t

he short version, before the cat: a password strength meter measures how a string looks, not how it was made. If your secret was derived from something short, no amount of symbols and capital letters makes it harder to guess — and in Bitcoin, that distinction is the whole game.

Tuga has a toy mouse. When she's bored she bats it under the sofa, then spends ten minutes staring at the gap with her tail going, completely convinced the mouse has become a different and more interesting mouse by virtue of being somewhere else.

It hasn't. It's the same mouse in a new position. The thing that changed is her view of it.

I bring this up because I had a long exchange in the comments last week with someone who believes you can take a single character, run it through a generator, and end up with a secret that would take centuries to crack. He had evidence: he'd pasted the output into a password strength meter and it told him so.

The meter was not lying. It was answering a different question than the one he thought he'd asked. That gap is worth an article, because it's where a specific and recoverable kind of money loss comes from.

1. What a strength meter actually measures

You paste K7#mQ2$vLp9!xZ into a checker and it says centuries. What it has done is estimate: if this string had been produced by picking characters at random, how many guesses would an attacker need?

Fourteen characters from a 95-character set is about 95¹⁴ possibilities. That is an enormous number, and the estimate is correct — conditional on the premise.

The premise is the entire thing. The meter cannot see where the string came from. It sees the costume, not the person wearing it.

2. Why derivation can't create what wasn't there

Here is the rule, and it's not a matter of opinion or implementation quality:

A deterministic function cannot increase entropy. If you can reproduce the output from the input, then guessing the input gets you the output.

An attacker who knows you used a generator doesn't attack the fourteen-character output. He attacks the input and runs the same generator. If your input was one character, he tries every character. If it was your name and a birthday, he tries names and birthdays. The output's appearance is irrelevant — he never guesses at the output space at all.

Put plainly: the lock is only as strong as the smallest thing you'd have to remember to open it.

This is why "it looks random" is not evidence of anything. Hash functions are designed to make low-entropy inputs produce high-entropy-looking outputs. That's their job. Mistaking that property for actual security is the oldest unforced error in applied cryptography.

3. This isn't hypothetical — it has a body count

In Bitcoin's early years, "brainwallets" were popular: pick a memorable phrase, hash it, and that's your private key. No backup needed, nothing to store, just remember the sentence. Elegant.

Attackers built dictionaries. Song lyrics, Bible verses, famous quotes, movie lines, every phrase in every book they could scrape, with every obvious variation. They precomputed the resulting addresses and watched the chain. When money arrived at one, it left within seconds — sometimes within the same block.

People lost real money this way, at scale, for years. Not because the hashing was broken. The hashing worked perfectly. The input was guessable, and the output looked magnificent the whole time.

Every "memorable input, strong output" scheme is a rediscovery of this, and the rediscovery always comes with a strength meter screenshot attached.

4. The Bitcoin-specific trap

Here's what makes this worse for us than for your email password.

Normal passwords are defended by the service. Guess wrong ten times at a bank login and you're locked out, rate-limited, flagged, emailed. The attacker gets a handful of tries. A weak password often survives because somebody else is guarding the door.

A seed or passphrase has no door. Someone who obtains your backup tests candidates entirely offline — on their own hardware, in parallel, at millions of guesses per second, with nobody to notice and no limit. And unlike your email, there's a direct payout waiting if they succeed.

So a scheme with, say, 350 million possible inputs is fine for a forum login and a complete donation for a wallet. Same scheme. Different threat model. The number of guesses an attacker can afford differs by a factor of roughly a trillion.

5. Where real entropy comes from

It's boring, which is why people keep trying to invent alternatives.

Dice. Physical dice, rolled by you, recorded by you. Most wallets document a dice-entropy procedure. It's tedious and it's unimpeachable.

Your hardware wallet's generator. That's what the secure element is for. Generated on-device, never transmitted, shown once.

Your wallet software's RNG, on a device you trust that isn't connected to anything it doesn't need to be.

For a passphrase specifically: pick several words at random using dice or a generator, not from your head. Human-chosen "random" words are not random — we reach for the same ones, and attackers know which ones.

Then write it down. The reason people invent derivation schemes is to avoid storing something, and storing something is not actually the hard part. It just feels less clever.

6. The uncomfortable half

Having spent five sections on entropy, let me argue against my own emphasis.

Entropy is almost never why people lose coins. Go through the actual losses of the last decade: phishing sites, fake support calls, malicious downloads, compromised clipboards, exchanges collapsing, seeds photographed "temporarily", and above all nobody knowing the wallet existed after someone died. Brute force is far down the list. If you've got twelve words from a hardware wallet in a sensible place, your entropy is fine and it has been fine since the day you set it up.

So the real failure here isn't weak randomness — it's the mindset. The person who builds a clever derivation scheme is usually spending their security budget on the one threat they've already defeated, while the actual openings go unattended. I'd rather someone have a boring 12-word seed, a tested restore, and a letter for their family than a baroque system with a perfect entropy score and no documentation.

And a strength meter still has one honest use. For a password you typed out of your own head, for a website, it will correctly tell you that Summer2024! is garbage. That's a real service. The error is only in pointing it at something derived and believing the answer.

Finally, I'd rather you didn't take my word for it either. The reason the dice recommendation is safe isn't that I said so — it's that the procedure is published, auditable and attacked in public by people who'd love to find a flaw in it. A method whose details you can't inspect is asking you for trust, and in this field trust is the thing we're meant to be minimising.

Tuga's mouse under the sofa is the same mouse. A secret that looks complicated and a secret that is hard to guess are two different things, and only one of them keeps your coins. 🐾⚡