Entropy Bit

A fair coin gives both sides an equal chance. One secret toss has two possibilities; two independent tosses have four; four tosses have sixteen. Each further independent toss doubles the number of possible sequences and adds one bit of entropy. This is the relationship described by H = log2(N): for N equally likely possibilities, it gives the number of bits. With 16 possibilities, that is 4 bits. Equal probability is an important condition, as we will see below. [1] [2]

Now, instead of tossing again, take a single result and write it down 256 times. The string will be 256 bits long, but there are still only two possibilities: all zeros or all ones. The actual secret still has just 1 bit of entropy. Repetition created no new independent choices. The same problem can appear less obviously when measurements are related. You therefore cannot simply multiply an entropy estimate for one sample by the sample count without checking independence. [1]

You can write the same value using ordinary digits, words or hexadecimal notation. Hexadecimal uses digits and the letters A to F; it is simply another way of writing a number, not a new secret. A hash, a fingerprint calculated from data by a particular function, does not itself add unknown possibilities either. If it comes from a small range of possible inputs, an attacker can try those inputs and compare their fingerprints. Knowing the exact input lets them calculate the same result. What matters most is how the secret value was created, not how complicated it looks. [1] [2]

In BIP39, 12 words encode 128 input bits and 4 checksum bits, making 132 bits in total. With 24 words, it is 256 plus 8, or 264 bits. The checksum bits are calculated; they are not additional independent secret choices. The 128 or 256 bits also assume a good method of creating the input. If you choose words yourself based on a favourite story, the word count does not guarantee that entropy. [3]

Imagine 128 independent secret bits, each produced like a fair coin toss. If you reveal 32 specific bits, 96 remain unknown in this model. This is not a general rule for every leak: it depends on the information disclosed and the relationships between values. A seed is the secret starting value from which a wallet derives its keys. Someone who knows the entire seed does not need to guess it. Their uncertainty is zero, even if the seed was originally generated perfectly. [1] [2]

So far, all outcomes have been equally likely. With a biased source, an attacker will probably try the most common result first. Min-entropy measures the advantage of that first guess: Hmin = -log2(pmax), where pmax is the probability of the most common outcome. If it is 3/4, the result is about 0.415 bits. Shannon entropy also exists and describes average information content. It is a different measure, and neither is the exact average number of guesses needed to crack a secret. [1] [2]

An attacker need not just guess the original input; they may try to exploit the algorithm’s mathematical properties. Bits of entropy, key length and security strength are therefore different concepts. In elliptic-curve cryptography (ECC), security depends on the difficulty of a particular mathematical problem. For example, NIST SP 800-57 assigns ECC key sizes from 256 to 383 bits a security strength of 128 bits in its classical comparison. This is not an assessment of a particular wallet, nor a claim that every 256-bit key offers 256-bit security. [4]

Ask which entropy measure is being used, what source the estimate comes from and what an attacker might know. NIST SP 800-90B assesses a source and its samples, including dependencies and behaviour after restarts. A measurement from one file is not a guarantee for every device and all future conditions. Min-entropy alone does not give an exact attack time either. A number is useful when we understand its assumptions. [1]