A reader wrote in via nostr: There are 12 and 24 word seed phrases with reoccurring words. Bacon repeated 24 times is probably the most famous. Do you have a list of other words that reoccur 12 or 24 times?Indeed, I stumbled across the “bacon” seed phrase back in 2018 though I haven’t looked for others, so this is a neat question! The most appetizing valid BIP39 Bitcoin wallet mnemonic, converted to emoji: 🥓 🥓 🥓 🥓 🥓 🥓 🥓 🥓 🥓 🥓 🥓 🥓 🥓 🥓 🥓 🥓 🥓 🥓 🥓 🥓 🥓 🥓 🥓 🥓 — Jameson Lopp (@lopp) April 2, 2018 (https://twitter.com/lopp/status/980930223335145479?ref_src=twsrc%5Etfw&ref=blog.lopp.net)

I wrote this script (https://github.com/jlopp/bitcoin-utils/blob/master/generateAllRepetitiveSeedPhrases.js?ref=blog.lopp.net) to iterate through every word in the BIP39 word list and check to see if a 12 or 24 word seed phrase with only that word repeated would be valid. To be clear, the BIP39 specification allows for generation of seed phrases that consist of 3 / 6 / 9 / 12 / 15 / 18 / 21 / 24 words, but for brevity I’ll stick to the most commonly used 12 and 24 word lengths. It turns out there are 130 valid seed phrases that are the same word repeated 12 times: action x12 agent x12 aim x12 all x12 ankle x12 announce x12 audit x12 awesome x12 beef x12 believe x12 blue x12 border x12 brand x12 breeze x12 bus x12 business x12 cannon x12 canyon x12 carry x12 cave x12 century x12 cereal x12 chronic x12 coast x12 convince x12 cute x12 dawn x12 dilemma x12 divorce x12 dry x12 elevator x12 else x12 embrace x12 enroll x12 escape x12 evolve x12 exclude x12 excuse x12 exercise x12 expire x12 fetch x12 fever x12 forward x12 fury x12 garment x12 gauge x12 gym x12 half x12 harsh x12 hole x12 hybrid x12 illegal x12 include x12 index x12 into x12 invest x12 involve x12 jeans x12 kick x12 kite x12 later x12 layer x12 legend x12 life x12 lyrics x12 margin x12 melody x12 mom x12 more x12 morning x12 nation x12 neck x12 neglect x12 never x12 noble x12 novel x12 obvious x12 ocean x12 oil x12 orphan x12 oxygen x12 pause x12 peasant x12 permit x12 piano x12 proof x12 pumpkin x12 question x12 real x12 report x12 rough x12 rude x12 salad x12 scale x12 screen x12 sea x12 seat x12 sell x12 seminar x12 seven x12 sheriff x12 siege x12 silver x12 soldier x12 spell x12 split x12 spray x12 stadium x12 sugar x12 sunny x12 sure x12 tobacco x12 tongue x12 track x12 tree x12 trouble x12 twelve x12 twice x12 type x12 uniform x12 useless x12 valid x12 very x12 vibrant x12 virtual x12 vocal x12 warrior x12 word x12 world x12 yellow x12However, there are only 11 valid seed phrases that are the same word repeated 24 times! bacon x24 flag x24 gas x24 great x24 slice x24 solution x24 summer x24 they x24 trade x24 trap x24 zebra x24Security WarningIn case it’s not obvious, it would be a very bad idea to actually use any of the above seed phrases. In fact, I checked and several of them have been previously used! But of course, they’re all empty - I’d be willing to bet that if you deposited any money into the above phrases at a standard derivation path, the funds would get swept within a minute or so. This is because there are folks out there running scripts that have generated billions of common seed phrases and brain wallets, just waiting for any unsuspecting person to deposit money into them. Why the Discrepancy in Repetitive Counts?The difference in the number of valid repeated 12-word and 24-word Bitcoin BIP39 mnemonics stems from the structure and requirements of the BIP39 standard, which involves a combination of entropy, checksum, and the mnemonic’s word count. Entropy and Checksum:

• 12-word mnemonic: Uses 128 bits of entropy and includes 4 bits of checksum. This results in 132 bits total, which are represented by 12 words. • 24-word mnemonic: Uses 256 bits of entropy and includes 8 bits of checksum. This results in 264 bits total, represented by 24 words. • For a mnemonic to be valid, its checksum must match the calculated checksum derived from the entropy. This means that only specific combinations of words will form a valid mnemonic. But there’s always more than one valid checksum!

Why More Valid 12-Word Repeated Mnemonics Exist:In a 12-word mnemonic, a smaller proportion of the mnemonic is devoted to the checksum (4 bits out of 132) compared to a 24-word mnemonic (8 bits out of 264). This means there are relatively more possible entropy configurations that could collide with a valid checksum for a given word when repeated. Probability of Valid Checksum:

• 12-word repeats: With fewer bits in the checksum, the likelihood of randomly hitting a valid checksum is higher. More concretely: each 11 word partial seed phrase has 128 possible valid 12th words. As such, the probability that a given word, if repeated 11 times, will have a matching checksum is 6.25%. • 24-word repeats: With more bits in the checksum, the precision required to match the correct checksum is higher. Therefore, the probability of a valid checksum occurring with a repeated word in all 24 positions is lower. More concretely: each 23 word partial seed phrase has 8 possible valid 24 words. As such, the probability that a given word, if repeated 23 times, will have a matching checksum is 0.39%.

A Practical Demonstration: Let’s say we have a partial seed phrase of “proof” repeated 11 times and we want to determine all valid checksums. Any of these 128 words will be valid as the 12th word. absurd addict afford always antique armed arrive atom awful barrel betray blame bomb bounce bronze buzz canyon car certain chat choose climb coin come coyote crop cupboard dance decide depend detail disease divorce drum earth egg else enlist equip exercise expand family festival finish flip focus frost future gentle glad goddess gravity hawk hint honey humor impose index interest jazz jump kind labor lecture letter live lunch man master message miss modify mountain need nerve number object omit order panther peace pelican pipe play pottery price proof pyramid quote raven reject render rib riot round sample scale seek shallow ship six skill slow soul special sport stay subject success surround tail team thing tilt tool traffic truck twelve unaware update vanish verify village wagon wear wild winter zooOn the other hand, if we have a partial seed phrase of “bacon” repeated 23 times and we want to determine all valid checksums, the possible valid 24th word could only be one of the following: bacon cupboard double jelly neutral review smile voiceConclusionBecause of the proportional differences in entropy and checksum between 12-word and 24-word mnemonics, there are statistically more valid configurations of the entropy for repeated 12-word phrases compared to 24-word phrases. This difference leads to a far higher number of valid repeated 12-word mnemonics than 24-word ones.