# Trying to calculate the strength of a Bitcoin brain wallet created with a custom diceware password

I want to create a brain wallet using a custom diceware since I don't like the original one. Instead of 7776 words it has 46656 because I use 6 dice for each word instead of 5, and also it only has words with many characters.

So this is what I got so far, please tell me if I made a mistake:

$$\frac{2 ^ {\log_2(46656) · 5} }{ (1 · 10^{15}) · (60 · 60 · 24 · 365)} = 7 \text{ years}$$

• $2 ^ {\log_2(46656) · 5}$ is the entropy for a password of 5 words
• $1 · 10^{15}$ is 1 Phash/s, which is the hashing power I'm assuming for this attacker. I don't even know if this makes sense, because an attacker doesn't need to start over for each brain wallet he wants to crack, and also there might have been huge databases of precomputed sha256 hashes before Bitcoin even existed.
• $60 · 60 · 24 · 365$ represents a year in seconds.
• You calculated the attackers worst case duration ... average case is half of this. Mar 15 '14 at 20:50
• Also: the entropy is the base-2 log of the number of (assumed equiprobable) passwords, thus $\log_2(46656)\cdot5$, not $2^{\log_2(46656)\cdot5}$. You do not account for key stretching, which can help a lot in many contexts, perhaps this one. Using long words has no discernible advantage, if they are public, which the computation assumes.
– fgrieu
Feb 28 '16 at 20:50

You also mentioned precomputed hashes. For an attacker to precompute all of the given hashes (assuming 32 bytes per SHA256 hash), they would need to store $46656^5 * 32 \approx 7.07 * 10 ^ {24}$ bytes, amounting to 7.07 yottabytes. This is currently an unpractical amount of storage.