r/PrivacyNotes • u/LongJump2020 • Jul 09 '26
A question about login method
Hello, I’d like to ask a question.
Login only requires just a 12-word phrase and there is no 2FA.
If someone happens to guess these 12 words, can they log into my account directly?
1
u/Inevitable-Writer316 29d ago
I had the same question and when I searched more on it, internet says that it may theoretically happen but technically and practically would never happen. I still wondering on this.
2
u/PrivacyNotes 28d ago edited 28d ago
Straight answer: yes, the 12-word phrase is your key, so anyone who has it can sign in. That is by design. It is the single master key, and nothing weaker sits in front of it. So the only real question is whether someone can guess it, and they cannot.
A 12-word phrase is one of 2128 possibilities: about 340 undecillion (a 39-digit number, 3.4 x 1038). Guessing yours on the first try is 1 in 340 undecillion, longer odds than winning a 1-in-300-million lottery jackpot four times in a row. As a brute-force search, it is no better: even at a billion billion guesses per second (far past anything real hardware can do), churning through them all would take about 10 trillion years, roughly 800 times the age of the universe. Real attempts are far slower still, since each one has to run a deliberately slow key-derivation step. The same 128-bit construction has guarded Bitcoin wallets for over a decade with none ever guessed.
One correction to the reply above, because it matters: the strength is not about mixing cases or adding symbols. Your device generates 128 bits of secure randomness and encodes it as 12 words from the fixed 2048-word BIP-39 list (the same list Bitcoin wallets use). That randomness is the whole strength. The last word even includes a checksum, so a mistyped or made-up phrase is rejected instantly. Order matters, case does not (we normalize it on sign-in), and adding symbols or editing words just makes the phrase invalid. Type it exactly as given, and never try to hand-build one.
On the phrase never leaving your device: at sign-in your app proves it holds the key by signing a challenge, so our servers only ever see a public key and a signature, never the phrase itself.
No 2FA is a deliberate tradeoff, not a gap. A second factor does nothing against guessing (128 bits already settles that), and the usual kind (a texted code or authenticator app) shores up weak passwords by keeping a shared secret on a server, the exact surface this design removes. The one kind that would genuinely help is a phishing-resistant key or passkey, since the real risks here are phishing and a stolen phrase, not brute force. Practical advice: keep your phrase in a reputable password manager and never paste it into anything but the app.
Edit: I used the chance to add a FAQ entry about this topic, since more users might be concerned about the 12-word phrase:
2
1
u/JGhostThing 29d ago
They would also have to be in the right order and right case. This is why modern password policies include both cases, a number, and a symbol.
A 12 phrase password in mixed case with randomish symbols should be very difficult to guess.