iancoleman / bip39

A web tool for converting BIP39 mnemonic codes
https://iancoleman.io/bip39/
MIT License
3.41k stars 1.42k forks source link

"Time To Crack" is misleading #599

Open crwatkins opened 2 years ago

crwatkins commented 2 years ago

I noticed that 48 bits of entropy entered from Hex displays a Time To Crack of "less than a second" while 46 bits of dice throws displays "centuries". That doesn't make any sense (in a number of ways). A quick look at the code suggests that zxcvbn (which I'm a big fan of) is used to generate the Time to Crack. I believe the problem here is that zxcvbn is a password strength estimator, and not a generic entropy strength estimator. I believe a more accurate Time to Crack might be generated from the tool's entropy estimation.