the Rabbit-Hole”, the title of the first chapter of Alice’s Adventures in Wonderland, which held about 85 BTC in July 2012, and the tongue-twister “how much wood could a woodchuck chuck if a woodchuck could chuck wood”, which held 250 BTC (about $20,000 at the time). While trying to warn that owner, Castellucci accidentally moved the 250 BTC himself, then tracked the owner down and gave it back.

Song Lyrics and Quotations

The first large-scale study of brain wallets, The Bitcoin Brain Drain (Vasek, Bonneau, Castellucci, Keith and Moore, Financial Cryptography 2016), tested about 300 billion candidate passwords, built from sources that included song lyrics and Wikiquote quotations. It found 884 brain wallets, used between September 2011 and August 2015, that had received about 1,806 BTC (roughly $103,000 at the time); 329 of them had passwords from the lyrics list. All but 21 had been drained, usually within 24 hours and often within minutes, and around a dozen competing “drainers” were emptying brain wallets as soon as they were funded. Castellucci’s own tests were blunter: money sent to a brain wallet whose passphrase appeared on common word lists, in song lyrics or on Wikiquote was swiped within seconds.

Phrases That Looked Strong

The first brain wallet in that study, seen in September 2011, used the passphrase “one two three four five six seven”. Castellucci’s slides note that a password-strength estimator rated it at 92.9 bits, “centuries to crack”. A phrase can feel random to the person who chose it and still sit near the top of an attacker’s list.

How Much Entropy Does a Made-Up Phrase Have?

Entropy measures how many equally likely possibilities an attacker faces. A properly generated 12-word phrase carries 128 bits, 2¹²⁸ (about 340 undecillion) possible phrases; a 24-word phrase carries 256 bits. Self-made phrases are hard to study directly, but research on human-chosen passwords shows how low it can go: in a USENIX Security 2014 paper, Joseph Bonneau of Princeton University and Stuart Schechter of Microsoft Research note that empirical estimates of the min-entropy of user-chosen passwords can be as low as 10 bits or fewer.

Nobody can measure the entropy of one particular self-made phrase, so the figures for human-made phrases below are assumptions for illustration, not measurements. The last column assumes an attacker who tests one billion phrases per second:

The checksum adds no protection here: anyone can compute it, and it exists only to catch typos. The odds of guessing a seed phrase are worked out in more detail in a separate guide.

How Do Attackers Search for Human-Made Phrases?

They don’t try phrases at random; they try the likely ones first:

1. Phrase lists. Lyrics, quotations, book text, forum and mailing-list posts, normalized and varied with rules for capitals, punctuation and spaces, as in Castellucci’s talk.
2. Word combinations in natural order. Narayanan and Shmatikov used Markov models to skip candidate passwords that don’t resemble natural language; sequences of words can be filtered the same way.
3. Personal details. In a targeted attack, names, family, pets, places and interests become the first ingredients to try.

The tools are fast. Brainflayer, the open-source brain wallet cracker Castellucci released at DEF CON 23, tested about 130,000 passphrases per second on a single machine, and by his estimate 1,000 cloud instances could check a trillion passphrases in nine hours for about $175. BIP39’s 2,048 rounds of PBKDF2 make each guess against a seed phrase slower, but no slowdown protects a phrase that sits near the top of an attacker’s list.

What If You Don’t Trust Your Wallet’s Generator?

That worry is reasonable: generators have failed. Libbitcoin Explorer’s bx seed command (versions 3.0.0 to 3.6.0) seeded its generator with 32 bits of clock time, so there were at most about 4.29 billion possible seeds, and attackers swept around 29.65 BTC in July 2023 (Milk Sad disclosure). In July 2026 Coinkite disclosed that since a March 2021 firmware change, Coldcard devices had generated seeds with a software generator instead of their hardware one, with an estimated effective search space of about 40 to 72 bits instead of 128, and attackers regenerated the keys and stole funds. The cure for a bad generator is more randomness, not your own words.

Making Up Words vs Rolling Dice

Both take the choice away from the device, but only one keeps the randomness. Making up words replaces the generator with your own preferences, which are exactly what attackers model. Rolling dice replaces it with a physical process that has no preferences: each roll of a fair six-sided die adds log₂ 6 ≈ 2.585 bits, so 50 rolls cover the 128 bits of a 12-word phrase, and 99 rolls (255.9 bits) are the usual count for a 24-word one. Coinkite does not consider Coldcard seeds that included at least 50 fair, independent, private dice rolls at risk from its generator flaw alone; a phrase its owner made up would have had no such protection.

The dice route takes care, and the last word needs a tool because it holds the checksum. The guide to generating a seed phrase with dice covers how many rolls each length needs, two methods, a worked example on the official test vector and the last word calculator step.

Mixing Several Sources of Randomness

Some devices never rely on a single source. Trezor combines its hardware random number generator with randomness from the computer or phone, adds the Optiga secure element as a third source on the Safe 3 and Safe 5, and a fourth, the TROPIC01 chip, on the Safe 7. Trezor Suite also runs an entropy check during setup to check that the device really mixes in the randomness Suite sends. Coldcard can mix dice rolls or coin flips into its own random value.

Keeping the Words Random and Adding a Passphrase

If you want a secret that only you know, keep the random words and add a BIP39 passphrase. You choose it, but it sits on top of 128 random bits instead of replacing them, so the words stay as strong as before. Make it long anyway: for passwords and passphrases, Trezor’s guide suggests rolling physical dice to pick words from a standard list. Back it up separately, because a forgotten passphrase locks the wallet as surely as lost words.

Why Do People Still Make Up Their Own Phrases?

• Memorability. Random phrases are hard to memorize, so people create meaningful alternatives. Memory techniques for a random phrase help without weakening it, although a written backup is still needed.
• Mistrust of generators. A real concern, as the failures above show, but the answer is dice or mixed sources, not invented words.
• The illusion of control. A phrase you invented feels safer because you know where it came from. An attacker can often guess where it came from too.
• Underestimating attackers. Castellucci stressed that the woodchuck owner was not stupid: few people understand how effective cracking tools are.

How to Create a Seed Phrase Safely

• Let a device or generator make it. A hardware wallet or trusted software creates the words from a cryptographic random number generator; creating a seed phrase walks through the process step by step.
• Pick the length once. Twelve words already put guessing out of reach; 12 vs 24 words compares the two.
• Write it down offline. Use paper or steel and titanium plates, which resist fire, water and corrosion, and never photos, text files, emails or cloud storage. How to store a seed phrase compares the options.
• Test the backup by restoring the wallet from your written copy before you fund it, as the restore guide describes.
• Consider multisig for large holdings, so that no single phrase can move the funds; see how multisig works for Bitcoin.

Frequently Asked Questions

Is a phrase I made up safe if it passes the checksum?

No. The checksum only catches typos, and about 1 in 16 random 12-word combinations passes it anyway. The BIP39 checksum checker accepts a made-up phrase as readily as a random one, because it cannot see how the words were chosen.

Can I choose just the last word?

Only at random. After 11 random words, 128 last words give a valid phrase, and their 7 free bits are part of your entropy; choosing by taste throws some of them away. Let coin flips or dice choose, as the dice guide describes.

I already use a phrase I made up. What should I do?

Treat it as weak. Create a new phrase with a wallet’s generator or with dice, send a small test transaction to the new wallet, then move the rest, and keep the old backup until the transfer is confirmed.

Does a passphrase fix a made-up phrase?

Not fully. A strong passphrase makes the wallet harder to find, but the words remain as guessable as before, and Coinkite gives the same advice about its affected Coldcard seeds: a strong passphrase reduces the immediate exposure but does not repair the seed. Replace the phrase.