frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

How secure is your Bitcoin wallet's mnemonic seed phrase?

https://bennet.org/blog/how-secure-is-your-bitcoin-wallets-mnemonic-seed-phrase/
27•tombennet•7mo ago

Comments

tombennet•7mo ago
Hey, author here. I made this to help technically curious people understand what's really going on when they're handed a Bitcoin seed phrase (i.e. why it's not just a password). You can flip bits of entropy, explore checksum validation, and see how mnemonic phrases are turned into deterministic wallets. Feedback welcome. If anything breaks I’ll fix it fast.
brudgers•6mo ago
I could not help but think of a class of early internet scam websites offering to check if your credit card number was stolen.

I'm sure that you aren't just collecting wallet seeds, but that's what it reminds me of.

tombennet•6mo ago
Thanks - I appreciate the comment. It's a valid concern, and one I thought about while making this. Just to clarify a few things:

- I've explicitly discouraged entering a real mnemonic, in several places. In fact I tried to steer people in a safe direction by putting the random generation component first. The article works best when starting with random entropy.

- All the BIP39 logic is handled client-side using paulmillr/scure-bip39, a minimal audited library.

- It works fully offline - no backend, no database, no server calls.

- There are no cookies or tracking scripts beyond simple pageview stats via Plausible (which is privacy-focused)

That said, I’d genuinely welcome suggestions on how to make it more trustable. Do you think open-sourcing the code for the page/site would help?

jbermudes•6mo ago
I think you did enough due diligence by putting the random part first, but I suppose one way to stop someone from putting in a real BIP39 mnemonic would be to use a completely different set of words than those allowed in BIP39.
nick3443•6mo ago
Make the text fields non-editable or drop them entirely? The writing and clickable demos provide a very good lesson without using any text input.
sudahtigabulan•6mo ago
I think the disclaimer is the best an honest site owner could do in this case.

If the site was malicious, there wouldn't be any disclaimer, and once you insert a passphrase, BIP39 or not, in a text field, it's game over. No need to press Submit even, some JavaScript will send it wherever it has to.

sparkie•6mo ago
Can you explain why this is a valid mnemonic?

    bacon bacon bacon bacon bacon bacon bacon bacon bacon bacon bacon bacon bacon bacon bacon bacon bacon bacon bacon bacon bacon bacon bacon bacon
oakwhiz•6mo ago
The last word contains checksum bits but not all of the bits it represents are checksum bits. It just so happens to be possible for all of them to be the same word here. In this case it can be bacon (139th word) or one of the following: cupboard, double, jelly, neutral, review, smile, voice
tombennet•6mo ago
Exactly what oakwhiz said. Similarly, if you set all 256 bits of the entropy portion to 1 (i.e. you play minesweeper with my grid) then the resulting valid mnemonic is zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo zoo vote. The last word contains the checksum, which is the hash of the string of 1s.
er4hn•6mo ago
This is really fun, thanks for putting it together. I appreciated the checksum and entropy visualizers quite a bit, they made how it works "click" for me.
tombennet•6mo ago
Thanks er4hn, I'm glad to hear it!
gblargg•6mo ago
Safest way to generate seed words is a set of dice and printed table. It's odd they only encode 256 bits of entropy, which clearly isn't enough to make multiple 256-bit private keys.
Calwestjobs•6mo ago
just XOR two photos from your iphone and pick middle part of that... you can even sha512 that.

Maybe Subkey generation ?

udev4096•6mo ago
Shit posts making top of the HN, again. Are people really that stupid?
Calwestjobs•6mo ago
Maaan, i stopped paying attention to bitcoin after Bitcoin Cash fork fiasco. Everything flew back into my consciousness. eth DAOHACK fail. Website, listing all possible BTC private keys. (de)Dusting. Printing signed transactions offline into QR codes on thermal paper... Good old days.

I am not sure BTC is still worth the hassle, most of hashrate is inside of USA (70+% =>51%...). most of BTC holdings is in USA... btc saga will end soon and badly in my opinion. BTC Cash made me pessimistic.

In Europe they have SEPA Instant Credit Transfer which allows people inter bank transfers in under 15 seconds. All KYC, all legal, all gov approved, gov regulated, all without fees to btc exchange / VISA. BTC does not even makes sense anymore. Technological innovations flew right past the BTC.

i am not even sure BTC infrastructure is quantum safe, blockchain "is", but i doubt rest of infrastructure is...

npoc•6mo ago
You're missing its monetary fundamentals that make it the hardest asset mankind has ever seen.
atoav•6mo ago
The first question you should ask yourself when tasked to secury literally anything is the same: secure it against whom or what?

This article is about entropy and mostly an explaination why your mnemonic seed is already safe against wild guesses. The question then is how to secure it against attackers who might want to get it otherwise.

If you live alone writing it on a piece of paper and putting it into a locked drawer might literally be enough, since your main concern would probably be online aftacks. If you have 30 guests a week that calculation might change, but then your scenario is to protect against a guest who A) knows you have a lot of bitcoins, B) posseses all other required information to access the wallet and C) is invited or has broken into your flat. If the latter is an issue, maybe getting a decent door and a safe is a good idea.

This is just an example, but if you want to secure a thing, knowing which attack-vectors to secure it against is key.

tomschwiha•6mo ago
I'm totally not into Bitcoins but nice and interesting writeup. I very much like the interactivity of the article.
Calwestjobs•6mo ago
Yeah, Jupyter notebooks / literate programming for everything !

OpenCiv3: Open-source, cross-platform reimagining of Civilization III

https://openciv3.org/
426•klaussilveira•5h ago•97 comments

Hello world does not compile

https://github.com/anthropics/claudes-c-compiler/issues/1
21•mfiguiere•42m ago•8 comments

The Waymo World Model

https://waymo.com/blog/2026/02/the-waymo-world-model-a-new-frontier-for-autonomous-driving-simula...
775•xnx•11h ago•472 comments

Show HN: Look Ma, No Linux: Shell, App Installer, Vi, Cc on ESP32-S3 / BreezyBox

https://github.com/valdanylchuk/breezydemo
142•isitcontent•6h ago•15 comments

Monty: A minimal, secure Python interpreter written in Rust for use by AI

https://github.com/pydantic/monty
135•dmpetrov•6h ago•57 comments

Dark Alley Mathematics

https://blog.szczepan.org/blog/three-points/
41•quibono•4d ago•3 comments

Show HN: I spent 4 years building a UI design tool with only the features I use

https://vecti.com
246•vecti•8h ago•117 comments

A century of hair samples proves leaded gas ban worked

https://arstechnica.com/science/2026/02/a-century-of-hair-samples-proves-leaded-gas-ban-worked/
70•jnord•3d ago•4 comments

Show HN: If you lose your memory, how to regain access to your computer?

https://eljojo.github.io/rememory/
180•eljojo•8h ago•124 comments

Microsoft open-sources LiteBox, a security-focused library OS

https://github.com/microsoft/litebox
314•aktau•12h ago•154 comments

How we made geo joins 400× faster with H3 indexes

https://floedb.ai/blog/how-we-made-geo-joins-400-faster-with-h3-indexes
12•matheusalmeida•1d ago•0 comments

Sheldon Brown's Bicycle Technical Info

https://www.sheldonbrown.com/
311•ostacke•12h ago•85 comments

Hackers (1995) Animated Experience

https://hackers-1995.vercel.app/
397•todsacerdoti•13h ago•217 comments

An Update on Heroku

https://www.heroku.com/blog/an-update-on-heroku/
322•lstoll•12h ago•233 comments

PC Floppy Copy Protection: Vault Prolok

https://martypc.blogspot.com/2024/09/pc-floppy-copy-protection-vault-prolok.html
12•kmm•4d ago•0 comments

Show HN: R3forth, a ColorForth-inspired language with a tiny VM

https://github.com/phreda4/r3
48•phreda4•5h ago•8 comments

I spent 5 years in DevOps – Solutions engineering gave me what I was missing

https://infisical.com/blog/devops-to-solutions-engineering
109•vmatsiiako•11h ago•34 comments

How to effectively write quality code with AI

https://heidenstedt.org/posts/2026/how-to-effectively-write-quality-code-with-ai/
186•i5heu•8h ago•129 comments

Understanding Neural Network, Visually

https://visualrambling.space/neural-network/
236•surprisetalk•3d ago•31 comments

I now assume that all ads on Apple news are scams

https://kirkville.com/i-now-assume-that-all-ads-on-apple-news-are-scams/
976•cdrnsf•15h ago•415 comments

Learning from context is harder than we thought

https://hy.tencent.com/research/100025?langVersion=en
144•limoce•3d ago•79 comments

Introducing the Developer Knowledge API and MCP Server

https://developers.googleblog.com/introducing-the-developer-knowledge-api-and-mcp-server/
17•gfortaine•3h ago•2 comments

I'm going to cure my girlfriend's brain tumor

https://andrewjrod.substack.com/p/im-going-to-cure-my-girlfriends-brain
49•ray__•2h ago•11 comments

FORTH? Really!?

https://rescrv.net/w/2026/02/06/associative
41•rescrv•13h ago•17 comments

Evaluating and mitigating the growing risk of LLM-discovered 0-days

https://red.anthropic.com/2026/zero-days/
35•lebovic•1d ago•11 comments

Why I Joined OpenAI

https://www.brendangregg.com/blog/2026-02-07/why-i-joined-openai.html
52•SerCe•2h ago•42 comments

Show HN: Smooth CLI – Token-efficient browser for AI agents

https://docs.smooth.sh/cli/overview
77•antves•1d ago•57 comments

The Oklahoma Architect Who Turned Kitsch into Art

https://www.bloomberg.com/news/features/2026-01-31/oklahoma-architect-bruce-goff-s-wild-home-desi...
18•MarlonPro•3d ago•4 comments

Claude Composer

https://www.josh.ing/blog/claude-composer
108•coloneltcb•2d ago•71 comments

Show HN: Slack CLI for Agents

https://github.com/stablyai/agent-slack
39•nwparker•1d ago•10 comments