Entropy and Bitcoin Security: Why Randomness Is Everything
Every Bitcoin wallet rests on one quiet assumption: that the randomness behind your keys is real. Here's what entropy actually is, how your wallet uses it, and why it matters more than almost anything else in Bitcoin security.
What entropy actually means
Entropy is genuine, unpredictable randomness. Not “hard to guess,” not “looks random,” but truly unpredictable, even to someone who understands exactly how it was generated. When a wallet creates your seed phrase, it needs a source of entropy to build it from.
This matters because a seed phrase isn't really 12 or 24 English words. Underneath, it's a number, picked from a source that's supposed to be as unpredictable as a fair coin flip. The words are just a human-readable way to write that number down. If the process that picks the number is even slightly predictable, the words on your paper are no safer than the flawed process behind them.
How your wallet turns randomness into keys
When you set up a new wallet, it doesn't ask you to think of a password. It generates one for you, using a random number generator built into the device or app. Good hardware wallets use a dedicated chip for this, designed specifically to produce output nobody, not even the manufacturer, could predict in advance.
That random number becomes your seed phrase, which in turn generates every private key your wallet will ever use. It's a one-way process: your wallet can turn the randomness into keys easily, but nobody can work backward from your public addresses to guess the randomness that created them. The only way in is guessing the original number directly, which is exactly what enough entropy makes impossible.
Why bigger numbers matter more than clever tricks
This same principle protects every password you've ever created, not just Bitcoin keys. A 4-digit PIN has 10,000 possible combinations, few enough that a computer can try all of them in seconds. An 8-character password mixing letters, numbers, and symbols climbs into the trillions, better, but still within reach of modern hardware given enough time. Stretch that to 16 or more genuinely random characters, and the number of possibilities grows so large that even dedicated cracking hardware would need longer than anything has existed to work through them.
Notice what's doing the work in each case: length and genuine randomness, not a clever substitution or an extra symbol tacked on the end. A password manager generating a long random string protects you far better than a memorable phrase with a few characters swapped for numbers, and the same logic scales all the way up to how Bitcoin seed phrases are built.
The scale of a Bitcoin seed phrase
Bitcoin seed phrases follow a standard called BIP-39. A 12-word seed carries 128 bits of entropy, meaning 2 to the power of 128 possible seeds. A 24-word seed doubles that to 256 bits, or 2 to the power of 256 possible seeds. Each extra bit of entropy doubles the number of possibilities, so going from 128 to 256 bits doesn't just add security, it multiplies the search space by itself 128 times over.
Written out, 2 to the power of 256 is:
115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007, 913,129,639,936
There's no everyday object large enough to compare that to, so try this instead: picture every atom in the observable universe as its own supercomputer, all of them running since the Big Bang, each checking billions of possible seed phrases every second. Added together, they still wouldn't make a meaningful dent in that number. Even a 12-word seed, at 128 bits, is already far beyond anything brute-force guessing could ever reach. The extra bits in a 24-word seed exist for margin, not because 128 bits was ever genuinely at risk.
Where this breaks down in practice
None of that math protects you if the randomness behind it isn't real. A search space of 2 to the power of 256 is meaningless if a flaw in a chip or a piece of code quietly narrows it down to something far smaller before you ever see your seed phrase. This is a question of implementation, not math, and it's the part nobody outside the manufacturer can verify just by looking at a device.
We wrote a full breakdown of exactly this happening to a well-regarded hardware wallet in our piece on the Coldcard security breach. A firmware bug caused some devices to generate keys in a predictable way instead of a truly random one, and an attacker who found the flaw drained affected wallets without ever touching the owner's device. The math behind BIP-39 was never the problem. The randomness feeding into it was.
The cautionary tale of the brainwallet
Early in Bitcoin's history, some people skipped wallet-generated randomness entirely. They created a “brainwallet”: a private key built directly from a memorable phrase they made up themselves, like a favorite quote or a familiar sentence, on the theory that nobody could guess something only they would think of.
It didn't work. Humans are remarkably bad at generating true randomness, and the phrases people chose clustered around common quotes, lyrics, and sayings. Researchers and attackers built lists of likely phrases and swept brainwallets almost as fast as people funded them. The lesson has held up ever since: a passphrase you can remember is a passphrase you didn't randomly generate, and anything you didn't randomly generate isn't entropy.
What this means for you
- Let your wallet generate your seed phrase. Never invent your own words or phrase, and never use a seed phrase someone else gives you.
- Favor wallets that are open source and well-established, so independent researchers have had the chance to check the code that generates your keys.
- For amounts that would genuinely hurt to lose, don't trust one vendor's randomness with everything. Multisig across multiple manufacturers means one vendor's flaw, whichever vendor it turns out to be, can't empty your wallet.
- If you want to remove trust in any device's randomness entirely, it's possible to build a seed phrase from your own physical dice rolls instead. It's slow and unforgiving of mistakes, and most people don't need it, but it exists for exactly this reason.
Common questions
Is entropy just another word for randomness?
Close enough for everyday purposes. Technically entropy is a measure of how unpredictable something is, and true randomness is what gives you high entropy. When people say a wallet needs good entropy, they mean it needs genuinely unpredictable randomness to build your keys.
Can I check whether my wallet's randomness is trustworthy?
Not directly. You can't open a chip and measure its randomness yourself. What you can do is favor wallets that are open source, well-established, and reviewed by independent security researchers, and avoid trusting any single device with an amount that would hurt to lose.
Does a 24-word seed phrase give you more security than a 12-word one?
Yes. A 12-word seed carries 128 bits of entropy, a 24-word seed carries 256. Both numbers are already far beyond what anyone could brute-force, but 24 words gives you a wider margin, which is why many wallets default to it.
What's a brainwallet, and why is it a bad idea?
A brainwallet is a private key created directly from a memorable phrase someone made up themselves, instead of from a wallet's random number generator. Humans are bad at generating randomness, so brainwallets built from common phrases have historically been guessed and drained almost immediately. Always let your wallet generate your seed phrase.