Passphrase → private key (brainwallet)

What this page computes

It takes a passphrase and derives a complete Bitcoin wallet from it with a single SHA-256 call. That is the whole algorithm — there is no salt, no iteration count, and no memory-hardness parameter:

The page is deliberately complete: it shows the input bytes, the digest, and every derived value, so that you can see exactly how little stands between a sentence you can remember and a private key. It is also deliberately one-sided about the consequences — see below.

1. The brainwallet idea, and why it feels so appealing

Bitcoin private keys are just 256-bit numbers, and any deterministic function of a memorable string can produce one. That gives an irresistible pitch: no paper backup, no metal plate, no seed phrase to lose — the wallet lives in your head and can be re-created anywhere on earth, from any computer, forever. Whole blog posts of 2011–2013 recommended it.

The flaw is not in the hashing. The flaw is in the word memorable. A private key has to be unpredictable to an attacker; a phrase you can recall without notes is, by construction, a phrase that comes from the tiny and heavily documented region of language space that humans find memorable. You have not created 256 bits of secret — you have created a lookup entry.

Two failure modes cover essentially every real brainwallet loss:

• Precomputation. An attacker hashes millions of candidate phrases once, derives the addresses, and stores them. From then on, any deposit to any of those addresses is detected instantly — it does not matter that the phrase was "secret", because the attacker never needed to guess it again.
• Targeted search. If your phrase is personal, an attacker who knows something about you ("a fan of Tolkien, likes horses") searches a far smaller space than 2²⁵⁶. Because one SHA-256 is all it costs per guess, that space is cheap to enumerate.

2. Why a single unsalted SHA-256 is a catastrophic key-derivation function

SHA-256 is a fast, general-purpose hash. Its designers optimised it for exactly the property that makes a key-derivation function fail: maximum throughput per second per dollar. When you hash a phrase once and spend the result, the attacker's cost to test one guess is one SHA-256 evaluation — measured in nanoseconds, and on dedicated silicon in picoseconds.

That last row is the whole story. Hash functions do not create unpredictability; they preserve the unpredictability of their input, and they preserve the predictability of it just as faithfully.

The arithmetic of a dictionary attack

Suppose an attacker has a corpus of 10,000,000 candidate phrases (a downloaded password list, famous quotes, song lyrics, Wikipedia sentences, plus every phrase ever posted about brainwallets). The time to exhaust it is simply corpus ÷ throughput, and raw SHA-256 throughput is enormous:

Read the top row again: a corpus of ten million phrases is exhausted in minutes on one CPU core. The bottom row is why sweepers are described as instantaneous. And notice what the same corpus costs against real key-derivation functions — the only thing that changes is the price of one guess:

The last two rows are qualitative on purpose: their cost is set by how much memory the attacker can afford to fill, not by how many hashes they can compute, so a single number would be misleading. That is exactly the point of a memory-hard KDF.

3. Human-chosen phrases have tens of bits of entropy, no matter how long they look

Entropy is not a property of a string; it is a property of the process that chose it. If you had generated the sample phrase by rolling dice over 95 printable characters, its 28 characters would carry 28 × log₂(95) ≈ 184 bits and it would be unbreakable. But you did not: you, or the author of the blog post, chose a sentence that other humans find memorable, and the set of such sentences is small and extensively catalogued. The string is long; the choice was short.

The search-space column is order-of-magnitude illustration, not measurement — but the arithmetic that converts it into time is exact, and that is the argument. Moving from "four common words" to "twelve words drawn from a 2048-word list" changes the attacker's job from hours to more than the age of the universe, because the entropy went from 44 bits to 128 bits. Memorability and entropy pull in opposite directions: every trick that makes a phrase easier for you to recall makes it easier for a wordlist to contain.

4. The historical record: the sweepers

Between roughly 2013 and 2015 brainwallets were not merely risky — they were actively farmed. Automated sweeper bots worked the problem at both ends:

• Offline: hash enormous candidate lists, derive the addresses once, and keep the resulting set. This is a one-time cost that then answers every future deposit instantly.
• Online: watch every new block — and often the mempool, before a block is even mined — for an output paying one of those addresses. The moment one appears, broadcast a spend of it with a higher fee so that the sweeper's transaction confirms first. Deposits were emptied in seconds, and in many documented cases the money never even reached a confirmed balance in the victim's own wallet.

The practice was studied academically. In The Bitcoin Brain Drain (Vasek, Bonneau, Castellucci, Keith and Moore, Financial Cryptography 2016) the authors scanned the blockchain for passphrase-derived addresses, found several hundred that had ever been funded, and reported that the great majority had been drained by attackers — press coverage of the paper put the stolen total at roughly $103,000. The specific figure matters far less than the pattern: funded brainwallets were emptied, nearly universally, and usually within minutes or seconds.

Meanwhile, the phrases that were famous enough to appear in tutorials — the XKCD sentence used as the sample on this page, the first lines of well-known books and songs, anything repeated in a forum thread — were derived by thousands of people and swept years ago. Publishing a brainwallet is the same as donating it. The address shown in the results panel for the sample phrase has been republished countless times; treat it as burned, because it is.

5. What a properly designed KDF does instead

Password-based key derivation functions are engineered to be expensive for the attacker while staying tolerable for the legitimate user:

• A salt — random per user, stored next to the ciphertext — makes precomputation useless and ensures that two people with the same passphrase get different keys. BIP39 uses a deterministic salt ("mnemonic" ‖ passphrase) precisely because the wallet must be re-derivable; the entropy of the words has to carry the security instead.
• An iteration count multiplies the cost of a single guess. Raising it from 1 to 2048 makes each guess 2048 times more expensive; raising it to two million makes brute force 2,000,000 times slower. This is the parameter that fights GPUs and ASICs, and it is why a brainwallet with one hash is indefensible: the attacker is running the cheapest possible inner loop.
• Memory hardness attacks the economics of parallel hardware. A GPU can run thousands of SHA-256 cores because SHA-256 needs a few dozen bytes of state; scrypt and Argon2id require megabytes per guess, so throughput becomes a memory-bandwidth and RAM-capacity problem instead of a raw-hash-rate problem. Argon2id (the 2015 Password Hashing Competition winner, standardised in RFC 9106) adds tunable memory and parallelism on top of the iteration count.

Note carefully, though: BIP39 uses only 2048 PBKDF2 iterations. That is not a strong KDF setting, and it is not meant to be. BIP39 does not depend on the KDF for security — it depends on 128–256 bits of entropy that the words encode, plus an optional passphrase that acts as a salt. The lesson generalises: choose an input with real entropy and a KDF that is expensive; neither alone is enough.

6. Brainwallet vs BIP39 mnemonic vs random key

7. Worked example: the XKCD phrase

The sample in the input box is the famous four-word sentence from XKCD #936, and this is exactly what the form above computes for it — the real values, reproducible right here:

Notice how complete the wallet looks. That is the trap: the output is indistinguishable from a properly generated wallet. Nothing in the address, the WIF or the checksum reveals that the key behind it came from a sentence that half the internet has already hashed. The only thing that distinguishes a safe wallet from this one is where the key came from.

8. Common mistakes

• "It is long, therefore it is strong." Length is not entropy. A 60-character quote has less real entropy than three dice-chosen words.
• "I added a symbol and a number." Every cracker applies those rules automatically; a mangling rule list is a standard feature, not a defence.
• "Nobody knows my sentence." If it is from a book, a film, a song, a forum post or your own social media, somebody — or somebody's corpus — knows it. If you invented it, it followed a human-generated pattern, and those are modelled too.
• "The blockchain is anonymous, so nobody will find it." The opposite is true: the blockchain is a permanently public, machine-readable list of exactly which addresses received money, and sweepers read all of it.
• "I will remember it forever." Memory is the least reliable storage medium humans have. People forget phrases, lose interest in the project, or die; the coins stay forever.
• Confusing this with a memory-hard KDF. Iterating a hash 200,000 times in your head is not the same as a KDF designed against GPUs — and if the input has 30 bits of entropy, no KDF saves it.

9. Quick reference