# Is it safe to store mnemonic seed in the email if I change random 2 words?

If I store 12 word seed in the email like gmail and my phone as well but change 3rd and 7th words in the seed for example with other bip-39 words and remember it, would that be safe? I can't think of a way for someone to be able to efficiently brute-force it.

A 12 word BIP-39 mnemonic encodes 132 bits, 128 of encoded data and 4 checksum bits. Each word represents an 11-bit segment.

Let assume that an attacker knows that you changed two of the words. Let's also assume that you're not changing the final word and therefore that the checksum is still valid.

This means the attacker needs to enumerate all of combinations of selecting two word positions from 1 up to 11 and then all the possibilities for a word in each of those positions. This is:

$${11 \choose 2} \cdot 2^{11} \cdot 2^{11} = 230,686,720$$

They will need to compute this many SHA-256 hashes to verify checksums for each, though only about $$1/2^4$$ (6.25%) will have matching checksums. Leaving them with roughly 14,417,920 candidates for the encoded data.

Any attacker should be able to calculate those candidates with fairly little time and memory:

$$\frac{14,417,920\text{ candidates}\cdot 128\text{ bits}}{8\text{ bits/byte}\cdot\ 2^{20}\text{ bytes/MB}} = 220\text{ MB}$$

Even if we assume that the attacker would take a full second per candidate to verify whether it maps to something they care about (e.g. determining if it is used in a given system), they would still be able to go through this full list in 167 days ($$14,417,920/60/60/24$$) and we should expect that on average they would find your original value in half that time. In the case where the encoded data is a private key that is used in a cryptocurrency, they would likely be able to perform these checks considerably faster than that.

If we increase the number of words you're modifying to some number, $$k$$, this turns into:

$${11 \choose k} \cdot (2^{11})^k \le 462 \cdot (2^{11})^k \lt 2^9 \cdot (2^{11})^k = 2^{11k + 9}$$

So in order to get the equivalent of even 96 bits of security, you would need to modify up to:

$$11k+9 = 96$$ $$k \approx 7.9 \rightarrow 8\text{ words}$$

You'll need a better method to protect your key.