Are Seed Phrases Safe from Quantum Computers?
The short answer, why breaking your coins doesn’t require cracking the phrase, and what to do to keep safe.
Seed phrases encode randomness · Grover speeds up exhaustive search · exposed elliptic-curve keys face a separate attack.
If you’re worried about whether a quantum computer will one day crack your 12 or 24 words that keep your crypto assets safe, you should know this: breaking an exposed signing key doesn’t require breaking the seed phrase, and they’re attacked in different ways.
This guide gives the direct answer, explains the mnemonic-to-key pipeline, shows what is exposed, and lists what to do (and what to skip) to keep your crypto safely in your own proverbial hands.
To learn what a full post-quantum migration changes for self-custody, the companion piece is Seed Phrases vs PQC.
In short
A securely generated seed phrase isn’t directly broken by Shor’s algorithm. Quantum search could, in theory, accelerate the guesswork, but no practical quantum attack against a properly generated BIP-39 mnemonic has been demonstrated (at least not yet).
The more direct concern for many existing wallets is recovery of an elliptic-curve signing key from an exposed public key. So the question “will a quantum computer break my seed phrase” that’s been plaguing your mind is less relevant than whether your public key has already been exposed, and those are separate questions with separate answers.
The mnemonic-to-key pipeline
For BIP-39 wallets, a 12-word mnemonic encodes 128 bits of initial entropy plus a checksum, and 24 words encode 256 bits plus a checksum. BIP-39 converts the mnemonic into a 512-bit seed using PBKDF2-HMAC-SHA512 with 2,048 iterations and an optional passphrase. The longer output doesn’t increase the original randomness, and BIP-39 is one mnemonic format among several (Electrum, for instance, uses its own).
Wallets then derive keys with a separate construction. Bitcoin’s BIP-32 uses HMAC-SHA512 together with secp256k1 elliptic-curve operations. The point to hold is that the mnemonic format and the derivation scheme are separate components, so keeping a familiar backup format doesn’t by itself make the derivation quantum-resistant. The elliptic-curve exposure is separate from the security of the mnemonic itself.
Entropy vs quantum: the two attacks
Which attack touches what Grover’s algorithm speeds up exhaustive search. For a uniformly random n-bit secret with a suitable candidate-checking procedure, it gives an idealized search cost on the order of 2^(n/2) queries, around 2^64 for 128 bits and 2^128 for 256 bits. Each query needs a quantum implementation of the checking procedure, so these aren’t complete resource estimates or practical timelines.
Shor’s algorithm acts on the elliptic-curve public key, not on the mnemonic. Given a sufficiently capable quantum computer, Shor’s algorithm could recover the corresponding signing secret from an exposed elliptic-curve public key without recovering your words.
For a securely generated, undisclosed mnemonic, generic guessing remains a search problem, and Grover offers a square-root reduction in query complexity. Exposed elliptic-curve public keys face a different attack: Shor can recover a signing secret without searching the mnemonic space. Theft, partial disclosure, or weak generation can undermine the mnemonic’s security independently.
What’s at risk
Many current wallets derive elliptic-curve signing keys from their seed. Bitcoin uses ECDSA and Schnorr signatures; other chains use schemes such as Ed25519. Disclosure depends on the account or output type: Bitcoin P2PK and Taproot expose public keys from the outset, whereas fresh P2PKH and P2WPKH outputs can keep them hidden until spending, under the condition that the same key hasn’t been disclosed elsewhere. A sufficiently capable quantum computer running Shor’s algorithm could attack an exposed elliptic-curve key without recovering the mnemonic.
You can check whether an address has already exposed its public key, and which Bitcoin addresses are vulnerable breaks it down by type.
How to harden, and what to skip
- A longer mnemonic does not fix vulnerable signatures: A securely generated 24-word phrase carries more entropy than a 12-word phrase, but neither prevents Shor’s algorithm from attacking an exposed elliptic-curve public key. Changing your mnemonic alone doesn’t provide post-quantum spending protection.
- Do the address hygiene instead: On Bitcoin, use a fresh receive address each time, avoid reuse, and keep long-term coins in an unused hash-committed output; other chains expose keys differently, so follow your chain’s guidance. The routine is in how to protect your crypto from quantum computers and hot wallets vs cold wallets.
- Protect the backup the ordinary way: A leaked seed phrase is a theft risk today, with no quantum computer required, so secure storage, tested backups, and no cloud photos still do the heavy lifting.
- Limit disclosure of extended public keys: A BIP-32 xpub reveals a public key and chain code and allows non-hardened public derivation. A future quantum compromise of that public key could expose the corresponding private-key subtree, even where individual receiving addresses have never spent.
- Follow your chain’s migration rather than pre-empting it: Post-quantum wallets can retain a mnemonic backup format: Project Eleven describes one implementation that derives post-quantum keys from a 24-word BIP-39 phrase. Whether an existing wallet can safely reuse its mnemonic depends on the derivation scheme adopted and any exposed ancestor keys, so follow the migration procedure your wallet and network support. Seed Phrases vs PQC covers that transition in detail.
Bottom line
Shor’s algorithm doesn’t directly break a securely generated seed phrase, and a longer phrase doesn’t repair a vulnerable signing key. Store the backup the ordinary way, practice address hygiene where your chain allows it so public keys stay hidden until you spend, and follow your chain’s migration. The highest exposure is in the signature, which is also where the fix will come from.
Sources
- BIP-39, mnemonic code for generating deterministic keys: github.com/bitcoin/bips
- BIP-32, hierarchical deterministic wallets (secp256k1 derivation): github.com/bitcoin/bips
- NIST Post-Quantum Cryptography project: csrc.nist.gov
- Project Eleven, generating post-quantum keypairs from a BIP-39 seed phrase (one implementation, not a standard): blog.projecteleven.com
Keep going
New to the threat? Start with What Is Q-Day?
Continue the series:
- Seed Phrases vs PQC: What Changes for Self-Custody
- How to Check if Your Bitcoin Address Has an Exposed Public Key
- How to Protect Your Crypto From Quantum Computers
Browse all post-quantum cryptography guides.
This article is educational and does not constitute security or investment advice.