Start with A Passphrase You Can Remember :
Generate a 24 word BIP39 Key from your Passphrase +(optional SALT)
Start with BIP39 Key :
Generate a 25 word Monero Key from your BIP39 Key +(optional SALT)
Open Source JavaScript Client-Side Bitcoin/Monero Wallet Seed Generator from Passphrase
Draft Mar 15 2025 for memorywallet.html
v1.0.0.6
People say "You can take your coins with you, all you need is to remember the words".
It's not so easy to remember 12, 15, 16, 24, or 25 words!
The memorywallet.html page takes the passphrase you CAN remember then:
Uses the passphrase concatenated with optional salt as input to Scrypt
Iterate Scrypt (Default 262144) to produce a 256 bit result
Use the 256 bit result from Scrypt concatenated with optional Salt as inputs toPBKDF2
Iterate PBKDF2 (Default 65000)
Takes the 256bit private key output from scrypt and pbkdf2 and creates a 24 word BIP39 key suitable for a bitcoin or other wallet
Uses the 256 bit private key concatenated with Salt to create a Monero private key
Uses normalized Monero private key to create a 25 word Monero mnemonic
The memorywallet.html page can take the BIP39 mnemonic and:
Converts the BIP39 Mnemonic to a 256 bit private key.
Uses the 256 bit private key concatenated with Salt to create a Monero private key
Use normalized Monero private key to create a 25 word Monero mnemonic
Creating a memorable passphrase involves combining several words to form a unique and secure phrase. Here are some tips to help you create a strong and memorable passphrase:
Use Multiple Random Words: Combine four or five random words that don’t make sense together. For example, “correct horse battery staple” is a strong passphrase because it is random and long.
Incorporate Numbers and Special Characters: To enhance security, include numbers and special characters in your passphrase. You can replace certain letters with numbers or special characters, such as ‘i’ with ‘!’, or add them randomly throughout the phrase.
Avoid Common Phrases and Personal Information: Do not use common phrases, song lyrics, or personal information like birthdays or pet names, as these can be guessed more easily.
Use a Passphrase Generator: Tools like the Memorable Password Generator or 1Password’s Strong Password Generator can help you create a secure and memorable passphrase. These tools often use word lists and randomization to ensure the passphrase is strong.
Create a Sentence: Form a sentence that is easy for you to remember and use the first letter of each word in the sentence, including punctuation marks and special characters.
Avoid Reusing Passphrases: Use a unique passphrase for each service to prevent a breach in one account from compromising others.
Use a Password Manager: A password manager can help you generate, store, and autofill unique passphrases for different accounts, making it easier to manage multiple strong passphrases.
By following these guidelines, you can create a passphrase that is both secure and easy to remember.
When choosing a passphrase, there are several key cautions and best practices you should consider to enhance security while ensuring usability:
Avoid Common Phrases:
Caution: Using well-known quotes, lyrics, or common sayings can make your passphrase vulnerable to dictionary attacks.
Best Practice: Create something unique. For instance, instead of "To be or not to be," you could use "2BOrNot2B@Shakespeare."
Length vs. Complexity:
Caution: While longer passphrases are generally better, some might think adding complexity (like special characters in every word) makes it secure but can decrease memorability.
Best Practice: Opt for length over complexity if it helps with memorability. A phrase like "MyFirstCarWasABlueFord!" is long, has some complexity, but is memorable.
Personal Information:
Caution: Never use easily guessable personal information like birthdays, names of family members, or addresses.
Best Practice: If you want to use personal information, disguise it significantly. E.g., "MyDogSpotIs10YrsOld" could be "D0gSp0tAged1D3c@d3".
Predictability:
Caution: Regular patterns or transformations (like capitalizing the first letter of each word) can be predicted by attackers.
Best Practice: Mix up your capitalization, numbers, and symbols unpredictably. For example, "tHeSunSh1nEs@Noon" rather than "TheSunShinesAtNoon".
Storage and Sharing:
Caution: Writing down passphrases or storing them insecurely (like in a plain text document) can compromise security.
Best Practice: Use a password manager for storing complex passphrases. If you must write it down, keep it in a safe, physical location, not directly associated with the device or service it protects.
Reuse:
Caution: Using the same passphrase across multiple accounts is highly risky.
Best Practice: Generate unique passphrases for each service or use a password manager to handle this for you.
Phishing and Social Engineering:
Caution: No matter how secure your passphrase, it's worthless if you're tricked into giving it away.
Best Practice: Be vigilant about where you enter your passphrase. Always double-check website URLs and be skeptical of unsolicited requests for credentials.
System Limitations:
Caution: Some systems might not accept very long passphrases or might have limitations on characters.
Best Practice: Before setting a passphrase, check the system's requirements; if it's too restrictive, consider if the security of your data is adequately protected elsewhere.
Entropy and Unpredictability:
Caution: Simplified methods like using a single sentence might not provide enough entropy for high-security contexts.
Best Practice: Increase entropy by adding randomness, like inserting special characters or numbers in unexpected places or using words from multiple languages or fictional universes.
By keeping these cautions in mind, you can craft a passphrase that balances security, memorability, and usability, protecting your digital identity more effectively.
The PBKDF2 (wikipedia link:PBKDF2) (Password-Based Key Derivation Function 2) is a key derivation function that has as input a passphrase concatenated with optional salt. The output in memorywallet is a 32 byte private key. The process to create the output is computationally intense. The memory wallet default number of iterations is 65000. Expert Options: Short: 65536 Warp: 65536 Offline Hardened 256000
The Scrypt (wikipedia link:Scrypt password-base key derivation function (pbkdf) is an algorithm that makes it costly to perform large-scale custom hardware attacks by requiring large amounts of memory. and converts a human readable passphrase into a fixed length arrays of bytes which can then be used as a private key. In the memorywallet the optional salt is concatenated with the original passphrase and the 32 byte output is passed to PBKDF2 as a passphrase. The memory wallet default number of Scrypt iterations is 262144. Expert Scrypt Options: Short: 65536 Warp: 262144 Offline Hardened 2097152 (csn fail on systems with insufficient memory)