the lookup

How It Works

A wallet can check whether a recovery phrase matches a known weak seed without exposing the phrase or its entropy.

The published datasets are large, but each check only needs a small fraction of that data.

5.86 TB
published across two datasets
2–4 MB
downloaded per check

the mechanism

Lookup privacy

The lookup starts with the wallet deriving the entropy from the recovery phrase, hashing it, and using only a short prefix of the hash to fetch the matching bucket. It then compares the bucket contents locally to determine whether it's vulnerable.

WALLET REMOTE UNLUKEY DATASETS Recovery phrase (12 or 24 words) Entropy — 16 or 32 raw bytes key = SHA-256(entropy) 32-byte key prefix only 19–20 bits Fetch static file /{bits}/{prefix} whole bucket ~2–4 MB, thousands of keys Compare the rest of the key locally against every entry in the bucket VULNERABLE NOT FOUND The wallet determines locally whether the recovery phrase is vulnerable.

k-anonymity

Many keys, one bucket

Multiple hashes that share the same prefix are grouped into a single bucket. The wallet downloads that bucket and checks locally which entry, if any, matches.

Bucket contents

5280e c4a1f83e… 5280e 7e20b19a… 5280e 53bf2c04… 5280e 91c2d7a5… 5280e 0d3a6e18… 5280e f8619b4d… ~144,000 entries sharing this prefix Bucket /{bits}/5280e
shared prefix hash suffixes sharing that prefix

prefix length

The tradeoff

The number of bits in the prefix determines how many entries are grouped into each bucket.

A longer prefix creates more buckets with fewer entries in each one, reducing download size but also reducing the anonymity set. A shorter prefix does the opposite.

The control below shows this tradeoff using the 44,203,122,032 unique keys in the 256-bit Coldcard dataset.

prefix length 19 bits
141618202224
524,288
buckets
≈84,311
keys per bucket (anonymity set)
≈2.53 MB
avg. download per check
19 bits is what the 256-bit tree actually uses today

dataset statistics

Current Datasets

Dataset Unique keys Prefix Buckets Dataset size Per check
Ill Bloom128-bit entropy 151,001,028,608 20 bits 1,048,576 4.53 TB ≈4.32 MB
Coldcard256-bit entropy 44,203,122,032 19 bits 524,288 1.33 TB ≈2.53 MB
Total published 195,204,150,640 — — 5.86 TB —