Key Space

Where you're going: A visceral, scale-by-scale walk through the number of possible Bitcoin private keys. By the end you'll understand why "guessing" a Bitcoin key is a strategy no amount of extra computers can rescue.

Why This Matters

Your Bitcoin lives behind a private key. Anyone who knows the key can spend the BTC. Anyone who doesn't, can't.

That sounds fragile. What stops an attacker from just trying every possible key until they hit yours?

The answer is "the math," and it is not a casual answer. The number of possible Bitcoin keys is so large that it overwhelms every intuition you have for large. Bigger than the number of grains of sand on Earth. Bigger than the number of stars in the observable universe. It even lands within a few orders of magnitude of the number of atoms in the observable universe, though, as you'll see below, it falls short of that one.

This rabbit hole is a tour through that number. The goal isn't to teach you cryptography; it's to make you feel the scale at a gut level, so you understand why "brute-forcing a Bitcoin key" isn't a real category of threat. It's not even on the menu.

The Number

A Bitcoin private key is a 256-bit number. "256-bit" means it can take any of 2^256 possible values - call it the key space. (Strictly, a valid key must be at least 1 and below the curve's order n, a number just under 2^256. That rules out about 4 x 10^38 values, which sounds like a lot until you see it is less than one part in 10^38 of the total.)

2^256 written out in decimal:

115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,913,129,639,936

Seventy-eight digits. We don't have intuition for numbers this big. So let's build some.

Walk It

Key Space Visualizer

drag the slider, or click a step

2^256 ~ 1.16 x 10^77

Bitcoin's private key space. Still 9 to 90,000 times smaller than the number of atoms in the observable universe (estimates run 10^78 to 10^82).

2⁸2¹⁶2³²2⁶⁴2⁹⁶2¹²⁸2¹⁶⁰2¹⁹²2²²⁴2²⁵⁶

Estimates: atoms in the observable universe ~10⁷⁸ to 10⁸²; grains of sand on Earth's beaches and deserts ~7.5 x 10¹⁸; atoms in a 70 kg human body ~7 x 10²⁷. Bitcoin's private key space is just under 2²⁵⁶, about the same size as the SHA-256 output space. You will not brute-force a key. Sources are listed at the end of the chapter.

What This Means in Practice

Bitcoin's security against brute-force key guessing rests on this number being absurdly large. To make it concrete:

• Imagine 10 billion computers, more than one for every person on Earth, repurposed to do nothing but guess private keys.
• Imagine each one tries a trillion keys per second.
• Imagine you keep this up for a billion years.

That fleet checks about 3 x 10^38 keys, roughly 2^128. Against a space of 2^256, that is about one part in 2^128 (3 parts in 10^39), which is also the chance that one of those guesses was your exact key. Checking all 2^256 keys at that pace would take around 4 x 10^47 years, more than 10^37 times the age of the universe.

One detail works in the attacker's favor. Addresses starting with 1 or 3 and standard single-key bc1q addresses commit to a 160-bit hash, so any key that happens to produce the same hash would unlock the coins too. That shrinks the search from 2^256 to about 2^160. Even so, the billion-year fleet has only a few chances in 10 billion of hitting one particular address.

The math doesn't care how fast your hardware gets. Doubling your computing power doubles the number of keys you can check, which moves you exactly one bit further. The imaginary fleet reached about 2^128. To cover all 2^256 keys it would have to double about 128 more times. That is not a war you can win by buying more GPUs.

All of that assumes blind guessing. If your public key is already on chain, a smarter attack needs only about 2^128 steps, and the next section explains why that is still out of reach.

So Why 256 Bits?

An elliptic-curve key needs about 256 bits to be as strong as a 128-bit AES key. AES-128 (the symmetric encryption used everywhere from your WiFi to your hard drive) is considered safe against brute force. Elliptic-curve keys need double the length because of a known shortcut. Starting from someone's public key, an algorithm called Pollard's rho can find the private key in about 2^128 steps, the square root of the key space.

SEC 2, the document that defines secp256k1, rates it at 128 bits, and NIST's key-management guidance puts 256-bit elliptic-curve keys in the same 128-bit class as AES-128. 2^128 steps is still far out of reach. It is about what the imaginary fleet above, which does not exist, would need a billion years to grind through for a single key.

A few things decide what those bits are really worth:

1. Quantum computers. A large enough quantum computer running Shor's algorithm could compute a private key straight from its public key, with no guessing, and longer keys would raise its cost only modestly. NIST lists elliptic-curve signatures as "no longer secure" once such machines exist. Grover's algorithm, which halves the bit-strength of a blind search, would still need about 2^128 steps here, no better than Pollard's rho. No quantum computer anywhere near the size Shor's needs exists as of October 2026. The Quantum and Bitcoin rabbit hole has the details.
2. Birthday-style shortcuts. Pollard's rho is a collision search. It takes random-looking walks around the curve until two of them land on the same point, and the birthday-paradox math says that happens after roughly sqrt(2^256) = 2^128 steps. Hash functions face the same math. Finding any two inputs with the same SHA-256 output takes about 2^128 work, and for a 160-bit hash about 2^80. Bitcoin's design accounts for this. SegWit's P2WSH script addresses use a 256-bit hash instead of P2SH's 160-bit one because, in the words of BIP 141, 2^80 work "is not infeasible anymore."
3. Bugs and bad randomness. When cryptography fails in practice, the cause is usually a flaw in the design or the code, such as a weak random number generator. Flawed generators in Android (found in 2013) and Libbitcoin Explorer (found in 2023) both left Bitcoin wallets open to theft. 128-bit security keeps brute force off the table, which leaves flaws as the thing worth worrying about.

Most attacks on Bitcoin keys in practice are not brute force. They're:

• Stolen or badly stored seed phrases (the human element; see Seed Backup Strategies)
• Weak entropy in key generation (the bug element)
• Side-channel attacks on hardware (the implementation element)
• Phishing and social engineering (the everything-else element)

The size of the key space rules out guessing, so real attackers go after the seed phrase, the software or the person instead.

The Math, Simplified

For context, the powers of 2 from the visualizer above translate to these "real world" comparisons:

Bits	Approximate size	What it's roughly equivalent to
2^32	4.3 x 10^9	IPv4 address space
2^64	1.8 x 10^19	About 2.5 times the estimated grains of sand on Earth's beaches and deserts
2^96	7.9 x 10^28	About 11 times the atoms in an adult human body (~7 x 10^27)
2^128	3.4 x 10^38	IPv6 address space; AES-128 key space; roughly the security level of a Bitcoin key (see above)
2^160	1.5 x 10^48	Every possible 160-bit address hash (addresses starting with 1 or 3, single-key bc1q addresses)
2^192	6.3 x 10^57	Several times the atoms in the Sun (~10^57)
2^224	2.7 x 10^67	About half the atoms in the Milky Way's stars (~6 x 10^67)
2^256	1.2 x 10^77	Bitcoin's private key space - 9 to 90,000 times smaller than the atom count of the observable universe (10^78 to 10^82)

Estimates for the observable universe run from about 10^78 to 10^82 atoms. Bitcoin's key space, about 1.2 x 10^77, is smaller than every one of those estimates, by a factor of somewhere between 9 and 90,000. Give every atom in the observable universe its own private key and you would run out of keys first. Still, the two numbers sit within a few orders of magnitude of each other, which is a strange thing to be able to say about a number you can write on an index card.

The Practical Takeaway

You don't have to "trust" Bitcoin's key security. You can reason about it.

• Generate a key randomly (good entropy)
• Keep it secret
• Use a wallet that doesn't leak metadata
• Don't get phished

Brute force is not on the threat model. The math is doing its job. What's left is mostly operational, plus the long-term quantum question covered in the Quantum and Bitcoin rabbit hole.

Pro tip: Whenever someone tells you Bitcoin will "eventually be cracked by computers," ask which computers. The Bitcoin mining network, which does nothing but hash, ran at about 10^21 hashes per second in October 2026. Pretend each hash were one step of Pollard's rho, the best known non-quantum attack on a key whose public key is already on chain. Recovering that one key would still take about 10 billion years, roughly 70 percent of the age of the universe. The serious long-term question is a quantum computer running Shor's algorithm, which skips guessing entirely.