Hide a seed in a word search

A seed phrase is twelve or twenty-four words from a list of 2,048. That makes it an awkward thing to hide in text: the words are ordinary English, but a reader who knows the list can spot them, and a program can do it in a millisecond. Text steganography is the craft of putting those words where nobody thinks to look. This page covers the four puzzle forms people reach for, in order of how much each one leaks.

Keep one thing in view the whole way through. The order of the words matters as much as the words themselves. A hiding method that stores twelve words but loses their order has stored a 479-million-way guessing game (that is 12 factorial), which a laptop finishes in minutes once it knows the twelve words. A good puzzle has to carry the sequence too.

The example

Every page on this site uses the same example phrase:

pizza educate fat kiss domain venue … (this phrase is public: never use it for real funds)

Build your own with your own words, on paper, away from any camera or computer. The disclaimer that goes with every tool on this site applies here too: we will never ask for a seed word or a passphrase, and you should never type one into this site or any tool it links to.

1. The word search

A grid of letters, twenty by twenty, with your twelve words placed in it and the rest filled with random letters. Make a list of decoy words that are also in the grid, so the puzzle looks like a puzzle.

What it hides: a casual reader sees a children's activity. What it leaks: a grid with twelve BIP-39 words in it and twenty decoys is a grid with thirty-two words in it, and a solver program finds all of them. The BIP-39 words then have to be separated from the decoys, and if your decoys are also on the list (which they should be, or the real words stand out), the attacker has thirty-two words and a checksum. Thirty-two choose twelve is about 225 million sets, times the orderings, and the checksum rejects fifteen out of sixteen wrong tries for a twelve-word phrase. A desktop clears that in hours.

So the word search needs a second layer for order. People use the word's direction (left to right, down, diagonal), the position of its first letter read as a page coordinate, or the printed clue list in a fixed order with the real words interleaved at a pattern only you know (every third clue, say). Any one of those is fine against a stranger. None of them holds against someone who knows you own bitcoin and has a weekend.

2. The crossword

A real crossword with real clues, where twelve answers are your seed words. Crosswords carry order for free: the numbering. You decide that the seed is answers 3, 7, 11, 14, 19, 22, 25, 31, 36, 40, 44 and 48 across, and you remember the rule, not the list.

What it hides: more than the word search, because the clues give every answer a reason to be there. "Italian flatbread (5)" is a normal clue, and pizza is a normal answer. What it leaks: a finished crossword is a list of answers in numbered order, and a program can test every twelve-answer subset against the word list and the checksum. A 15 by 15 grid has about seventy answers. Seventy choose twelve is a big number (about ten trillion), but the word list cuts it hard: most crossword answers are not on the list, and the ones that are can be found instantly. If forty of your seventy answers are off the list, the attacker is back to thirty choose twelve, which is small.

The fix is the same as before, in reverse: make most answers list words. A crossword where sixty of seventy answers are BIP-39 words is harder to crack and looks slightly odd to a constructor, but nobody else notices.

Writing clues is also where people slip. A clue that is too easy for the twelve real words and hard for the rest is a signal. Write them all the same way.

3. The acrostic

A poem, a letter, a diary entry, where the first letters of the lines, or the first word of each sentence, spell or are your seed. The second form is the direct one: twelve sentences, each starting with one seed word, in order.

"Pizza night again, the third this month. Educate me on why we keep ordering it." That reads like a diary. It also reads like a seed to anyone who runs the first word of each sentence against the list, which takes no skill. Acrostics carry order perfectly and hide poorly against a reader who knows the trick. They belong on the null cipher page, where the rules for writing one that reads naturally are laid out.

4. The scramble

Your twelve words, with the letters of each one shuffled, in a list: azzip, cdeateu. Or all the letters pooled. This is a puzzle for a stranger and no puzzle for a program, which unscrambles against a 2,048-word dictionary instantly. Order is kept if you keep the list in order, which also means the whole thing reads as a list. A scramble is the weakest of the four and gets listed here because it is the one people most often think is clever.

What all four share

The 2,048-word list is public. Every method above has to survive an attacker who holds the list, the checksum rule, a word-finding program, and the suspicion that your puzzle is a seed. Against that attacker, hiding words in text buys you one thing: the attacker has to suspect the puzzle. Once they do, the puzzle is a list of candidates and a short computation.

That is the honest limit of text steganography, and it is the same limit the ciphers on this site have. The disguise stops the glance. The passphrase stops the search. Use the puzzle for the glance and the passphrase for everything else.

A smaller trick that helps

Numbers hide better in text than words do, because the list is of words. Turn the seed into numbers first with one of the ciphers, then build the puzzle from the numbers: a sudoku with twelve givens, a knitting pattern, a list of scores. Now the attacker needs the cipher name as well as the puzzle, and a grid of numbers has no dictionary to check against. The disguise page has worked examples.

Sources