Can a 12-Word Seed Phrase Be Brute Forced?
Can a 12-Word Seed Phrase Be Brute Forced?
No. A 12-word seed phrase cannot be brute forced with any computer that exists or will exist in any foreseeable future. The phrase carries 128 bits of entropy, which means there are 2^128 possible combinations, a number so large that guessing through it would take far longer than the age of the universe. If someone tells you your bitcoin is at risk from brute force, they are either misunderstanding the math or trying to sell you something.
This question comes up because “12 words” sounds short. Twelve words is shorter than a password of twelve random characters, and wallets hand you those words on a single screen. It feels flimsy. But the strength of a seed phrase has nothing to do with how it looks and everything to do with how many possibilities the attacker must check.
How many seed phrases exist: the brute force math
Every word in a standard seed phrase comes from the BIP39 wordlist, a fixed list of 2,048 English words. A 12-word phrase is therefore drawn from 2,048^12 possibilities. That works out to 2^132 raw combinations, and because the last word contains a 4-bit checksum, the number of valid phrases is 2^128. That is roughly 340 undecillion, a 3 followed by 38 zeroes.
Now imagine an attacker with absurd resources: one trillion guesses per second, sustained for the entire 13.8-billion-year age of the universe. They would check roughly 4.3 x 10^29 phrases, against 3.4 x 10^38 possibilities. They would cover about one ten-millionth of one percent of the search space. To reach even a 50/50 chance, they would need to repeat that whole exercise hundreds of millions of times.
Adding more machines does not change the picture. Neither does a thousand years of computing progress. The numbers are not “very big” the way a million is very big; they are big in a way that swallows every realistic amount of hardware and time.
What brute forcing a seed phrase would actually require
It helps to see why the attack is not just slow but structurally hopeless. A brute-force attempt is not a single guess. For each candidate phrase, the attacker must generate a valid phrase (only 1 in 16 random combinations passes the checksum), run the key-derivation function to produce the master key and addresses, and then check each derived address against the full history of the Bitcoin blockchain, because an address with no history is indistinguishable from an unused wallet. Every step multiplies the cost. Attackers do not spend money this way when easier targets exist, and for seed phrases, easier targets always exist: the person holding the phrase.
When the math breaks down: partial knowledge
There is one scenario where brute force becomes realistic, and it is worth understanding because it defines what you must protect. The 2^128 number assumes the attacker knows nothing. Every word they learn cuts the search space dramatically.
If an attacker learns 4 of your 12 words, and knows their positions, 8 words remain unknown. That is 2,048^8, or 2^88 possibilities. Still far beyond brute force. But if they learn 8 words, only 4 remain unknown: 2,048^4 is about 1.8 x 10^13, roughly 18 trillion combinations. That is within reach of serious hardware. And if they learn 10 words, the remaining 2^22 (about 4 million) can be cracked in seconds on a laptop.
This is why partial leaks matter so much. A photo that shows most of your phrase, a thief who glimpsed part of your backup, a relative who memorized a few words, any of these turn an impossible attack into a practical one. The checksum helps the attacker here too: it lets them discard invalid candidates cheaply. The practical lesson is simple and strict: treat every word of the phrase as equally secret, because secrecy of the whole phrase is what the math depends on.
The same logic applies to sloppy splitting schemes. If you split your phrase across two locations and one copy is stolen, the attacker holds 6 words and faces 2,048^6, about 7 x 10^19 combinations. That is still out of reach, but it is dramatically weaker than the full 2^128, and it is one more reason to think carefully about how you split. Read the guide to splitting a seed phrase across two locations before cutting your backup in half.
The real threats are not brute force
Since brute force is off the table, attackers go after the phrase itself. Every real-world seed phrase theft falls into one of a few patterns, and all of them are things you can defend against:
Theft of the physical backup. Burglars look in the obvious places: desk drawers, safes, bookshelves, nightstands. A backup that is easy for you to grab is easy for a thief to grab. Hiding spots matter, and the guide to hiding a seed phrase from burglars covers what actually works.
Digital copies. Photos of the phrase, notes in cloud-synced apps, screenshots, email drafts: anything digital can be copied silently and perfectly. Malware on phones and computers specifically hunts for seed phrases. The phrase should never exist as a file, a photo, or a message.
Phishing and social engineering. Fake wallet support, fake “verify your wallet” sites, fake firmware updates: the goal is always to get you to type the phrase somewhere. No legitimate wallet or support agent will ever ask for your seed phrase.
Physical coercion. The unpleasant one. If someone knows you hold significant bitcoin and knows where you live, the attack is not on the math, it is on you. This is the actual reason many security guides recommend discretion about holdings and decoy or passphrase-protected setups for larger amounts.
Notice what all of these have in common: they attack the human, not the cryptography. Your security budget should go toward protecting the physical backup and your own operational habits, not toward worrying about brute force.
Does a longer phrase or a passphrase help?
A 24-word phrase carries 256 bits of entropy. For brute-force purposes it adds nothing practical over 12 words, since 12 words are already past the “impossible” threshold. Its real benefit is resistance to partial leaks: with more words, each exposed word costs the attacker less of the total search space.
A passphrase (sometimes called the 25th word) is a different tool. It is an extra secret combined with the phrase during key derivation, so an attacker who steals your 12 words but does not know the passphrase cannot derive your wallet at all. That genuinely protects against physical theft of the backup, but it introduces its own risk: a forgotten passphrase is unrecoverable, and there is no checksum to catch typos. Use one only if you understand the trade-off and have a plan for the passphrase itself. The bitcoin self-custody guides hub walks through the full setup, from generation to durable backups.
Quick answers
Can a 12-word seed phrase be brute forced? No. With 2^128 possible phrases, no existing or foreseeable computer can guess through a meaningful fraction of the combinations.
What about quantum computers? A sufficiently advanced quantum computer running Grover’s algorithm could theoretically reduce the search to 2^64 operations, which would still be an enormous undertaking and remains far beyond current or near-term hardware. It is not a reason to change your setup today, but it is a reason to keep an eye on the field over decades.
Can someone brute force my phrase if they know some of the words? Yes, this is the real danger. Each known word shrinks the search space exponentially. With 10 of 12 words known, the rest can be brute forced in seconds. Keep every word secret.
Is a 24-word phrase safer against brute force? Technically yes, practically no difference: a 12-word phrase is already far past the point where brute force is feasible. Choose 24 words for partial-leak resistance, not for anti-brute-force reasons.
Should I worry about someone randomly guessing my phrase? No. The chance of a random guess hitting your funded wallet is vastly smaller than the chance of being struck by lightning on a clear day while winning the lottery. Worry about theft, phishing, and bad backups instead.
