Glossary · Wallets and keys

Brain wallet

Published 27 Apr 2025 · Updated 20 Oct 2026 · 10 min read

A brain wallet is a cryptocurrency wallet whose private key comes from a passphrase the owner memorizes. The classic version hashes the phrase into the key, often with a single SHA-256, so anyone who guesses the phrase controls the funds. Today the term also covers a memorized seed phrase, a different and much stronger secret.

  • A classic brain wallet turns a memorized, human-chosen phrase into a private key.
  • Attackers can guess the phrase, and anyone who knows it has the same private key.
  • Use a wallet-generated random seed phrase or a hardware wallet instead.
How a brain wallet worksWhy brain wallets failHow attackers drain brain walletsThe record of measured failuresBrain wallet vs seed phrase and hardware walletSafer ways to control fundsKey creation and recovery by designBrain wallet FAQ

How a brain wallet works

The appeal was simplicity. There is nothing to write down, nothing physical to lose in a fire or a burglary, and the same phrase opens the wallet on any computer. The catch is that anyone else who types that phrase can do the same. In the classic Bitcoin version, four steps turn the phrase into an address. Some tools for the Ethereum network used keccak256 instead of SHA-256.

Number 1

Passphrase

The human phrase is the only secret in this setup. It replaces computer-generated randomness, so its unpredictability determines how difficult the resulting wallet is to guess.

Number 2

Hash

A hash function converts the phrase into a 256-bit value. Classic tools often use plain SHA-256 without a salt, so identical phrases always produce identical results.

Number 3

Private key

That value becomes the Bitcoin private key, a 256-bit number. The corresponding public key is computed from it using the secp256k1 curve.

Number 4

Address

The public key is hashed with SHA-256, then RIPEMD-160. A version byte and checksum are added before Base58 encoding. Compressed and uncompressed public keys produce different addresses.

Figure 1 · Fixed sample phrasesFrom phrase to public recordCompare the fixed phrases with the masked random key to see keys, addresses and activity. Explorer records show amounts, not identities.
  1. Brain icon01 · Passphrasecorrect horse battery staple
  2. Hash icon02 · SHA-256 = private keyc4bbcb1fbec99d65bf59d85c8cb62ee2db963f0fe106f483d9afa73bd4e39a8a
  3. Key icon03 · Public key0478d43027…59cc3455
  4. Wallet icon04 · Bitcoin address1JwSSubhmg6iPtRjtyqhUYYH7bZg3Lfy1T
Wallet owner iconSweeper bot iconAnyone who hashes this phrase gets this exact key, including every attacker who has it on a list.
Explorer recordmempool.space, 20 October 2026: 4,163 transactions, about 15.9 BTC received in total, all of it spent. Balance 0.

Phrases are fixed. Explorer figures date to 20 October 2026. This page never turns typed text into keys.

Why brain wallets fail

The output can look complex even when the input is easy to predict. Cryptographic entropy measures uncertainty, not the number of characters displayed. A 256-bit key does not give a human phrase 256 bits of randomness. The weakness starts before the key exists.

Predictable human choices

People often choose recognizable language rather than random inputs. A phrase can be long yet predictable, especially when it comes from a published book or quotation.

Shared guessing work

Without a salt, one phrase guess tests every brain wallet using that derivation at once. Attackers can reuse the result against everyone who chose that phrase.

Fast public hashing

Plain SHA-256 makes guesses cheap to test. In 2016, researchers estimated a cloud cost of about 56 dollars to check a trillion passwords.

An unchanged key

A phrase-derived key cannot be reset like a password. If the phrase leaks or is guessed later, protecting the funds requires moving them to a new wallet.

Figure 2 · Sample attacker speedsCompare guessing resistanceChoose a secret and a sample guessing speed to compare entropy in bits and the average time to find it.
Secret
Guesses
Entropy51.7 bits4 × 12.9 bits from a 7,776-word list
Average time to find it21.2 daysFour random Diceware words carry about 52 bits of entropy, more than a famous quote but far less than a 12-word seed.

Entropy figures follow Diceware and BIP-39. Attacker speeds are round sample numbers, not benchmark results.

How attackers drain brain wallets

Attackers hash huge phrase lists in advance, compute the addresses and watch them. This dictionary attack draws on leaked passwords, dictionaries, Wikipedia, quotes and lines from famous books. The February 2016 Brain Drain study evaluated about 300 billion candidate passwords, and a 2017 follow-up used 3.9 trillion. Castellucci's tool ran about 130,000 guesses a second on one machine in 2015, and a 2016 speed study made it about 2.5 times faster.

The February 2016 study found 884 brain wallets receiving 1,806 BTC between September 2011 and August 2015. It reported that 98% were drained at least once. Half of the wallets were drained in 21 minutes or less. At least 14 drainers competed. By September 2013, measured drain times had fallen to minutes and seconds. The researchers found no evidence that people holding more bitcoin chose stronger passwords.

Figure 3 · Simplified sweepA deposit meets a sweeperFollow the sample payment to see how a prepared bot can spend funds without waiting for the owner to act.
Wallet owner iconYour walletSends funds to the brain wallet address
Bitcoin network iconBitcoin networkReceives the payment
Sweeper bot iconSweeper botWatches a list of precomputed addresses
Clock iconDeposit sentBalance 0.05 BTC
Step 1 of 4 · DepositYour wallet sends 0.05 BTC to a brain wallet address. This example follows the payment from its arrival to the sweep.

This sequence is simplified. The 0.670 s timing comes from the October 2020 BitMEX Research test.

The record of measured failures

Bitcoin and most other cryptocurrency networks publish every transaction, so every deposit and sweep is on the record. Weak key generators caused similar failures without a passphrase. The Profanity vanity address tool for Ethereum exposed keys in 2022, and the Libbitcoin Explorer "Milk Sad" flaw led to thefts in 2023. Those were not brain wallets.

  1. September 2011

    The earliest observed wallet

    The February 2016 study traced its earliest brain wallet to the phrase "one two three four five six seven".

  2. August 2015

    A public warning

    Ryan Castellucci presented his cracking research at DEF CON 23 and released Brainflayer on 7 August 2015. That day, brainwallet.org closed permanently. A press report linked the shutdown to the talk.

  3. February 2016

    A systematic study

    The Bitcoin Brain Drain, by Vasek, Bonneau, Castellucci, Keith and Moore, was presented at Financial Cryptography 2016. It found that 98% of the brain wallets it identified were drained at least once.

  4. October 2020

    Published texts swept

    BitMEX Research funded eight wallets made from famous texts. All were swept within a day, one of them 0.670 seconds after BitMEX's own node saw the deposit. Three lost funds before confirmation.

  5. January 2026

    A wider address count

    The Milk Sad team found at least 20,397 Bitcoin addresses from single-SHA-256 brain wallets, with 3,606.59 BTC moved through them over the years, plus 156 on Ethereum.

Brain wallet vs seed phrase and hardware wallet

In a brain wallet, a human phrase is the secret. BIP-39 represents random entropy as words, while a hardware wallet keeps private keys inside a device.

Brain walletBIP-39 seed phraseHardware wallet
Secret sourceBrain walletA person chooses the phrase that becomes the private key.BIP-39 seed phraseThe wallet encodes computer-generated randomness as 12 to 24 words.Hardware walletThe device generates private keys and keeps them inside.
StrengthBrain walletSecurity depends on the unpredictability of a human choice.BIP-39 seed phraseA standard phrase carries 128 to 256 bits of random entropy.Hardware walletKeys come from the device's own randomness and never leave it.
Precomputed guessesBrain walletUnsalted derivation lets attackers prepare keys from phrase lists.BIP-39 seed phraseNot feasible with a sound generator. Phrase lists cannot predict random entropy.Hardware walletNot feasible with a sound device. Phrase lists cannot predict its keys.
RecoveryBrain walletIf the phrase is forgotten, or the owner dies or is permanently incapacitated, funds are lost.BIP-39 seed phraseThe seed phrase carries the random secret used for recovery.Hardware walletDevice-held keys still require a separate plan for recovering access.
Current adviceBrain walletThe Bitcoin Wiki, last edited in June 2026, says not to use it.BIP-39 seed phraseUse wallet-generated words rather than sentences you create yourself.Hardware walletUse device-generated keys, not keys derived from a chosen phrase.

A seed phrase records a random secret in words, while a hardware wallet is about where keys are generated and kept. Those words still represent randomness if you memorize them.

Safer ways to control funds

For funds still in a brain wallet, the Bitcoin Wiki (last edited in June 2026) advises moving them to a modern wallet as soon as possible. The options below cover how secrets are generated, where keys stay and how access is recovered. Each solves a different problem.

Wallet-generated seed phrases

Introduced in 2013, BIP-39 transcribes computer-generated randomness into readable words. BIP-32 HD wallets can derive many keys from one random seed, rather than requiring a separate memorized phrase for each key.

An extra passphrase

An optional BIP-39 passphrase adds another secret to a random seed. Each passphrase opens a different wallet. Unlike a brain wallet, the random seed remains the main secret.

Device-held private keys

A hardware wallet generates private keys inside a secure device and keeps them there. The keys never leave it, and they do not come from a phrase the owner invents.

Shared or recoverable control

Multisig wallets, multi-party computation (MPC) and ERC-4337 smart accounts with social recovery remove reliance on one secret. MPC distributes shares across devices without assembling the full key.

Key creation and recovery by design

We design how a wallet creates secrets, stores keys and recovers access as one system. Our crypto wallet development work covers mobile, browser extension, desktop and white-label products, including custodial and non-custodial wallets. Through our blockchain development services, we help teams decide who holds keys, who approves transactions and how users keep access.

PixelPlex case icon

We built Console Wallet, a self-custodial wallet with more than 250K registered users across its browser extension and its iOS and Android apps. Private keys stay on the user's device, protected by passkey-based approvals. There is no seed phrase to back up or lose.

  1. Random secret generation

    Start with computer-generated entropy. The words users see should transcribe that randomness, as in BIP-39, never a sentence they choose.

  2. Key custody boundaries

    Define where keys or shares live. In our MPC wallet development, each device holds a secret share, and the full key is never reconstructed.

  3. Backup and recovery

    Decide how users regain access after forgetting information, or how others recover funds after incapacity or death. Do not rely on users remembering forever.

  4. Signing and approvals

    Specify who can approve a transfer and what they must check. Review key storage and transaction checks together, rather than as separate features.

  5. Testing and audits

    Test key creation and recovery before release. Plan security audits that check where keys are stored, predictable inputs and recovery failures, not just successful transactions.

Discuss your wallet's key and recovery design

We can discuss your custody model, key generation and recovery requirements before you decide how to build.

Discuss wallet requirements

Brain wallet FAQ

Is a brain wallet safe to use?

No. Attackers guess human phrases at scale. In the February 2016 study, 98% of the brain wallets found were drained at least once, half in 21 minutes or less. Encryption would not help, because attackers rebuild the key from the phrase and never need a file from the owner.

Is a memorized seed phrase a brain wallet?

By the current Bitcoin Wiki definition, yes. It uses brainwallet for recovery data kept only in memory, usually a seed phrase. A BIP-39 seed is stronger, with 128 to 256 bits of computer-generated randomness. If the words are forgotten, or the owner dies or becomes permanently incapacitated, the funds are lost.

How does a brain wallet differ from a BIP-39 passphrase?

A BIP-39 passphrase adds a secret to a random seed, while a classic brain wallet has no random seed at all. It is often called the 25th word, and a different passphrase opens a different wallet. Even with a weak passphrase, the random seed remains the main secret.

Does a long phrase make a brain wallet safe?

No. A 2016 study found brain wallets "not secure in practice even for quite complex passwords". In the October 2020 BitMEX Research test, all eight wallets made from famous published texts were swept within a day. Key stretching, as in WarpWallet, raises the cost of each guess, and an optional salt makes attackers target one user, but neither adds entropy to a weak phrase.

Are brain wallets still used in 2026?

Rarely. In January 2026 the Milk Sad team called weak brain wallets "more or less a problem of the past". Over the years it found at least 20,397 Bitcoin addresses made with a single SHA-256, and about 5.26 BTC moved through one in February 2025. The Bitcoin Wiki advises moving any funds left in one to a modern wallet as soon as possible.

Can stolen brain wallet funds be recovered?

Usually not. The sweeper signs an ordinary transaction with the correct key, so the network treats it as valid. Knowing the phrase controls only the old address, not the address the coins went to. An explorer shows where the coins moved, not who moved them.

How do attackers find a brain wallet?

They do not look for the owner. They hash huge candidate phrase lists in advance, compute matching addresses and watch them. When a deposit arrives, a bot already holding the key sweeps it. One phrase gives several addresses, two legacy ones and newer formats such as SegWit, so attackers watch all of them.

Related terms

All definitions
Sources (21)

Get updates about blockchain, technologies and our company

We will process the personal data you provide in accordance with our Privacy policy. You can unsubscribe or change your preferences at any time by clicking the link in any email.

Follow us on social networks and don't miss the latest tech news

  • facebook
  • X
  • linkedin
  • instagram
Stay tuned and add value to your feed