Brain Wallets: Why a Passphrase You Made Up Is a Key Someone Can Guess

Where you're going: A brain wallet is a Bitcoin key made from a phrase you keep in your head. A standard formula called a hash turns the phrase into a very long number, and that number is the private key, the secret that lets its holder spend the coins. In February 2014 James D'Angelo made five of them on video and sent real money to three. This chapter walks through his lesson and then checks it against the chain: what happened to his coins, why a phrase a person makes up is far easier to guess than it feels, who was already running programs to take such coins, how the best-known site shut down, what the chain had recorded for the famous phrases by November 2026, and what replaced the idea.

Credit: This chapter recreates a lesson from James D'Angelo's "Bitcoin 101" Blackboard Series for the World Bitcoin Network: "Fun with Brain Wallets (Making and Playing With Them)" (9 February 2014). The demonstration is his: type a phrase, hash it, and send real money to see what happens. The words and the drawings here are ours, and so is the chain data, read in November 2026. It is the second in a set of credited recreations of the Blackboard Series; the first is Quindecillions.

Thirty cents

On Saturday 8 February 2014, James D'Angelo was recording a lesson for his World Bitcoin Network channel. He was working with two web pages. One scrambles any text into a fixed-length string of letters and digits, called a SHA-256 hash, and the other turns a hash into a Bitcoin address. He typed Satoshi Nakamoto into the first, pasted the result into the second, and looked the address up on a block explorer, a site that shows every payment an address has received. The address already had a history of ten transactions. It had received 23 cents in all and held nothing. He sent it 30 cents from the channel's own wallet and told his viewers they were welcome to go and take it.

Bitcoin records payments in batches called blocks, about one every ten minutes, and until a payment is in a block it waits in public, unconfirmed. His was confirmed in block 284,859, stamped 21:05:29 UTC. The same block holds a second transaction that spends those coins to another address, one that had collected coins from a better-known brain wallet four times in the two months before. The 30 cents were claimed while his payment was still waiting, and the video would not be published for another 24 hours. Whoever took the money had not watched the lesson. They already had the phrase.

A key made this way is called a brain wallet, and from about 2011 to 2015 it was a popular idea.

A key you can say out loud

A Bitcoin private key is a secret number, and whoever knows it can spend the coins at its address. The number is 256 bits long, up to 78 digits written out. SHA-256, the hash function Bitcoin uses for almost everything, takes any input, from a name to a whole book, and returns a number of exactly that size. So the hash of any text can serve as a private key, which is how the classic brain wallet works. Here is the first phrase D'Angelo types in the video, run through our own short program. The three lines are the phrase, its hash, and the address that goes with that key:

passphrase    Happy New Year
SHA-256       d2b85fa6a231e708bd7dfa023a6e6a51c9ddb8eaf3786e6428b10b1bbc158da5
address       1F1eetZmGydCzyGpfYHhmdVVc22b6sbfEa

The middle line is the private key. Anyone who types the same fourteen characters gets the same key and the same address, on any computer, in any year. Nothing has to be stored, in a file or on paper, and that was the appeal. D'Angelo opens his lesson with a man stopped at a border with gold hidden in his car seats, and offers the brain wallet as the science-fiction alternative, wealth that crosses a border inside your head.

The first bounty and the best-known site

The earliest case we can find with money behind it is from 14 July 2011. A member of the forum now called BitcoinTalk who posted as casascius, later known for the Casascius physical coins, put up a single sentence and offered the coins to whoever worked out where they were. The sentence was "This string contains 0.25 BTC hiding in plain sight." Within the hour another member guessed that the SHA-256 of the sentence was the private key, and the winning claim was confirmed 3 hours and 20 minutes after the coins arrived. Before the day was over casascius had described where this could lead, a future wallet that let people keep coins on passphrases "and suckers choosing poor passphrases as places to put their coins". The same post argued that guessing such phrases by brute force would be slow.

The best-known site for it, brainwallet.org, went online in April 2012. We have a copy of its last working version, from 1 August 2015. The whole scheme is one line of its JavaScript, the code the page ran in the visitor's browser:

var hash = Crypto.SHA256($('#pass').val(), { asBytes: true });

Take whatever is in the passphrase box, hash it once, and use the result as the key. By its last months the page was candid about that. The hint in the box read "Long sentence that does not appear in songs or literature. SHA256 used as private key. Should not be empty!" There was no minimum length and no strength check.

For most of its first two years the page opened with a passphrase already typed in: "correct horse battery staple", the example from a well-known comic strip about passwords that we come to below. Every visitor was shown the same ready-made key and address, and by November 2026 that address had more than 4,000 transactions on it. In May 2014 a contributor had the phrase taken out, because visitors could mistake it for a random one and use it. The maintainer accepted the change and at first made the page refuse an empty box. A week later the refusal was removed, under the note "default password is blank", and the page computed a key for the empty box instead.

Opened fresh, the copy we have displays a private key, an address and a QR code before a visitor has typed a character. They belong to the empty passphrase, which the hint in the box told visitors not to use. By 9 November 2026 that address, 1HZwkjkeaoZfTSaJxDw6aKkxp45agDiEzN, had received 60 BTC in 423 payments, and 57.9 of those bitcoin came in the fourteen months between that change and the day the site closed. Fifty of them arrived in one payment on 29 July 2015 and were spent in the same block. The chain does not say what any sender meant to do. In a talk that two of the researchers who later measured brain wallets gave in 2017, the speaker called the empty passphrase the most common brain wallet of all and doubted that anyone had ever meant to put money there.

D'Angelo did not use that site. He hashed his phrases on a general-purpose SHA-256 calculator and pasted the results into another widely used tool of the time, bitaddress.org, whose own brain wallet tab had refused his first phrase: its limit was fifteen characters, and Happy New Year has fourteen. The refusal came with a warning: "Choosing a strong passphrase is important to avoid brute force attempts to guess your passphrase and steal your bitcoins." That was the advice of the day, and he pointed his viewers to its fullest statement, the Bitcoin Wiki's brain wallet page, which casascius had started in January 2012. Since that August the page had said that a passphrase must be "an entire original sentence that does not appear in any song or literature", and that with anything weaker "theft of the brainwallet is an eventual certainty". In February 2014 the wiki's advice was to choose a better phrase. Its advice to stop making up phrases at all came in 2015.

Three payments, one recording

D'Angelo funded three wallets in that session. One was Satoshi Nakamoto, with its 30 cents. Another was World Bitcoin Network, which he called a weak phrase; he sent it about a dollar. The third was his example of a very good one: the same three words, a dollar sign, a sentence about eating lasagna on a sunny day, and the last word stretched with twelve extra letters, 79 characters in all. It also got about a dollar. He expected viewers to empty all three soon after the video went up, and said so more than once.

We read all three histories from the Bitcoin Core node behind ChainQuery on 9 November 2026. Amounts are in sats, short for satoshis, the smallest unit of bitcoin; 100 million of them make one bitcoin.

The table gives the same three payments with their block numbers.

Passphrase	Sent	Confirmed (UTC)	Spent (UTC)
Satoshi Nakamoto	41,700 sats, about 30 cents	Block 284,859, 8 Feb 2014, 21:05	The same block
World Bitcoin Network	139,100 sats, about 98 cents	Block 284,859, 8 Feb 2014, 21:05	Block 285,006, 9 Feb 2014, 21:27
The 79-character phrase	139,100 sats, about 98 cents	Block 284,860, 8 Feb 2014, 21:11	Block 285,008, 9 Feb 2014, 21:34

The first row is the 30 cents from the opening. A payment can be spent in the same block that records it because it first waits in the mempool, in public, until a miner, one of the computers that assemble blocks, picks it up. A program that already holds the key sees the payment arrive, signs a transaction spending it, and broadcasts that while the payment is still waiting. A miner can then put both in one block, which is what "spent in the same block" means: the coins never rested at the address at all.

YouTube's own record puts the video's publication at 21:00:41 UTC on Sunday 9 February. The two phrases nobody had seen sat untouched for 147 and 148 blocks, a little over 24 hours. The first block the chain records after the video went up, 285,006, carries the transaction that empties World Bitcoin Network, and block 285,008 empties the long one. The coins went to two different addresses, 27 and 34 minutes after publication by the block stamps.

Without planning it, the lesson ran something close to a controlled experiment. The 79-character phrase lasted about as long as the three-word one, 148 blocks against 147, because both were on screen in the same video, and its length never came into it. Each wallet was emptied once somebody else had its phrase. For the famous name that was before D'Angelo typed it; for the other two it was when the video went public. Whether a guessing program would ever have reached the long phrase on its own nobody can say, because the video gave it away first.

The famous name's address kept receiving payments afterward. By 9 November 2026 the Satoshi Nakamoto address he paid had received 36 payments, the first a single satoshi in December 2011 and the last in August 2025. Of the 36, 21 were spent in the block that confirmed them, including both payments of 2025, one of which was 800 sats.

Why a made-up phrase is easy to guess

A key made by a wallet is one of about 1.16 x 10^77 possible numbers, and Quindecillions works through why nobody finds one of those by searching. A brain wallet's key is one of those numbers too, but it comes from a much smaller set, the phrases a person might think of, and a thief only has to search that set.

Guessing the password to a website is slow work, and four things make guessing a brain wallet fast.

• Nothing limits the guesses. A website locks an account after a few wrong tries. A thief hashing phrases at home answers to nobody and can try as many as the hardware allows.
• Every wallet is attacked at once. Careful websites store only a hash of each password, and before hashing they mix in a random value called a salt, so the same password looks different for every user and each account has to be attacked on its own. A brain wallet has no salt. The same phrase gives the same key to everyone who ever picks it, so one guess is checked against every address on the chain.
• The hash is fast. SHA-256 is built to be quick. Password systems use functions that are slow on purpose, so that every guess costs something.
• The targets are public and the prize is cash. Every address that has ever held coins is on the chain, with its balance beside it.

Ryan Castellucci, a security researcher whose 2015 talk this chapter comes back to, put it on one slide: "Brainwallets make the Blockchain a public password hash database". The slides after that one score the chain's version the way an auditor would: it is hashed, it is not salted, and on whether it is slow their answer is "Kinda".

The usual yardstick for the size of such a set is strip 936 of the web comic XKCD, from August 2011, which argues for passwords made of four random common words such as "correct horse battery staple". It counts 2^44 possibilities, about 18 trillion. Guessers measure such counts in bits, and each bit is one doubling, so 2^44 is 44 bits. The comic reckons 550 years to guess one such password at a thousand tries a second. It says where that pace comes from, an attack on "a weak remote web service", and adds that "cracking a stolen hash is faster".

With a brain wallet nothing has to be stolen, because the address each guess is checked against is already on the chain. Castellucci's cracker, a program they wrote to guess phrases, tried 130,000 of them a second on their own desktop in 2015, with each try tested against every address at once. The same slides estimated that the botnets of the day, networks of hijacked computers, could check 2^48 phrases every 24 hours. At that rate the comic's whole four-word set lasts 90 minutes. A 2016 paper by Castellucci and two colleagues put the cost of the attack on rented servers at about 56 dollars per trillion guesses, which prices the entire four-word set at under a thousand dollars.

The chart puts seven kinds of secret on that scale, from a common password to the words a wallet makes.

All of that assumes the four words are random, since the comic's method works only if dice or a computer pick them. A phrase a person composes, a lyric, a movie line or a pet's name with a year on the end, comes from a far smaller set than its length suggests, because attackers build their lists from what people have already written and said. Castellucci's slides describe the recipe: scrape song lyric sites, Wikiquote, Project Gutenberg, forums and mailing lists, then apply rules for punctuation, capitals and spaces. "If someone else came up with it," one slide warns, "it will eventually make it into a phraselist".

The research on phrases people choose says the same. In 2012 Joseph Bonneau and Ekaterina Shutova probed a real system, an Amazon service that had customers pick a passphrase of two or more words. Of 476 song titles they tried, 73 percent were already somebody's phrase. Their conclusion was that "even 4-word phrases probably provide less than 30 bits of security", against the 44 bits of four words chosen at random. Thirty bits is about a billion guesses, a little over two hours for one 2015 desktop.

When you set up a modern wallet, it draws 128 random bits, shows them to you as twelve words from a standard list of 2,048, and asks you to write the words down. That is about 3.4 x 10^38 possibilities. It is some 19 trillion trillion times the four-word set, and the same botnets would need about 3 x 10^21 years to cover it.

Who was already guessing

Castellucci had found out by accident, in 2013, how exposed a brain wallet could be. Their first cracker, a slow one fed with word lists they already had, turned up the tongue twister how much wood could a woodchuck chuck if a woodchuck could chuck wood. The address behind it held 250 BTC, worth "about $15k" by the draft of their slides. All they had was an address, so they made a plan to warn its owner through the chain: pay the address a few cents, then take those cents straight back to a vanity address beginning "yoink", and hope the owner noticed that a stranger could spend from the wallet.

An address holds each payment it has received as a separate coin, with no single balance, and a transaction spends whole coins and sends the remainder back as change. Castellucci's wallet software picked the coin to spend, and it picked the 250 BTC one instead of the few cents. The chain carries the round trip. On 24 March 2013, in block 227,725, one transaction spends the 250 BTC that had sat there for 38 days: 31,337 sats go to an address beginning 1yoink, and 249.99918663 BTC go to a change address the software had just made up. Two blocks later, 22 minutes by the stamps, 250.001 BTC is back at the brain wallet's address. A screenshot in the draft slides shows the two transactions being sent less than two minutes apart. By their account, they then reached the owner through the operator of a mining pool. On 29 March the coins left for a new address.

Castellucci told the story at DEF CON 23, a hacker conference in Las Vegas, on 7 August 2015. Their slides begin with a fresher one: "Somebody just lost $14K last week." That was the 50 BTC paid to the empty passphrase nine days before. By 9 November 2026 the address that collected them had received 266 payments, had never spent one and held 55.49 BTC, for reasons the chain does not show.

The talk came with a much faster cracker called Brainflayer, which checked each guess against a lookup filter built from every address that had ever appeared on the chain. A month earlier Castellucci had explained in a blog post why they were giving away a tool that could be used to steal: there was no getting the flaw fixed, the post said, pointing in a footnote to the patch brainwallet.org had turned down, and other people were already exploiting it with crackers of their own. The slides put the number of active thieves at about half a dozen, racing each other with bots and lookup tables of at least 10 billion phrases.

The measurement came the next year, in a paper for the Financial Cryptography conference of 2016. Marie Vasek, Joseph Bonneau, Castellucci, Cameron Keith and Tyler Moore ran about 300 billion candidate phrases from more than twenty word lists against every transaction up to August 2015. Quindecillions has the headline numbers: 884 brain wallets found, 1,806 BTC through them, half emptied within 21 minutes of being funded. The paper, and a talk two of its authors gave in 2017, add four details to those numbers.

• The 884 is a floor. The authors could count only the wallets whose phrase they managed to guess. When two of them repeated the search in 2017 with thirteen times as many phrases, the count rose to 2,005.
• Nearly every wallet was emptied, and quickly. All but 21 of the 884 were drained at least once, and people kept paying into emptied wallets, so the paper counts 1,895 drains in all. By September 2013 the typical time to drain was "measured in minutes and seconds rather than hours".
• A drain is not always a theft. Owners move their own coins too, though the authors judged that most drains were not the owner's. The 1,806 BTC counts everything paid in. The paper's table of drains is ranked in dollars, and its top two entries are both the woodchuck's 250 BTC, moved once in Castellucci's accident and once by the owner. The four entries the table labels as drainers add up to about 90 BTC.
• Draining was a poor living. The authors confirmed at least 14 drainers. The top four took about 35,000 dollars between them, the busiest emptied 100 wallets for 3,219 dollars, and one robbed 78 wallets for 62 dollars. Only 6 percent of the wallets ever received a hundred dollars' worth.

How the site closed and the advice changed

On the forums the warnings had gone further than the wiki's by the middle of 2013. In July 2013 a brainwallet.org user reported on BitcoinTalk that coins sent to a new brain wallet had been moved "literally within seconds", and the developer Mike Hearn replied, "The owner of that site needs to shut it down." That October another developer, Gregory Maxwell, was asked on the same forum whether a standard for brain wallets existed and answered with a mock one in capitals: "FOR GODS SAKE. DON'T DO IT. YOU MAY THINK YOU ARE SMART ENOUGH. SO DID EVERYONE ELSE WHO GOT ROBBED."

On 29 October 2013, two weeks after Maxwell's post, a contributor offered brainwallet.org a change to its code that would have let a user put a passphrase through 100,000 rounds of hashing in place of one. The site's maintainer closed the request seven hours later. "You don't really need that," the reply began. Turning a passphrase into an address also takes a second piece of arithmetic, an elliptic-curve multiplication, which the maintainer described as "a few orders of magnitude slower than SHA256", so it was "not possible to calculate MILLIONS of passphrase-based addresses per second". Castellucci answered that in a footnote in July 2015: the extra step is about a hundred times slower than a hash, and good practice for passwords calls for a slowdown of a hundred thousand to a million times.

In February 2015 the developer Peter Todd called brain wallets "such scary technology" on the developers' mailing list. The wiki's advice turned that year. On 30 May an editor deleted the page's example passphrase with the note "this example is a great way to get your money stolen". It was the example D'Angelo had walked through on camera, under a card telling viewers not to send money to it. The example's own address had received five payments by then, and every one had been spent.

The site closed on the day of the talk. Castellucci was due on stage in Las Vegas at 14:00 on Friday 7 August 2015, which is 21:00 UTC. The public record of the site's code, its repository, shows its last change stamped 20:57 UTC that day by its author's clock, and GitHub's public log of events shows it arriving at 21:00:00. That change deletes the site's code and replaces the page with two words, "Closed Permanently". The page gave no reason. The copy we quoted earlier matches, file for file, the version from six days before, the last one that worked.

Two days later the same wiki editor removed the page's advice on choosing a strong phrase: "we should not encourage people to use human-generated passphrases no matter how good they think they are". As of November 2026 the page files the whole scheme under "Obsolete brainwallet style" and says it "should not be used".

What the chain shows for 32 phrases

Closing one website did not retire the arithmetic, which takes a few lines of code with any Bitcoin library. In January 2026 the Milk Sad research group published a count of 20,397 addresses known to have been made this way, built on public lists of phrases that others had already cracked, and called it a lower bound. It is a different kind of count from the 2016 study's 884, which left out some 17,800 wallets that its authors took for other people's experiments.

We ran a much smaller check of our own, with no cracking tool. We typed 32 phrases by hand: the five from D'Angelo's video, seven that the slides and the paper name, and twenty obvious guesses such as password, bitcoin, test and 1. Each phrase makes two old-style addresses, the kind that start with 1, because Bitcoin has two ways of writing a public key, uncompressed and compressed, and each gives an address of its own. We read what had happened at all 64 from a public block explorer, and at all but the four busiest from the Bitcoin Core node behind ChainQuery as well. Wherever we had both, the two agreed on every count.

By 9 November 2026, 29 of the 32 had been used. Their addresses had received 1,307.7 BTC between them, and every one of those addresses held nothing. The table shows seven of the histories. Each row is the phrase's uncompressed address, the form the old sites made by default; the other address usually has far less on it.

Passphrase (uncompressed address)	Payments in	BTC received	First payment	Last payment by 9 Nov 2026
The empty passphrase	423	60.0	September 2012	May 2026
bitcoin is awesome	50	501.1	November 2012	March 2026
how much wood could a woodchuck chuck if a woodchuck could chuck wood	55	500.1	February 2013	February 2026
Down the Rabbit-Hole	7	165.1	July 2012	December 2021
The quick brown fox jumps over the lazy dog	8	10.1	October 2012	March 2023
one two three four five six seven	13	0.22	September 2011	September 2011
1	91	0.21	January 2014	August 2026

"Received" counts every payment in, so some coins are counted twice. The woodchuck's 500 BTC is the same 250 counted on arrival and again on its return, and about half of the 165 BTC at Down the Rabbit-Hole is change from its own spending, paid back to the same address. In all, at least 334 of the 1,307.7 BTC is change or returned coins of that kind. A spend is not always a theft either, since owners moved their own coins too. The table shows that these phrases were in use and that none of their addresses held anything on 9 November 2026.

The large sums are old, since nearly all of the bitcoin arrived in 2012 and 2013; 500 BTC went to bitcoin is awesome on 20 November 2012 and went back 43 minutes later to the address that had sent it. The spending got faster after that. For the 39 addresses whose full history we could download, 1,150 payments in all, the next table groups the payments by the year they arrived. "None" in the last column means that at least half of that row's payments were spent in the block that confirmed them.

Paid in	Payments	Spent in the same block	Typical wait before the coins moved
2011	14	0	About a month
2012	20	2	About four hours
2013	50	20	Two blocks
2014	210	97	One or two blocks
2015	124	94	None
2016 to 2023	608	386	None
2024 to 2026	124	122	None

Four addresses had histories too long for us to download in full: the comic's phrase, with about 4,200 transactions, and three of the words we typed, password, god and wallet, with about 45,000, 47,000 and 40,000. Most of the traffic at those three looks like one sender's work: on 9 November 2026 two of them had exactly 28,065 payments each and the third had 28,099. The 2016 paper set aside 15 brain wallets that were flooded during a 2015 "stress test" of the network, and these look like three of them.

This is 39 hand-picked addresses, not a survey. Single bursts of test payments dominate some years, 2017 and 2020 were slower than the years around them, and the recent rows are thin. Most of the payments of 2025 and 2026 come from two bursts that look like someone testing the programs that take these coins, one of them 39 payments from a single address in February 2026. Even so, every payment in those two years, the smallest of them 550 sats, was spent in the block that confirmed it. The data behind the two tables in this section can be downloaded, with one row per address and one row per payment.

What a slow hash buys

Two repairs were available by the time the site closed.

The first kept the idea and made guessing expensive. WarpWallet, published in November 2013 by Max Krohn and Chris Coyne, ran the passphrase through scrypt, a function built to be slow and hungry for memory, and let the user mix in an email address as a salt, so that an attacker "would have to target you individually". Its authors tested it in public. They put 10 BTC behind a passphrase they described only as eight characters, all letters and digits. That is about 2.2 x 10^14 possibilities, fewer than Castellucci's estimate of what a botnet could try against ordinary brain wallets in one day. The coins arrived on 19 November 2013 and were still there when the deadline the page had set, 1 January 2016, passed. A month later the same 10 BTC went on to fund a second challenge. Four smaller prizes behind deliberately weak phrases were all taken within eight days.

So a slow hash does buy something. It multiplies the cost of every guess by a fixed amount; Castellucci's figure was from 130,000 guesses a second down to about one. That was enough to protect eight characters with no pattern to them. It does nothing for a phrase near the top of everybody's list, and the challenge says nothing in favor of a phrase a person makes up: the answer its authors later published, PuACRv0R, is not a phrase anyone would make up.

What replaced it

The second repair removed the human choice, and it is the one that won. One wallet had made that change early. In its first days Electrum, released in November 2011, asked each user to type in a seed of their own, the secret a wallet makes all its keys from, that was "long and random". On 6 November its author replaced that with 128 bits drawn by the computer, under the note "use random seed; do not trust the user for entropy" (entropy is the technical word for randomness). The site brainwallet.org went online five months later.

BIP-39, a Bitcoin Improvement Proposal assigned its number in September 2013, turned the approach into a shared standard. The wallet draws 128 to 256 random bits and shows them to you as 12 to 24 words from a fixed list of 2,048. It picks the words and you copy them down. The proposal's Motivation section says it is "a way to transport computer-generated randomness with a human-readable transcription" and "not a way to process user-created sentences (also known as brainwallets) into a wallet seed". The words are called a seed phrase. A seed phrase reads like a passphrase, but every combination of words is as likely as every other, so there is no list of likely ones to try first. The entropy bits entry has the arithmetic.

BIP-39 also lets you add a passphrase of your own on top of the words, the so-called 25th word. That one is a human choice again. It is safe to the extent that it sits behind random words a thief does not have, and on its own it would be a brain wallet.

If you still want it in your head

The wish behind the brain wallet was reasonable. A secret that exists only in memory cannot be photographed or found when a house is searched. As of November 2026 the Bitcoin Wiki uses the word for something narrower, memorizing a seed phrase that a wallet generated. Nobody can guess such a phrase, but there are two other ways to lose it.

The first is forgetting. In a 2014 study by Bonneau, one of the brain wallet paper's authors, and Stuart Schechter, paid participants learned a random 56-bit secret a little at a time over about ten days. Of those who finished, 94 percent learned it, and 88 percent of those tested about four days after they stopped could still type it exactly. Two weeks after that, 59 percent could. That is a random secret less than half the size of a twelve-word seed, drilled for ten days, and four in ten had lost it within three weeks of stopping.

The second is dying. D'Angelo makes both points himself at the end of his lesson: forget one character and you may never get the money back, and if you die your family may never get it either.

So treat memory as a second copy and never the only one. Write the words down and store them the way Seed Backup Strategies describes, and if someone must be able to recover the coins without you, plan for that on paper too.

Pro tip: If a tool ever asks you to invent the words that make your key, stop. A wallet doing its job shows you words it drew at random and asks you to write them down. And if you still have coins behind a phrase you once made up, treat that key as public and move them to a wallet that drew its own words.

What this buys us

• You know what a brain wallet is. One hash turns a phrase into a private key, and nothing has to be stored.
• You know why it fails. No salt, no limit on guesses, a fast hash, a public list of targets, and phrases that come from a far smaller set than their length suggests.
• You know how fast. Half of the wallets in the 2016 study were emptied within 21 minutes. In our own small check, every payment of 2025 and 2026 was spent in the block that confirmed it.
• You know what happened on camera. Thirty cents sent to a famous name were gone a day before the video was published, and two phrases nobody knew lasted until the video showed them.
• You know what replaced it. A wallet draws 128 to 256 random bits and hands them to you as words. Twelve of those words are about 19 trillion trillion times harder to guess than four random ones, and nobody has a list to start from.

Let the wallet pick the words, and write them down.