MASTERING-BITCOIN · Unit 5 · Video 3

Twelve Words Between You and Your Bitcoin: Interactive Practice

IKey Concepts Reference

Concept	Formula / Fact	Meaning
BIP39 entropy	$\text{bits} = (\text{words} \times 11) - \text{checksum}$	12 words → 128 entropy + 4 checksum
Word list size	$2^{11} = 2048$ words	Each word encodes 11 bits
Seed space	$2^{128}$ to $2^{256}$ possible seeds	Astronomical — un-brute-forceable
SLIP39 threshold	$k$ -of- $n$ shares required	Any $k$ reconstructs; any $k-1$ reveals nothing
Passphrase derivation	$\text{seed} = \text{KDF}(\text{words}, \text{passphrase})$	Every passphrase yields a valid wallet

IIInteractive Visualization 1: How Entropy Scales with Word Count

BIP39 recovery codes come in several standard lengths: 12, 15, 18, 21, or 24 words. Each additional word adds 11 bits — but 4 bits are reserved for the checksum.

Move the slider to see how entropy grows with word count. The vertical axis is logarithmic — each tick represents a factor of 1,000 more possible seeds.

⚙ interactive visualization — coming to this page format soon

Reflect: A 12-word seed has $2^{128} \approx 3.4 \times 10^{38}$ possible values. Even if every computer on Earth tried a trillion seeds per second, exhausting this space would take longer than the age of the universe. Why, then, is length alone not enough to keep coins safe?

IIIInteractive Visualization 2: SLIP39 Threshold Sharing

SLIP39 splits your seed into $n$ shares, where any $k$ of them can reconstruct it. Fewer than $k$ shares reveal nothing — not a partial seed, not even a hint.

Try different $(k, n)$ combinations below. The grid shows every possible subset of shares; green means "recovers the seed," red means "reveals nothing."

⚙ interactive visualization — coming to this page format soon

Notice: With $3$ -of- $5$ , an attacker must compromise three separate locations to steal the seed, while your heirs only need to collect three of the five to recover your Bitcoin. What threshold would you choose to balance theft resistance vs. family accessibility?

IVInteractive Visualization 3: Passphrase Produces Entirely Different Wallets

In BIP39, every passphrase — including the empty one, and including typos — produces a valid wallet. No error, no warning. This enables plausible deniability, but also silent failure on typos.

Select a passphrase to see which wallet it unlocks. Notice that all wallets are real and valid — they just hold different coins.

⚙ interactive visualization — coming to this page format soon

Reflect: Because BIP39 never signals "wrong passphrase," a single typo looks identical to "funds stolen" — you see an empty wallet either way. How does Aezeed's authenticated-passphrase design flip this trade-off?

VQuiz Questions

Question 1

A standard BIP39 recovery code has 12 words, drawn from a list of 2,048 words. How many bits of entropy (randomness) does this represent?

Remember: each word encodes 11 bits, but some bits are reserved for the checksum.

✅ Correct! 128 bits of actual entropy, plus a 4-bit checksum for typo detection.

❌ Not quite. You're close if you multiplied 12 × 11, but remember: 4 of those bits are used for the checksum, not for entropy.

Show solution

Solution:

Each of the 12 words encodes 11 bits, giving $12 \times 11 = 132$ total bits. However, the last 4 bits are a checksum derived from the preceding entropy, not from fresh randomness.

$\text{entropy bits} = 12 \times 11 - 4 = 128 \text{ bits}$

This is why 12-word BIP39 seeds are said to have "128-bit security." The checksum is what lets the wallet software reject typos — if the checksum doesn't match, the software knows at least one word is wrong.

Question 2

You protect your Bitcoin using SLIP39 with a 3-of-5 threshold. You give shares to your spouse, sibling, lawyer, a safety deposit box, and keep one at home.

An attacker steals 2 of the 5 shares. How much information about the seed can they derive?

✅ Correct! Below the threshold, SLIP39 reveals mathematically zero information.

❌ Not quite. SLIP39 is based on threshold cryptography, not proportional splitting. Fewer than $k$ shares give zero info.

Show solution

Solution:

This is the defining property of a threshold secret-sharing scheme (Shamir's Secret Sharing underpins SLIP39). With a $k$ -of- $n$ scheme:

Any $k$ or more shares reconstruct the secret exactly.
Any $k-1$ or fewer shares reveal zero information about the secret.

This isn't "hard to brute-force" — it's mathematically zero information. The attacker holding 2 shares is in exactly the same position as someone holding 0 shares.

That's why SLIP39 is so powerful for inheritance planning: you can distribute shares widely without accumulated theft being a gradual threat. Only simultaneous compromise of $k$ locations breaks the scheme.

Question 3

True or False: In BIP39, if you type your passphrase with a typo, the wallet software will display an error message and refuse to open the wallet.

✅ Correct! Silent failure is an intentional design choice — it's what enables plausible deniability.

❌ Not quite. BIP39 can't detect passphrase typos. Every passphrase produces a valid (but possibly empty) wallet.

Show solution

Solution:

False. BIP39 has no way to validate a passphrase — by design. The passphrase is simply mixed with the recovery words during key derivation:

$\text{seed} = \text{PBKDF2}(\text{mnemonic}, \text{"mnemonic"} + \text{passphrase}, 2048)$

Any passphrase — including an empty one, a typo, or a completely random string — produces a valid 512-bit seed, which generates a valid key tree full of valid Bitcoin addresses. Those addresses just happen to be empty because no one has ever sent coins to them.

This design choice gives BIP39 plausible deniability (an attacker can't distinguish "no passphrase" from "hidden passphrase"), but at the cost of silent failure on typos. Aezeed makes the opposite trade-off: it embeds a cryptographic tag that authenticates the passphrase, so typos produce an explicit error — at the cost of losing deniability.

Question 4

A journalist worries that a hostile government may coerce her into disclosing her Bitcoin backup. She wants to be able to hand over something that opens a wallet, while keeping her real funds hidden.

Which recovery scheme best fits her threat model?

✅ Correct! For a coercion-based threat model, BIP39's silent-passphrase behavior is a feature, not a bug.

❌ Not quite. Think about which scheme lets her hand something over that looks complete, without the attacker being able to prove she's hiding more.

Show solution

Solution:

The correct choice is BIP39 with a passphrase. Here's why each option fares:

BIP39 + passphrase (correct): The journalist keeps a small decoy balance at the no-passphrase wallet. Under coercion, she surrenders the 12 words; the coercers see a real wallet with a believable small balance. Because every passphrase yields a valid wallet, there is no cryptographic way for them to prove she has hidden funds behind another passphrase. This is plausible deniability.
❌ Aezeed: This is exactly the wrong choice for coercion. Aezeed's authenticated passphrase lets the coercers verify when she's given up the real one — meaning the coercion has a definite end only when she fully complies. She loses the ability to stop the torture by claiming she's disclosed everything.
❌ Codex32: A clever scheme for paper-only verification, but it addresses a different threat (losing your backup or mistyping during transcription), not coercion.
❌ Pure memorization: Offers no protection against coercion — in fact, it makes the coercion longer and more painful, since there's nothing to hand over. It also risks total loss from forgetting, head injury, or death.

The key insight: "best scheme" depends entirely on the adversary. Deniability (BIP39) vs. error detection (Aezeed) vs. split-key resilience (SLIP39) are opposing trade-offs, not a ranking.

Solved: 0 / 4