Brainwallet

Brainwallet.

A brainwallet is a method of deriving cryptocurrency keys from information a person attempts to remember. In its classic Bitcoin form, a user chooses a word, quotation, or passphrase and hashes it to obtain a private key. This method is unsafe because human-chosen text has far less unpredictability than a cryptographic key and can be tested by attackers without interacting with the owner.

The term is also sometimes used for memorizing a wallet-generated recovery phrase. That is a different construction: a recovery phrase encodes random entropy generated by wallet software, whereas a classic brainwallet starts with words chosen by the user. Relying on memory as the only backup still creates a serious risk of permanent loss.

Security warning: Do not create or fund a classic brainwallet. Do not test a real passphrase, recovery phrase, seed, or private key on a website. Examples published in articles, videos, source code, or demonstrations must be assumed compromised.

How classic brainwallets work

Early brainwallet tools commonly applied a hash such as SHA-256 to a user-selected phrase and interpreted the result as a Bitcoin private key. The associated public key and address could then be calculated deterministically. The process required no stored key file, which made it appear resistant to device loss or theft.

The design moves the security problem to the memorized phrase. An attacker can assemble dictionaries, quotations, song titles, leaked passwords, spelling variants, keyboard patterns, and language-specific word lists; derive each candidate key; and check the public blockchain for funds. These guesses are performed offline and at high speed. A long or unusual-looking sentence is not necessarily unpredictable, and adding a few substitutions or punctuation marks does not provide measurable cryptographic entropy.

Evidence of exploitation

Vasek, Bonneau, Castellucci, Keith, and Moore conducted a large-scale study of Bitcoin brainwallet use. After evaluating about 300 billion candidate passwords and excluding research activity, they identified 884 brainwallets used between September 2011 and August 2015. All but 21 had been drained; many were emptied within minutes and most within 24 hours. The researchers observed multiple drainers competing to spend funds from weak keys.

Ryan Castellucci demonstrated the attack model publicly at DEF CON 23 and released brainflayer, a proof-of-concept tool that tests candidate phrases using Bitcoin's secp256k1 public-key derivation. The tool did not break Bitcoin's cryptography: it automated guesses drawn from the much smaller space of human choices.

Why strengthening the hash is not enough

Some later designs added salts or memory-hard password-derivation functions to make each guess more expensive. Such controls can materially slow an attacker when they are specified and implemented correctly, but they do not make a predictable phrase equivalent to a uniformly random secret. Their protection depends on the phrase, parameters, salt, implementation, and the attacker's resources.

Custom schemes add another risk: if the exact normalization, character encoding, capitalization, salt, or parameters are forgotten, the same words may derive a different key. A private construction may also receive little review and become impossible to reproduce after its software disappears. For those reasons, a “hardened brainwallet” should not be presented as a replacement for securely generated wallet entropy and a tested backup.

Recovery phrases are different

BIP 39 recovery phrases encode 128 to 256 bits of wallet-generated entropy plus a checksum and derive a seed using PBKDF2-HMAC-SHA512. The specification explicitly describes the words as a transport for computer-generated randomness, not as a way to process user-created sentences. Other wallets use different recovery-code schemes. In all cases, the security comes from the wallet's random entropy and reviewed derivation process, not from a person inventing memorable words.

Mastering Bitcoin distinguishes recovery codes from brainwallets on this basis: recovery words are created randomly by the wallet, while brainwallet words are selected by the user. A recovery phrase is a complete secret backup and must never be disclosed.

An optional BIP 39 passphrase creates a different seed for every value entered. It can therefore provide an additional secret, but it also creates another permanent-loss risk: there is no universal account-recovery service and an incorrect passphrase can open an apparently valid but different wallet. It should not be confused with choosing the recovery words themselves.

Human-memory and continuity risks

Even a secret that initially had enough entropy can be lost through ordinary human events. Exact recall may change with time, illness, injury, stress, aging, changes in language, or a misunderstood mnemonic aid. Memory-only custody also creates difficult inheritance and incapacity problems. Conversely, coercion can defeat the assumption that a memorized secret leaves nothing to steal.

Memorizing wallet-generated recovery material may be an additional personal safeguard, but it should not be the only tested recovery method unless the owner has deliberately accepted the risks of forgetting, incapacity, death, coercion, and inheritance failure. A durable plan normally separates secure random generation from redundant, physically protected, tested recovery.

Safer practice

• Use maintained wallet software or a hardware signing device that generates entropy securely.
• Record the wallet's recovery material exactly as instructed and keep it offline in physically protected storage.
• Never photograph, email, upload, or paste a recovery phrase into a website, support conversation, or AI system.
• Test the recovery process using the wallet's documented procedure and a safe environment before relying on the backup.
• Preserve the wallet type and other non-secret metadata needed for recovery.
• Consider loss, theft, fire, coercion, incapacity, and inheritance as separate parts of the threat model.
• If a classic brainwallet or publicly exposed example has ever held funds, treat its key as compromised and move any remaining funds to a newly generated wallet.

Historical and educational value

Brainwallets are an important example of the difference between mathematical key size and effective security. Bitcoin's private-key space is extremely large, but a key derived from a common quotation occupies a small, attacker-prioritized set of guesses. The episode also illustrates why security claims must examine entropy generation, backup behavior, software compatibility, and user interfaces rather than cryptographic algorithms alone.

Older tutorials often included a worked phrase, derived key, and address. Repeating such a walkthrough provides little encyclopedic value and creates a predictable key that readers may mistakenly fund. The useful lesson is the attack model and the historical evidence, not a reusable secret-generation recipe.

See also

• Private key
• Mnemonic phrase
• Bitcoin wallet
• Cold storage
• Password cracking