<p>After reading the <a href="https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki" rel="nofollow noreferrer">bip39 specification</a>, I learned that a 12 word mnemonic phrase was generated using an entropy of 128 bits, if I want to use a 24 word passphrase, there shall be no way to generate it from a 12 word list the entropy for a 24 word mnemonic phrase uses a 256 bit entropy + 8 bits of checksum which finally generates a 256 + 8 = 264 bits of random bits that can be split on 24 words of 11 bits, thus using the 2048 (2^11) words in the bip39 word list.</p>
<p>I wonder if I can use a key stretching algorithm like <code>PBKDF2+HMAC-SHA512</code> algorithms, to produce a 256-bit (or it's first 256 bits) values as its final output in order to generate the 24 words mnemonic phrase I want, from only a list of 12 words, but I am not sure about how secure this is (well, of course is less secure because I cut the search space in half).</p>
<p>For now, I think the most secure way to obtain a 24 words mnemonic passphrase is to just create a new wallet on yoroi and just manage 2 mnemonic phrases, one with 12 words for btc and other altcoins (via trezor wallet and exodus), and a 24 word mnemonic phrase for cardano using yoroi :c</p>
<p>I leave this answer for any future reader, please let me know if I am wrong, please have a good day.</p>

CC BY-SA 4.0
2021-06-01T11:23:14.230Z
2021-06-01T11:30:05.443Z
2021-06-01T11:30:05.443Z
Joe Cabezas
<p>Yoroi dev here.</p>
<p>Yoroi uses 15 words because we think it's the best trade-off between security and convenience. Using more words may provide marginal security benefits, but you also have downsides like more difficulty if you want to memorise your mnemonics, more risk of writing down the wrong word or in the wrong order during backups, more inconvenience using offline metal backup devices (because you need to backup more words) and so on.</p>
<p>We also allow to recover 24-word mnemonics so that Daedalus users can use Yoroi if they want to. But allowing for more options compromises usability/UX. It's not a technical choice.</p>
<p>I don't see why you could not &quot;stretch&quot; a 12-word recovery phrase to obtain 15 words. You just need to make sure that the checksum is valid.</p>
<p>Finally, and more importantly, I am not sure that trying to use the same recovery phrase to manage multiple wallets is a good practice (hardware wallets are an exception of course). But ultimately, it's your choice.</p>

CC BY-SA 4.0
2021-06-02T04:06:29.840Z
thank you very much for answering, now I understand 15 words is just a choice and 12 words is not a technical limitation.
Regarding the stretching is less secure because it reduces the search space for brute force if the attacker knows it was a key generated by stretching 12 words, defeating the purpose of using more, but I envision one way to stretch it is to just add more bits from the checksum (37 bits) then it will make 128+37=165 or 15 11bit words.
Joe Cabezas
CC BY-SA 4.0
2021-06-02T04:06:32.500Z
Finally, using the same recovery phrase for multiple wallets shall not be a problem as long the wallet phrase is secured like in a hardware wallet, also that's the idea of HD wallets, to serve multiple coins, and therefore multiple wallets if a coin is not listed in a wallet of choice, I think®
Joe Cabezas
CC BY-SA 4.0
2021-06-02T06:01:35.100Z
Yes, agree, but it depends on how you manage it.  If you are constantly restoring mnemonic wallets in multiple devices, then it's an issue. Or if some apps, for some reason, are storing your root key, then there is a risk that all your wallets get exposed.
vaz
CC BY-SA 4.0
2021-06-02T07:33:39.380Z
thanks for your insights, the best option here is just to create a new wallet with 15 or 24 words and make a metal backup of it also, this is why I am accepting this as the answer, please have a good day
Joe Cabezas
CC BY-SA 4.0
2021-06-01T12:50:32.917Z
2021-06-01T12:50:32.917Z
vaz
<p>Currently I have a 12 words passphrase that I use over some wallets like <code>exodus</code> and <code>metamask</code>, I want to use the same 12 words on <code>yoroi</code> but <code>yoroi</code> only allows me to use 15 or 24 words.</p>
<ul>
<li>I was under the impression that <code>yoroi</code> uses <code>bip39</code> standard, why I can't create a wallet with only 12 words?</li>
<li>What is the technical limitation that prevents yoroi to use 12?</li>
<li>Is there an existing way (without coding it myself) to transform my 12 words into 15?, or 24?, assuming that 12 word passphrases are just 12*11=132 bits of entropy (128 bit entropy + 4 bit checksum) <a href="https://github.com/bitcoinbook/bitcoinbook/blob/develop/images/mbc2_0506.png" rel="noreferrer">[reference here]</a></li>
</ul>
<p>I want to avoid creating a new wallet entirely and now having to backup 12+24=36 words for reasons out of this scope.</p>
<p>(like for example I already etched the 12 words in metal using carbon atoms and I don't want to do it again because is expensive).</p>

<yoroi><bip39>
is it possible to use (bip39) 12 words passphrase in yoroi?
# is it possible to use (bip39) 12 words passphrase in yoroi?

(Asked by: username_0 on 2021-06-01)

Currently I have a 12 words passphrase that I use over some wallets like `exodus` and `metamask`, I want to use the same 12 words on `yoroi` but `yoroi` only allows me to use 15 or 24 words.

* I was under the impression that `yoroi` uses `bip39` standard, why I can't create a wallet with only 12 words?
* What is the technical limitation that prevents yoroi to use 12?
* Is there an existing way (without coding it myself) to transform my 12 words into 15?, or 24?, assuming that 12 word passphrases are just 12\*11=132 bits of entropy (128 bit entropy + 4 bit checksum) [[reference here]](https://github.com/bitcoinbook/bitcoinbook/blob/develop/images/mbc2_0506.png)

I want to avoid creating a new wallet entirely and now having to backup 12+24=36 words for reasons out of this scope.

(like for example I already etched the 12 words in metal using carbon atoms and I don't want to do it again because is expensive).

**Tags:** yoroi, bip39

---

## 2 answers

### Answer by username_1 on 2021-06-01. Score: 3 | Accepted answer

Yoroi dev here.

Yoroi uses 15 words because we think it's the best trade-off between security and convenience. Using more words may provide marginal security benefits, but you also have downsides like more difficulty if you want to memorise your mnemonics, more risk of writing down the wrong word or in the wrong order during backups, more inconvenience using offline metal backup devices (because you need to backup more words) and so on.

We also allow to recover 24-word mnemonics so that Daedalus users can use Yoroi if they want to. But allowing for more options compromises usability/UX. It's not a technical choice.

I don't see why you could not "stretch" a 12-word recovery phrase to obtain 15 words. You just need to make sure that the checksum is valid.

Finally, and more importantly, I am not sure that trying to use the same recovery phrase to manage multiple wallets is a good practice (hardware wallets are an exception of course). But ultimately, it's your choice.

> **Comments:**
> **username_0**: thank you very much for answering, now I understand 15 words is just a choice and 12 words is not a technical limitation. Regarding the stretching is less secure because it reduces the search space for brute force if the attacker knows it was a key generated by stretching 12 words, defeating the purpose of using more, but I envision one way to stretch it is to just add more bits from the checksum (37 bits) then it will make 128+37=165 or 15 11bit words.  
> **username_0**: Finally, using the same recovery phrase for multiple wallets shall not be a problem as long the wallet phrase is secured like in a hardware wallet, also that's the idea of HD wallets, to serve multiple coins, and therefore multiple wallets if a coin is not listed in a wallet of choice, I think®  
> **username_1**: Yes, agree, but it depends on how you manage it.  If you are constantly restoring mnemonic wallets in multiple devices, then it's an issue. Or if some apps, for some reason, are storing your root key, then there is a risk that all your wallets get exposed.  
> **username_0**: thanks for your insights, the best option here is just to create a new wallet with 15 or 24 words and make a metal backup of it also, this is why I am accepting this as the answer, please have a good day  

---

### Answer by username_0 on 2021-06-01. Score: 0

After reading the [bip39 specification](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki), I learned that a 12 word mnemonic phrase was generated using an entropy of 128 bits, if I want to use a 24 word passphrase, there shall be no way to generate it from a 12 word list the entropy for a 24 word mnemonic phrase uses a 256 bit entropy + 8 bits of checksum which finally generates a 256 + 8 = 264 bits of random bits that can be split on 24 words of 11 bits, thus using the 2048 (2^11) words in the bip39 word list.

I wonder if I can use a key stretching algorithm like `PBKDF2+HMAC-SHA512` algorithms, to produce a 256-bit (or it's first 256 bits) values as its final output in order to generate the 24 words mnemonic phrase I want, from only a list of 12 words, but I am not sure about how secure this is (well, of course is less secure because I cut the search space in half).

For now, I think the most secure way to obtain a 24 words mnemonic passphrase is to just create a new wallet on yoroi and just manage 2 mnemonic phrases, one with 12 words for btc and other altcoins (via trezor wallet and exodus), and a 24 word mnemonic phrase for cardano using yoroi :c

I leave this answer for any future reader, please let me know if I am wrong, please have a good day.


---

