One-time pad vs. a public book cipher

People who learn that our ciphers are public often ask the next question: why not a cipher nobody can break? One exists. It's called the one-time pad, and it has been mathematically unbreakable since 1949. This page explains what it would take to use one on a seed phrase, and why we don't offer it.

What a one-time pad is

Gilbert Vernam patented the idea for teleprinters in 1919: combine each character of the message with a character of a key, and send the result. Claude Shannon proved in 1949 that if the key is truly random, at least as long as the message, kept secret and never reused, the ciphertext tells an attacker nothing at all. Every possible message is equally likely. No amount of computing changes that.

On a seed phrase, a pad looks like this. Each BIP-39 word is a number from 0 to 2047, its place in the word list. The pad is twelve random numbers in the same range. Add each pad number to its word number, wrap around at 2048, and write down the result as a word or a number.

1. Word number: pizza is word 1,325 of the list (counting from 0).
2. Pad number: say 917, rolled with dice.
3. Sum: 1,325 + 917 = 2,242. Over 2,047, so subtract 2,048: 194.
4. Write down 194 (or word 194, blue).

To recover, subtract the pad: 194 − 917 = −723, plus 2,048 = 1,325, pizza.

Without the pad, 194 could be any word, and so could the eleven after it. The result looks like a seed phrase, and BIP-39's checksum gives the attacker nothing, because every possible original phrase is equally likely.

What a true pad would require

Shannon's conditions are strict, and each one costs you something.

1. Truly random: dice, coins or a hardware generator you trust. A pattern, a date or a passage from a book won't do. 2,048 is 2¹¹, so eleven coin flips give one pad number.
2. As long as the secret: twelve pad numbers for twelve words, twenty-four for twenty-four. The pad is exactly as big as the seed.
3. Secret: nobody but you ever sees it. If anyone sees the pad and the encrypted list, they have your seed.
4. Used once: never apply the same pad to a second seed. The Soviet Union shows why. During the Second World War its pad factory issued duplicate pages, and the United States Army's Venona project used the repeats to read parts of about 3,000 messages.
5. Stored as safely as the seed: lose the pad and the encrypted list is noise. Your coins are gone.

Look at conditions 3 and 5 together. You started with one secret, twelve words, that you had to keep safe and never lose. Now you have two secrets of the same size, the pad and the encrypted list, and you must keep both safe and lose neither. You have split your seed into two shares. Splitting has real uses, and methods built for it (Seed XOR, Shamir's SLIP-39) get their own pages.

Why this site doesn't ship one

Anything we could give you as a pad fails condition 3.

• A pad on this site is public. If we published pads the way we publish ciphers, every visitor and every mirror would have yours.
• A pad made for you by this site is seen by this site. It passes through our server, your browser, any proxy on the way, and the logs of each.
• A pad made in your browser needs our code. The site runs no JavaScript, on purpose. Even if it did, you'd be trusting software we wrote with the key to your coins.

A pad has to come from you, made offline, with dice. At that point you don't need a website.

What a public book cipher gives you instead

A classic book cipher keeps the book secret. Ours doesn't. The 9,132 tables are public, mirrored and seeded. The only secret is which day you picked, and one choice among 9,132 is about 13 bits. The BIP-39 checksum lets an attacker test all of them in minutes (the details).

In exchange you get things a pad can't give:

• You store nothing but a name. The cipher lives on the internet in a dozen places. You remember "Black Old-Fashioned Cardinal", or a date, and can fetch the table anywhere.
• You can't lose the cipher. If our site disappears, the torrents and mirrors still carry every cipher.
• Your list can look like something else. Numbers in the 5432 to 7479 band fit into receipts and logs (disguises). Pad output is just another seed.

	Public book cipher	One-time pad	BIP-39 passphrase
Secret you must keep	A cipher name	12 or 24 random numbers	A phrase you choose
If the secret is lost	Fetch the cipher again	Coins lost	Coins lost
Stops a casual look	Yes	Yes	No (on its own)
Stops a determined attacker	No	Yes	Yes, if strong

What we recommend

Use the public cipher and a disguise to keep your words out of sight. Use a BIP-39 passphrase as the lock (the 25th word). The passphrase is the second secret a pad would be, but smaller, easier to write down, and part of the standard every signer already speaks. If you want a real second share for your seed, use a method designed for splitting, not a pad you improvise.

We will never ask for a seed word or a passphrase. Never type one into this site or any tool it links to.