12 or 24 words? Seed phrase math, passphrases and quantum computers

12 or 24 words: what's the difference?

Your recovery words are a big random number written in a form people can copy. Under the BIP-39 standard, the wallet first picks 128 or 256 random bits (the "entropy"). It adds a short checksum taken from a SHA-256 hash of those bits, then cuts the result into 11-bit pieces. Each piece picks one word from a fixed list of 2,048 words (BIP-39).

The math checks out: 128 + 4 = 132 bits, and 132 ÷ 11 = 12 words. 256 + 8 = 264 bits, and 264 ÷ 11 = 24 words. Because the last word carries the checksum, only about 1 in 16 random lists of 12 words is valid (1 in 256 for 24 words). That's why you never invent your own words. BIP-39 says it's meant to carry computer-generated randomness, not "user-created sentences" (BIP-39).

Why 12 words is already enough

• Bitcoin's keys top out at about 128 bits anyway. The secp256k1 curve that Bitcoin's keys use is rated at 128-bit security strength (SEC 2). Trezor puts it simply: 12 words give 128-bit security, "equivalent to Bitcoin's private key strength" (Trezor).
• 24 words is "vastly more than needed." That's Trezor's own description. It used 24 words on its oldest model because recovery words were typed on a computer, and says that on newer devices, which take the words directly, "12 words are enough" (Trezor).
• 128 bits is the benchmark even for the quantum era. NIST uses a brute-force search for a 128-bit key (AES-128) as the yardstick for its lowest post-quantum security category (NIST IR 8547 draft).
• Already have 24 words? Keep them. Nothing is wrong with 24. It's just more words to write down, stamp into metal and check. See Seed phrase backup.

Real story: the math only works if the randomness is real. In 2023, researchers found that a wallet tool called Libbitcoin Explorer (bx) asked for 256 random bits but started from only 32 bits of clock time, so at most 2³² ≈ 4.3 billion possible starting points (Milk Sad). That's few enough for a computer to try every one; at a hypothetical million guesses a second, the whole list takes about 72 minutes. Thieves emptied affected wallets on July 12, 2023. In 2026, a firmware flaw in some COLDCARD devices made weak seeds that attackers recomputed offline (Coinkite), with more than 1,830 BTC swept from more than 9,000 addresses by Galaxy Research's Oct 16, 2026 count (Galaxy Research; see Security Status). In both cases the cause was weak randomness, not too few words. Use a reputable device on current firmware, and check our Security Status page.

The passphrase: an optional "25th word"

A passphrase is extra text you choose yourself and add on top of your recovery words. When the wallet turns your words into the secret seed, BIP-39 mixes in the passphrase (it runs 2,048 rounds of a function called PBKDF2 using HMAC-SHA512). No passphrase means an empty one (BIP-39). It isn't really a 25th word from the list. On Trezor's newer models it can be any characters, up to 128 of them (Trezor).

Benefits

• Protection if your words are found. Someone who finds your recovery words but not the passphrase opens only the no-passphrase wallet (Trezor).
• A hidden wallet. Every passphrase produces a valid wallet, and only the right one shows your funds. BIP-39's authors call this "plausible deniability" (BIP-39).

Risks

• Forget it and the funds are gone. Trezor says passphrases "cannot be changed, removed, or recovered" (Trezor). No company can reset it.
• A typo creates a different valid wallet. "Every passphrase you enter creates a different wallet, even if it's a typo or mistake" (Trezor). Capital letters and spaces count. Write down your wallet's master fingerprint or first receive address so you can confirm you've opened the right wallet.
• It needs its own backup. Store it separately from the words, so one find doesn't expose both. Your heirs also need to know it exists (Inheritance planning).

How strong should it be? A passphrase only matters once someone already has your words, and at that point it's the only thing left to guess. EFF's dice method gives six random words from a 7,776-word list, about 2⁷⁷ possibilities (EFF). At a hypothetical trillion guesses a second, that takes about 3,500 years on average, and eight words takes about 212 billion years. Your pet's name or a song lyric could fall in seconds. Test the full restore (words plus passphrase) before you deposit anything.

The brute-force math

2¹²⁸ written out is 340,282,366,920,938,463,463,374,607,431,768,211,456, a 39-digit number. 2²⁵⁶ has 78 digits. On average a guesser finds the right phrase after trying half the possibilities, which is what the table below uses.

The mining row is wildly generous to the attacker. Mining machines can only run SHA-256, and checking one seed guess takes far more work: BIP-39 alone requires 2,048 rounds of HMAC-SHA512 before the wallet's keys are even derived (BIP-39). The universe is about 13.8 billion years old (Planck 2018). Trezor says guessing a backup of any length would take "longer than the age of the universe" in real-world terms (Trezor). By our math, beating the age of the universe on an average 12-word search would take more than about 3.9 × 10²⁰ guesses a second. That's more than a third of the entire mining network's raw speed, aimed at a single wallet.

How big is 2¹²⁸? Honest comparisons

These estimates are rough, so we show the range each source gives and divide it out exactly.

Picture it this way: if every grain of sand on every beach were itself a whole beach of sand, you'd have about 5.6 × 10³⁷ grains. 2¹²⁸ is still about six times that. A 12-word phrase has far more possibilities than there are stars in the observable universe, but fewer than there are atoms in the Earth. A 24-word phrase falls just short of the usual estimates for atoms in the observable universe.

Quantum computing: what it can and can't do

Quantum computers threaten two kinds of math in different ways, and the difference matters.

• Grover's algorithm speeds up guessing, but only to a square root. Searching 2¹²⁸ possibilities takes roughly (π/4) × 2⁶⁴ ≈ 1.45 × 10¹⁹ steps, run one after another. Google Quantum AI's researchers call Grover-based attacks on Bitcoin mining not practically relevant, because error correction eats up the speedup and Grover "does not parallelize well" (Google Quantum AI, 2026). Give a quantum machine their "fantastical" speed of one step per microsecond and searching 12 words still takes about 459,000 years. A million such machines would only cut that about a thousandfold, to roughly 459 years, and each real step needs all 2,048 HMAC-SHA512 rounds plus key derivation, not a single hash.
• Shor's algorithm is the real concern, and it doesn't target your words. It can work out a private key from a public key, breaking the elliptic-curve signatures (ECDSA and Schnorr) that Bitcoin uses to authorize spending (Google Quantum AI, 2026). Your words stay hidden. What becomes vulnerable is any coin whose public key is visible.

Which coins have a visible public key?

• Old pay-to-public-key (P2PK) outputs, mostly early mining rewards, put the public key right on the blockchain. They hold a little over 1.7 million BTC (Google Quantum AI, 2026).
• Taproot (bc1p) addresses also record a public key on-chain (BIP-360).
• Reused addresses. Spending from a bc1q or 1… address reveals its public key, so coins left at that address are exposed. An address that has received coins but never spent from them keeps its public key hidden behind a hash (BIP-360).
• Every coin, briefly, while a transaction waits to confirm. Breaking a key in that window would need a much faster machine. Google estimates a future fast machine could take about 9 minutes, giving it just under a 41% chance against a normal Bitcoin transaction under idealized assumptions (Google Quantum AI, 2026).
• In total, Chaincode Labs estimated about 6.26 million BTC was exposed in 2025 (Chaincode), and Google's 2026 paper put it at about 6.9 million BTC (Google Quantum AI, 2026).

How close is it? The range of expert views

• Estimates of what's needed keep falling. Google Quantum AI's 2026 paper says breaking one Bitcoin key needs at most about 1,200–1,450 error-corrected ("logical") qubits, or fewer than 500,000 physical qubits on its type of hardware. That's nearly 20 times fewer than earlier estimates, and the attack would take minutes (Google Quantum AI, 2026). An IonQ paper estimates about 19,400 physical qubits on a trapped-ion design, running about 26 days with a 63% success rate (IonQ, 2026).
• Today's hardware is far from that. Google's 105-qubit Willow chip was a real milestone in 2024: its error-corrected qubits got better as they got bigger (Nature). It's still roughly 1/4,800th of the 500,000 physical qubits Google estimates an attack would need.
• Expert surveys are split. In the Global Risk Institute's 2025 survey of 26 experts, they put the chance of a code-breaking quantum computer at 28–49% within 10 years and 51–70% within 15 (GRI). NIST summarizes the range: some expect one by 2030, many in 15 to 20 years, and others in 30 or more (NIST).
• Governments are planning to move on. NIST published its first post-quantum standards (FIPS 203, 204 and 205) in August 2024. Its draft transition plan would deprecate weaker elliptic-curve signatures after 2030 and disallow them after 2035 (NIST IR 8547 draft).

The case that it's far off: no existing machine is close. Hardware has to scale up thousands of times while keeping errors low, and slower designs might need days per key. That would expose only long-visible public keys, not coins you haven't spent from. Bitcoin can also adopt new signature types through a soft-fork upgrade. The cautious case: estimates keep dropping, upgrades and coin migrations take years, and coins whose owners are gone can't be moved at all. Google's researchers urge vulnerable communities to start migrating "without delay" (Google Quantum AI, 2026). Both are true at once: there's time, but not time to waste.

What Bitcoin developers are proposing

• BIP-360, Pay-to-Merkle-Root (P2MR). This draft, earlier called P2QRH, would add a Taproot-like address type (starting bc1z) that drops the exposed public key. It protects against "long exposure" attacks on coins sitting still, but not the brief window while a transaction is in the mempool. Its authors say that may need post-quantum signatures later. It's a draft, not an active rule (BIP-360).
• Post-quantum signatures. Candidates include NIST's ML-DSA and SLH-DSA, which BIP-360's authors say should be "scrutinized before use" (BIP-360).
• What to do about coins nobody can move. BIP-360's authors point to a proposal by Jameson Lopp and others to eventually burn coins that stay vulnerable (BIP-360). Google's researchers describe the choice as a trade-off between "the immutability of cryptographic property rights and the economic stability of the network" (Google Quantum AI, 2026). Nothing has been decided.

What you can do today

• Don't reuse addresses. Use a fresh receive address every time; good wallets do this for you. This was already privacy advice before quantum computing came up (Google Quantum AI, 2026).
• For long-term savings, Google's researchers note that unused bc1q (SegWit) addresses keep the public key hidden, while bc1p (Taproot) addresses don't (Google Quantum AI, 2026).
• Share your xpub (extended public key) only when you need to. It reveals public keys, including to portfolio-tracking apps (BIP-360).
• Keep your words offline and the randomness real. Quantum computing doesn't change that advice. See Seed phrase backup.
• Ignore anyone selling a "quantum-proof" fix that needs your words. Any real upgrade will arrive as a Bitcoin software update. Never type your words into a website (Common scams).