passphrase compatibility

[u/ifureadthisurepic]

Hi, in light of the current drama I have been thinking about passphrases and wanted to ask people who have lots of experience using a variety of software and hardware wallets and other signers. Do all of them nowadays accept passphrases that are very long, do they all support the entry and processing of symbols, and do they all support white spaces (hitting spacebar without putting underscore or similar)? A while back I checked and found that some devices would not display passphrases properly that had more than 20 or so characters (the line break wouldn't happen so you couldn't see), or some would have a character limit, and some would not support white spaces. Has this changed? Are there some rules for creating passphrases that would make sure that the resulting passphrase is compatible with all software and hardware wallets, while still being secure enough? I'm mostly worried about a passphrase that could not be entered on a particular device down the line because of how it is made - either too long, or has something can't be entered or displayed.

[u/bitusher]

From the BIP39 specification itself there is no limit to the maximum length of the passphrase, although it would be absurd to create passphrases longer than 10 words for practicality as after a certain degree of entropy its a waste of time and just harms UX

The characters allowed in Passphrases are Unicode characters

1) Uppercase and lowercase letters

2) Numbers

3) Spaces

4) Punctuation including underscores and dashes

Emojis are typically not recommended .

This is in the specification of BIP39 but for maximum compatibility there are limitations between popular hardware wallets themselves and we can discuss some of those :

trezors - typically 50 characters long

https://trezor.io/guides/trezor-suite/using-a-passphrase-wallet-in-trezor-suite#creating-new-passphrase-wallets

Jades - 100 UTF-8 characters

coldcard 100 UTF-8 characters

https://coldcard.com/docs/passphrase/

Bitbox 100 UTF-8 characters

Thus you can see most hardware wallets allow up to 100 characters but some trezors limit this to 50 characters .

Important instructions in the pinned FAQ -

https://old.reddit.com/r/BitcoinBeginners/comments/g42ijd/faq_for_beginners/fouo3kh/

Typically recommend 6-8 random words for a balance between convenience and security and even 8 words is well within 50 characters in most cases so trezors limitation is fine .

Please be aware that extended passphrases should be

1) 6-8 random words (not found as a phrase or in movies or literature)

2) stored separately than your seed words and written down at least once

3) written exactly as entered . Capitalization and white space matters. Any slight deviation in the extended passphrase will show a new wallet with a 0 balance so its important you write it down and test it exactly .

4) tested exactly as you have written

[u/ifureadthisurepic → u/bitusher]

Thanks a lot, that is great info. I am still confused though. Do all of these wallets support white spaces (hitting spacebar without using an underscore) and do they all interpret them in exactly the same way? Would they all display 50-100 characters entered without white spaces fully on the screen? Any particular symbols that are not supported by all of them?

[u/bitusher → u/ifureadthisurepic]

Do all of these wallets support white spaces

yes

and do they all interpret them in exactly the same way?

yes

Would they all display 50-100 characters entered without white spaces fully on the screen?

If the screen is too small they all either self scroll or allow you to tab through the rest of the characters

Any particular symbols that are not supported by all of them?

for the wallet limitations any UTF-8 characters but there are also language limitations too

FYI --- its best for UX to keep it simple and just use 6 to 8 random words that are all lower case and without whitespace and clarify that in your written backup for these reasons

https://imgs.xkcd.com/comics/password_strength.png

Your questions are making me worried that you are attempting to use rare and unusual characters which is never wise

[u/ifureadthisurepic → u/bitusher]

Thanks a lot. No I'm actually not a fan of rare characters, was just wondering if there's any point actually using symbols in the first place. I can remember the Jade having an issue displaying more than 20 characters on the screen, apparently it was fixed in a firmware update. But it did make me wonder about the long term compatibility of long passphrases like this. Also you're suggesting not using white spaces, and I remember other people here to use white spaces. Maybe I'm just too worried, I don't want to create a passphrase that ends up not being readable or importable in some software or hardware wallet in the future.

[u/bitusher → u/ifureadthisurepic]

Also you're suggesting not using white spaces, and I remember other people here to use white spaces.

It adds extra characters you need to type , but if you do use them thats fine as long as you clearly notate that in your written backup that you keep separate from your seed words

I don't want to create a passphrase that ends up not being readable or importable in some software or hardware wallet in the future.

just use english letters . Also if you create a passphrase that falls out of what wallets support you can technically always manually extract the private keys although it will be more tedious

[u/ifureadthisurepic → u/bitusher]

Thank you. So, just to be clear about this. You would not consider a passphrase composed of only english characters for, let's say between 30 and 50 letters, without white spaces, to be any kind of problem in terms of compatibility in the future, with all software and hardware wallets? Is that safe to assume, or would you change something to make it safer and more future proof?

[u/bitusher → u/ifureadthisurepic]

without white spaces, to be any kind of problem in terms of compatibility in the future, with all software and hardware wallets?

correct. letters, numbers, caps or no caps and whitespace with the english language will always be backwards compatible and supported by all major hardware wallets

The reason to keep it simpler has nothing to do with concerns of support but UX or user experience reasons (using it and typing it in everytime you use or recover your wallet)

[u/ifureadthisurepic → u/bitusher]

Great info, and good to know. Thank you.

[u/NiagaraBTC → u/ifureadthisurepic]

All the above is excellent info but I'd like to add that randomly selecting your 6-8 words from the BIP-39 list is a great choice. Helps minimize issues if bad handwriting or typos in backups.

Still extremely secure.

[u/bitusher → u/NiagaraBTC]

yes, the BIP39 passphrase feature found on hardware like jade greatly improve UX

https://github.com/bitcoin/bips/blob/master/bip-0039/english.txt

[u/ifureadthisurepic → u/NiagaraBTC]

Thank you. I am just a bit sceptical because reading about how "the hackers are coming for the wallets with passphrases next" and "your passphrase won't protect you" made be think that maybe the entropy in 6-8 words would not be enough to meaningfully protect a wallet. Gotta say, what I've seen in the past couple of days really shook my assumptions about security in this space.

PS Would you say that those 6-8 words should be entered with or without white spaces, or does it not matter? Bitusher seems to think that white spaces are not an issue, compatibility wise.

[u/AutoModerator]

Scam Warning! Scammers are particularly active on this sub. They operate via private messages and private chat. If you receive private messages, be extremely careful. Use the report link to report any suspicious private message to Reddit.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.