Why a public cipher hides your seed but doesn't encrypt it

Every cipher on this site is public. Anyone can download all of them, and the torrents exist so they stay downloadable. The numbers protect you against some people and not others, and one extra step turns the disguise into a lock.

What a cipher here is

A cipher in the vault is a lookup table. It gives each of the 2,048 words of the BIP-39 English list its own four-digit number. There is one cipher for every day from 1 January 1770 to 31 December 1784 and from 1 January 2000 to 31 December 2009: 5,479 days plus 3,653 days, 9,132 ciphers in all.

Every cipher uses the same 2,048 numbers, 5432 to 7479, in a different order. In the 8 January 1784 cipher (Black Old-Fashioned Cardinal) the public example phrase encodes like this:

pizza educate fat kiss domain venue kingdom raise split step copper time (this phrase is public: never use it for real funds)

Word	Number	Word	Number
pizza	5432	kingdom	6853
educate	6201	raise	7318
fat	6211	split	7226
kiss	6173	step	7389
domain	6965	copper	7213
venue	6879	time	7280

The same twelve numbers read through the 26 May 1781 cipher (Gray Terrible Baboon) give kite assist minimum helmet boil hybrid large beach come video crucial three. Any number from 5432 to 7479 decodes to some word in every cipher. A wrong cipher raises no error. It hands back a different list of real words.

How a recognised list falls

Suppose someone finds twelve four-digit numbers, all between 5432 and 7479, and suspects what they are. This is what they do:

1. Download the five tomes. They are public, signed and seeded.
2. Decode the list with each of the 9,132 ciphers. That is 109,584 table lookups.
3. Throw out every result that fails the BIP-39 checksum.
4. Turn each survivor into a wallet and look for one with a history on the blockchain.

Step 3 is where your list gives itself away. BIP-39 builds the last word partly from a checksum: the first bits of a SHA-256 hash of the rest. A 12-word phrase carries 4 checksum bits and a 24-word phrase carries 8. A wrong cipher produces what amounts to a random list of words, and a random list passes a 4-bit check one time in 16 and an 8-bit check one time in 256. So the checksum leaves:

Phrase	Checksum bits	Wrong ciphers that still pass (of 9,131)
12 words	4	about 571
24 words	8	about 36

The right cipher passes as well, on top of those. We timed it. Decoding a 12-word list against 9,131 shuffled tables and checksumming each result took 3.6 seconds on one core of an ordinary server. 523 wrong tables passed, close to the expected 571. Turning a survivor into a wallet seed (PBKDF2 with 2,048 rounds of HMAC-SHA512, as BIP-39 specifies) took under a millisecond each. The slowest part is step 4: asking a block explorer or your own node whether a few hundred wallets were ever used. With a local node that takes seconds. Over a public API it takes minutes.

The attacker doesn't need to know which cipher you picked, or even that you picked one from this site. Twelve or twenty-four numbers that all fall between 5432 and 7479 point here on their own.

What the disguise buys you

The numbers keep your seed safe from anyone who doesn't recognise them. In practice that covers a lot:

• A burglar who empties the desk drawer and sees a receipt.
• A relative going through papers who sees a parts list.
• A search that is looking for words, a card with "seed" on it, or a metal plate.
• A shoulder-surfer, a cleaner, a photo of your notebook in the background of a video call.

It also means you can keep the list somewhere ordinary instead of somewhere secure, and that a careless look gets nothing.

The disguise does nothing against someone who knows this method exists and has the reason and the time to look closely at your papers. That could be a border officer who has seen this site, a thief who targeted you because you own bitcoin, or a former partner who watched you write the list. Each of them only has to recognise the list. After that the work is the four steps above.

What does the locking

The fix is in BIP-39 itself. The standard lets you add a passphrase to the seed: wallet software feeds the words and the passphrase together into the function that makes the wallet. Every passphrase gives a valid wallet, and only yours gives the wallet with your coins in it.

With a passphrase in place, step 4 changes. The attacker decodes your numbers, finds the right twelve words, and opens a wallet that is empty (or holds whatever small decoy amount you chose to leave there). To reach the real wallet they need the passphrase as well, and the passphrase isn't on the receipt. Choosing one strong enough, and storing it so you never lose it, is the subject of the 25th word.

So the method has two parts, and they do different jobs:

1. The cipher and the disguise stop the casual look. They let your words live on paper in plain sight.
2. The passphrase stops the person who saw through the disguise.

Use both. A disguised list without a passphrase is a seed phrase with a cover story, and its safety lasts only as long as nobody looks twice.

Make the second look harder

You can't stop someone testing a list they recognise. You can make recognition less likely:

• Pick your own cipher, never one from an example on this site. Those are the first anyone would try.
• Use a disguise where four-digit numbers in the 5432 to 7479 band look normal. Prices from $54.32 to $74.79 on one receipt are a pattern; disguises that survive a second look covers what breaks and what holds.
• Keep the cipher's name in your head, not next to the numbers.
• Open the cipher from your own downloaded copy of the tomes, not on this site. Your browser history is part of the second look.

We will never ask for a seed word or a passphrase. Never type one into this site or any tool it links to.