Glossary / Wallets & custody
Brain wallet
- Definition
- Brain wallets turn a memorized phrase straight into a private key by hashing it, a design that researchers emptied at scale and that no maintained wallet still offers.
The appeal was obvious: memorize a sentence, cross a border carrying nothing, recreate the wallet on the other side. The flaw was equally simple, because people pick guessable sentences and an attacker can test candidates offline for free. A 2016 academic study identified 884 brain wallets holding 1,806 bitcoin between 2011 and 2015, and all but 21 of them had been emptied.
How it works
Status: brain wallets were abandoned after public cracking tools appeared in 2015, and no wallet in current maintenance offers the option. Recovery phrases generated by the device replaced them entirely.
The construction is one line of code. Take the phrase, run SHA-256 over it, and treat the resulting 32 bytes as a private key. There is no salt, no random component, and no deliberate slowness. The same phrase therefore produces the same key for every person on earth who ever thinks of it, which turns a secret into a lookup problem.
Attackers exploit that directly. They build a list of every address that has ever held a balance, load it into a fast membership structure, then hash candidate phrases by the million: song lyrics, scripture verses, film quotes, passwords from old breach dumps, and every string those sources can be permuted into. Each hash is checked against the address list in microseconds. Ryan Castellucci demonstrated the attack at DEF CON 23 in August 2015 and published brainflayer, the tool that made the technique routine. The same research team counted around a dozen competing drainers watching for new deposits, which is why a funded brain wallet was typically emptied inside a day and often within minutes.
Human phrase selection is the part that cannot be fixed. Even a sentence you believe is original sits in a search space vastly smaller than the 2 to the power of 256 that a random key occupies, and the attacker only needs the phrases people actually choose.
Where you see it
Brain wallets are historical, but the idea keeps returning under new names, so it is worth recognizing. WarpWallet, published by Keybase in 2014, tried to rescue the concept with scrypt and PBKDF2 plus an email address as salt, which raises the cost per guess without changing the fact that a human chose the input.
The live confusion is with memorizing a proper recovery phrase. Twelve words generated by a hardware wallet carry 128 bits of machine entropy and stay strong whether or not you also memorize them. A phrase you invented carries whatever entropy your imagination contains, which is far less than it feels. If a site, app, or "custom vanity seed" tool asks you to type a sentence you thought of and promises a wallet in return, close it.
Brain wallet vs passphrase
A brain wallet is the whole secret; a BIP-39 passphrase is an extra factor layered on top of machine-generated words. That difference decides the attack. To grind a brain wallet an adversary needs nothing but a wordlist and electricity, because the addresses are public. To grind a passphrase an adversary must already hold your recovery words, which means the attack only starts after a physical compromise. Weak human input is dangerous in both, but only one of them is exposed to the entire internet from the moment it is funded.