How Long Does It Take to Brute Force a Seed Phrase
How Long Does It Take to Brute Force a Seed Phrase
How long does it take to brute force a seed phrase when none of the words are known? For a full 12-word phrase, longer than any realistic attacker can wait, because the search space is so large that checking every combination would take far longer than a human lifetime, even with very powerful computers. Brute force only becomes a real risk when an attacker already knows most of the words, their order, or other clues that shrink the search dramatically.
The maths behind a 12-word phrase
A seed phrase is not a password a person chose, which another person could guess by trying common options. It is generated from random numbers, and the words are a readable encoding of that randomness. A 12-word BIP39 phrase has 128 bits of entropy. The word list contains 2048 words, and each word carries 11 bits of information. Twelve words encode 132 bits in total, with the final bits acting as a checksum that helps a wallet detect a mistyped word.
128 bits of entropy means there are 2 to the power of 128 possible combinations: 340,282,366,920,938,463,463,374,607,431,768,211,456. An attacker is not looking for one likely phrase among millions, but for one exact phrase among more possibilities than anyone can picture. The checksum removes some invalid combinations, but the search is still defined by those 128 bits.
How long does it take to brute force a seed phrase with no clues
No single time figure is exact, because speed depends on the hardware and on how efficiently each guess can be tested. Even if an attacker could test one trillion complete phrases every second, working through the full 128-bit space would still take far more than billions of years. Making the machine a million times faster still leaves a search that does not finish on any human timescale.
That is why the answer is often given as effectively never. It does not mean the phrase is protected by magic. It means the maths puts a complete search out of reach, so a rational attacker does not attempt it. They look for a copy of the phrase, a screenshot, a careless backup, or a victim they can trick into typing the words into a fake app.
Testing is also slowed a little by design. Turning a phrase into a wallet involves a key stretching step that uses 2048 rounds of hashing, which makes each check more costly than a single quick operation. The main protection is still the size of the search space. The wider security routine is covered in the Never Lose Bitcoin guides.
When brute force gets much faster
The picture changes completely when part of the phrase is known. Each unknown word adds roughly a factor of 2048 to the search, before the checksum narrows some options, so removing words from the unknown set cuts the work fast. If an attacker knows 11 of your 12 words and their positions, only one word is missing, and that is a small search a computer can finish quickly. If two words are missing in known positions, the search is in the millions of combinations, which is also practical.
With three or four words missing, the search grows into the billions and beyond, and the time depends on other clues: the positions of the missing words, the order of the known words, and which address to test each guess against. A partially exposed backup is protected only by the part that stayed secret. If several words may have been seen, treat it seriously, as covered in how to check if someone copied your seed phrase, and consider moving to a fresh wallet.
What about 24-word phrases and passphrases
A 24-word BIP39 phrase has 256 bits of entropy, which makes a complete search vastly harder again. In practice, a correctly generated 12-word phrase is already far beyond brute force when no words are known. The extra words mainly add margin, but they also add backup length and more chances to record a word wrongly if the process is rushed.
A passphrase, sometimes called the 25th word, works differently. It is not chosen from the 2048-word list, and the same seed phrase plus a different passphrase creates a different wallet. If the passphrase is long, unique, and never stored with the phrase, an attacker who obtained all the words still cannot reach that wallet without also guessing the passphrase. If the passphrase is a pet name, a date, or a single common word, it adds little, because an attacker will try those first. Only use one if you can record and recover it reliably, since losing it can lock you out of your own wallet.
How attackers actually get seed phrases
Real losses rarely come from brute force. They come from exposure. A photo in a phone gallery, a phrase typed into a note app, a backup left where visitors can find it, or a fake support message that sends the owner to a website asking for the words will all hand an attacker the complete phrase at once. No search is needed when the victim delivers the answer.
Malware is another route. If a phrase is typed or stored on a compromised computer or phone, an attacker may capture it directly. That is why a phrase should be generated and restored only on a trusted device, ideally a hardware wallet, and should stay offline on paper or metal. The risks of a digital copy are covered in is storing a seed phrase in a password manager safe. A digital copy turns a maths problem that favours you into a file copying problem that favours the attacker.
How to keep brute force irrelevant
Keep the full phrase unknown, so an attacker would face the full search space and choose an easier target. Generate the phrase offline on a device you trust. Write it down carefully, check each word against the device, and store the backup in a private place that protects it from fire, water, and casual discovery.
Never enter the phrase into a website, a search box, or an app sent to you by message. Never photograph it, and never read it aloud where a phone or smart speaker could be listening. If you need to test recovery, follow a safe offline process, as in how to test your seed phrase backup without risking funds.
Protect the clues as well as the words. Do not store parts of the phrase in cloud notes, do not label a backup with your balance, and do not tell people where the pieces are. With no leaked words, order, or location, brute force is the only route left, and it leads nowhere in a lifetime.
Réponses rapides
How long does it take to brute force a 12-word seed phrase? With no words known, a complete search of the 128-bit space is not practical on any human timescale, even with extremely fast hardware. It becomes practical only when most of the phrase is already known.
Can a computer guess my seed phrase? A computer can try combinations, but guessing a full, correctly generated 12-word phrase from nothing is effectively out of reach. Computers succeed when they are given most of the words, the order, or a leaked digital copy.
Is a 24-word phrase much safer against brute force? Yes, it has 256 bits of entropy, so the search space is far larger. In practice, a secret 12-word phrase is already beyond brute force, and safe handling matters more for most people.
What if an attacker knows some of my words? The risk rises fast. One or two missing words in known positions can be searched quickly. If several words may have been exposed, move your bitcoin to a new wallet with a fresh phrase.
Does a passphrase stop brute force? A strong, separate passphrase creates a different wallet and adds a secret an attacker must also guess. A weak or stored passphrase adds little. Only use one if you can back it up and recover it reliably.
