A private key is only as safe as the randomness that made it. Learn what entropy means, how weak randomness led to real thefts, and how to stay safe.
Keys are random numbers
A private key is just a number between 1 and about 1.16 × 10^77. Security comes entirely from the attacker not being able to guess it. That only works if it was picked truly at random.
What is entropy?
Entropy measures unpredictability, in bits. 128 bits of entropy means 2^128 equally likely possibilities, far too many to try.
| Source | Entropy | Safe? |
|---|---|---|
| 12-word seed from a good wallet | 128 bits | Yes |
| 24-word seed | 256 bits | Yes |
| A memorable phrase you thought of ("brain wallet") | Very low | No |
| A key from a buggy random generator | Unknown | No |
Real failures
- Brain wallets: attackers run dictionaries, song lyrics and famous quotes through hash functions and sweep any funds instantly.
- Weak generators: some early wallet software reused ECDSA signatures nonces or produced predictable keys, and funds were stolen.
Good practice
Let well-reviewed wallet software or a hardware wallet generate your seed. Never make one up, and never use a seed you've seen anywhere else.
How much is 128 bits?
2^128 is about 3.4 × 10^38. If a billion computers each guessed a billion keys per second, checking every 128-bit possibility would still take more than ten trillion years.
Checklist for a safe seed
- Generated by a reputable wallet or hardware device.
- Created on a device you trust, not a website.
- Never typed into a computer or phone after backup.
- Never chosen, edited or "improved" by you.
Key takeaways
- Key security depends entirely on true randomness.
- 128 bits of entropy is far beyond brute force.
- Human-chosen phrases and buggy generators have led to real thefts.
Common questions
Can I roll dice to create a seed?
Yes, it's a known method if done carefully, with enough rolls and correct conversion. Most people should let a hardware wallet do it.
How likely is it that someone else gets my key?
With proper randomness, the chance is so small it's not worth considering.
Can I create my own seed words?
You shouldn't pick words yourself; humans are bad at randomness and the last word must include a checksum.
Is 24 words safer than 12?
Both are far beyond brute force. 24 words adds margin but is not necessary for most people.