Entropy and Bitcoin Security: Why Randomness Is Everything

What entropy actually means

Entropy is genuine, unpredictable randomness. Not “hard to guess,” not “looks random,” but truly unpredictable, even to someone who understands exactly how it was generated. When a wallet creates your seed phrase, it needs a source of entropy to build it from.

This matters because a seed phrase isn't really 12 or 24 English words. Underneath, it's a number, picked from a source that's supposed to be as unpredictable as a fair coin flip. The words are just a human-readable way to write that number down. If the process that picks the number is even slightly predictable, the words on your paper are no safer than the flawed process behind them.

How your wallet turns randomness into keys

When you set up a new wallet, it doesn't ask you to think of a password. It generates one for you, using a random number generator built into the device or app. Good hardware wallets use a dedicated chip for this, designed specifically to produce output nobody, not even the manufacturer, could predict in advance.

That random number becomes your seed phrase, which in turn generates every private key your wallet will ever use. It's a one-way process: your wallet can turn the randomness into keys easily, but nobody can work backward from your public addresses to guess the randomness that created them. The only way in is guessing the original number directly, which is exactly what enough entropy makes impossible.

Why bigger numbers matter more than clever tricks

This same principle protects every password you've ever created, not just Bitcoin keys. A 4-digit PIN has 10,000 possible combinations, few enough that a computer can try all of them in seconds. An 8-character password mixing letters, numbers, and symbols climbs into the trillions, better, but still within reach of modern hardware given enough time. Stretch that to 16 or more genuinely random characters, and the number of possibilities grows so large that even dedicated cracking hardware would need longer than anything has existed to work through them.

Notice what's doing the work in each case: length and genuine randomness, not a clever substitution or an extra symbol tacked on the end. A password manager generating a long random string protects you far better than a memorable phrase with a few characters swapped for numbers, and the same logic scales all the way up to how Bitcoin seed phrases are built.

The scale of a Bitcoin seed phrase

Bitcoin seed phrases follow a standard called BIP-39. A 12-word seed carries 128 bits of entropy, meaning 2 to the power of 128 possible seeds. A 24-word seed doubles that to 256 bits, or 2 to the power of 256 possible seeds. Each extra bit of entropy doubles the number of possibilities, so going from 128 to 256 bits doesn't just add security, it multiplies the search space by itself 128 times over.

Written out, 2 to the power of 256 is:

115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007, 913,129,639,936

There's no everyday object large enough to compare that to, so try this instead: picture every atom in the observable universe as its own supercomputer, all of them running since the Big Bang, each checking billions of possible seed phrases every second. Added together, they still wouldn't make a meaningful dent in that number. Even a 12-word seed, at 128 bits, is already far beyond anything brute-force guessing could ever reach. The extra bits in a 24-word seed exist for margin, not because 128 bits was ever genuinely at risk.

Where this breaks down in practice

None of that math protects you if the randomness behind it isn't real. A search space of 2 to the power of 256 is meaningless if a flaw in a chip or a piece of code quietly narrows it down to something far smaller before you ever see your seed phrase. This is a question of implementation, not math, and it's the part nobody outside the manufacturer can verify just by looking at a device.

Here's what that looks like with real numbers. In 2026, a build error in a well-regarded hardware wallet's firmware caused it to skip its dedicated randomness chip and use a simple software substitute instead. Seeds that should have carried 128 bits of entropy came out with roughly 40 bits on the older devices and around 72 on the newer ones.

Read quickly, 40 out of 128 sounds like it kept a third of its protection. It kept essentially none. Every single bit you lose halves the number of possibilities, so dropping 88 bits doesn't shave the search space down, it divides it by itself dozens of times over. 128 bits is past what any computer will ever work through. 40 bits is roughly a trillion possibilities, which sounds enormous and is nothing: an ordinary machine can grind through that. The gap between “impossible forever” and “an afternoon’s work” is much narrower than the numbers make it look, which is exactly why entropy is worth understanding rather than taking on faith.

There's a second reason it worked. Your public addresses are on the blockchain for anyone to read. So an attacker didn't have to find a victim first and then break in. They could generate likely seeds, check them against every address already on the ledger, and go straight to whichever ones matched. No device access, no seed phrase, no contact with the owner. We wrote the full story up in our piece on the Coldcard security breach. The math behind BIP-39 was never the problem. The randomness feeding into it was.

The one thing you can't check yourself

Almost everything else about a wallet, you can verify with patience. You can confirm you're on the real website, check a signature on a download, compare an address on the screen against the one on your computer, send a small test amount first. Entropy is the exception. Two seed phrases, one generated properly and one generated from a broken source, look identical. There is no inspection you can run at home, and no warning light. You find out it was weak when the coins move.

That's worth sitting with, because it changes what “do your own research” can realistically mean here. Open source helps, and it's still what made the 2026 flaw findable and provable once someone looked properly. But public code isn't the same as reviewed code. The flawed function above sat in the open for five years, in a device with a reputation for exactly this kind of care, and “anyone can audit it” quietly turned into “surely someone already has.”

So the honest answer is that you can't verify your own entropy, and choosing a well-regarded brand doesn't solve that for you either. What you can do is arrange things so that being wrong about any one device isn't fatal: split the trust across more than one manufacturer, or supply the randomness yourself with dice. Both are covered below.

The cautionary tale of the brainwallet

Early in Bitcoin's history, some people skipped wallet-generated randomness entirely. They created a “brainwallet”: a private key built directly from a memorable phrase they made up themselves, like a favorite quote or a familiar sentence, on the theory that nobody could guess something only they would think of.

It didn't work. Humans are remarkably bad at generating true randomness, and the phrases people chose clustered around common quotes, lyrics, and sayings. Researchers and attackers built lists of likely phrases and swept brainwallets almost as fast as people funded them. The lesson has held up ever since: a passphrase you can remember is a passphrase you didn't randomly generate, and anything you didn't randomly generate isn't entropy.

Common questions