Can a 12-word recovery phrase be guessed?
Not in practice. The app draws 12 words at random from a fixed list of 2,048, and the last word also works as a typo check. The number of possible phrases is far too large to try them all. The Recovery PIN is far weaker, which is why it is optional and labelled.
Why
Because the words are picked at random from the list, guessing them is not realistic. The risk is not the maths but people: a phrase that is written somewhere findable, photographed, or chosen by a person instead of the app, is not random any more. StrongRoom picks the words for you.
On the phone, every well-formed try at a Recovery Phrase counts in the Throttle, which makes later tries wait longer. An Export Package file has no Throttle: anyone holding a copy can try on their own computer. That is why the phrase has to be random, and why you should treat the file and the paper as two halves of one secret.
What to do
- Use the words the app gives you; do not swap them for words you prefer.
- Keep the paper away from the Export Package.
- Prefer the Recovery Phrase over the Recovery PIN, unless you know you would not write twelve words down.
- If you think someone saw the phrase, choose a new one in the Vault's settings.
What this does not cover
It does not cover the Recovery PIN, which is 6 to 12 digits and can be guessed far more easily, or a weak pattern or passphrase. Read the limits.
Frequently asked questions
Is the Recovery PIN as strong?
No. It is shorter, so it is easier to guess. It works only on the phone where it was set and only from Forgot.
Can the 12th word be worked out from the first 11?
Only partly: the last word holds a checksum, so a few of its options are ruled out, which does not make the phrase practical to guess.
Sources
No platform facts are stated on this page.