Short answer: 12 words is already unbreakable, and 24 words does not fix any problem you actually have. If your wallet gave you 24, keep them. If it gave you 12, you are not carrying a weaker wallet in any sense that matters. The difference is real but it lives in a place almost nobody’s threat model reaches.
Here is the honest version of why.
What the two lengths actually encode
Under BIP-39, each word carries 11 bits, because the wordlist holds exactly 2,048 = 211 words. The lengths break down like this:
| Words | Total bits | Entropy | Checksum | Search space |
|---|---|---|---|---|
| 12 | 132 | 128 | 4 | 2128 ≈ 3.4 × 1038 |
| 24 | 264 | 256 | 8 | 2256 ≈ 1.2 × 1077 |
So 24 words is not “twice as secure”. It is 2128 times as many possibilities — a number with 39 more digits. Which sounds decisive until you ask what 2128 already means.
Why 128 bits is already the end of the argument
Take the largest computing effort humanity actually operates: the Bitcoin mining network, running on the order of 1021 hashes per second. Point all of it at guessing seed phrases instead of mining.
It does not get 1021 guesses per second, because a candidate phrase is not one hash. BIP-39 stretches the phrase into a seed using 2,048 rounds of PBKDF2-HMAC-SHA512, so each guess costs about two thousand times a bare hash. That leaves roughly 5 × 1017 candidate phrases per second.
Searching 2128 at that rate takes about 2.2 × 1013 years — some 1,600 times the current age of the universe. And that is the entire global mining industry working on one wallet, forever, with no electricity bill.
It is worth being precise here rather than reaching for the biggest number available, because the sloppy version of this claim is easy to disprove and it undermines the true one. The deliberate key-stretching is doing real work in that calculation: it is what turns an already-large number into an unreachable one.
A security margin that large is not improved by making it larger. Both 12 and 24 words sit in the same category: the phrase will never be guessed. It will be lost, photographed, or handed over.
So why does 24 exist at all?
Three defensible reasons, none of which is “12 might get cracked”.
1. Symmetry with 256-bit keys. The underlying private keys are 256-bit numbers. A 256-bit seed means the seed is not the narrowest part of the system. This is tidiness rather than practical defence, since 128 bits is already out of reach.
2. Grover’s algorithm, if you take the long view. A large quantum computer running Grover’s search would roughly halve the effective strength of a brute-force search — 128 bits behaves like 64, and 256 behaves like 128. Sixty-four bits is genuinely uncomfortable; 128 is not. So a 24-word phrase is the conservative choice on a multi-decade horizon.
Two caveats keep this honest. Machines capable of that do not exist and are not close. And it is the wrong thing to worry about first: the same quantum computer running Shor’s algorithm attacks the elliptic-curve signature on your spent coins directly, which is a far cheaper path than brute-forcing your seed. Upgrading 12 words to 24 does nothing about that. We cover the real shape of this in quantum.
3. Institutional convention. Custodians and auditors like the larger number because it is defensible on paper. That is a procurement argument, not a cryptographic one.
The costs of 24 words, which are real
Since the security gain is theoretical, the practical costs deserve equal billing:
- Twice the transcription risk. Every word is a chance to write the wrong thing, in the wrong order, or illegibly. Backup failures are overwhelmingly transcription failures, and you double the surface.
- Twice the stamping work on a metal backup, and twice the plate space.
- Twice the verification effort every time you check a backup is still correct.
Put plainly: 24 words defends you against an attacker that does not exist, at the cost of doubling your exposure to the failure that actually happens.
Can you convert between them?
Not in any meaningful sense. The word count is a property of how much entropy the wallet generated at creation. You cannot append twelve words to a 12-word phrase and arrive at the same wallet with more security — that is a different seed and therefore different keys entirely.
If you genuinely want to move from 12 to 24, the only route is to create a new wallet with a 24-word phrase and send your funds to it. That is an on-chain transaction with fees, and a fresh chance to make a backup mistake. For the reasons above, it is almost never worth doing on security grounds alone.
What actually improves your position
If you have decided you want more protection than you have now, these all beat adding words — in descending order of how much they help most people:
- Get the backup onto metal, in two buildings. This addresses the failure that genuinely occurs.
- Verify the backup works before you rely on it.
- Add a passphrase if your threat model includes someone finding the words. This adds real, tunable secrecy on top of either length — and unlike extra words, it protects against discovery rather than against arithmetic.
- Write instructions for your heirs, since inaccessible crypto is lost crypto.
The word count on your card is close to the least important decision in your custody setup. Where the card lives is one of the most important.
Sources
- BIP-39 — entropy sizes, checksum lengths and the 2,048-word list
- NIST FIPS 205 — context on post-quantum standardisation and hash-based schemes