I'm looking to generate a brain wallet for ethereum. Which sites are trustworthy to do this without my coins being stolen?
3 Answers
First, a warning: Brainwallets are intrinsically risky - never make one out of an actual phrase in the english language (or any language for that matter). Phrases from language are much easier to guess than a random list of words from a language, so only use brainwallets that are random lists of words taken from a large pool of potential words (e.g. more than 50,000). Of course, brainwallets are also risky because they can be forgotten.
But with that warning out of the way, if you want trustworthy security you can't use any single website or program to make the brainwallet because it is not possible to know if data is intercepted anywhere along the way. I like to mix and match different sources of random words to generate a trustworthy, high entropy wallet. Here's one way you could do that:
- Get 5 brainwallets from a variety of websites.
- Make a list of 50 words from 3 or 4 different random word generators, make sure they have large pools of words that they pull from. Here's one with 90k words in the pool, that's pretty good: http://www.wordgenerator.net/random-word-generator.php
- Get some random words from printed (ie, not digital or on your compture) things in your house. Maybe the 10th word of five newspaper articles, the 20th word of five pieces of mail, the second word off a few business cards.
- Randomly take words from each of these sources and construct your own brainwallet that way. DO NOT try and make a sentence that's easy to remember from the words. If you want to memorize them, first make the wallet randomly, then figure out how you're going to memorize them. I think 13 or so words was the standard for a lot of bitcoin wallets, 20 is much better.
If you want to understand more about the entropy/difficulty to guess a brainwallet this is a useful place to start: https://xkcd.com/936/ To actually calculate entropy you need to know how many possible words were in the pool that you randomly choose yours from.
-
The website that @5chdn links to (blog.ether.camp/post/138376049438/why-brain-wallet-is-the-best) says 5 words is plenty - that assumes that you don't get all common words. I would go with at least a few more words, even from a pool of 200,000, but that's me. Feb 2, 2016 at 1:49
Here is the ethaddress.org brain wallet. It's not trustworthy but you can clone it on github and run it locally on an offline machine. Which makes it pretty trustless.
Here is live.ether.camp (click "get address" button). It's also not trustworthy, but since you asked for multiple alternatives it's worth to add this. These guys are pushing brain wallets really hard.
Test this with small amounts first!
Just made an cold brain wallet with transaction signing. Made it mostly for personal use. Please take a look if you wish.
Please use it online version only for test purposes. It is more intended for offline use: you can download HTML and put it to always offline device (I use old smartphone for that purpose).
It is in active development and no guaranties, but already functional and while you use it offline you should be safe (as safe as your pass phrase).
It uses browserifyed ethereumtx-js npm module and this QRCode.js as libraries, and a few my own js scripts at the top of HTML. So one may compare libraries line by line with original and prove they are the same, and check my few script that they do not do any suspicious things.
Anyway, if you use it offline it can't send anything outside a device.
But to be sure that it works correct, try to generate a wallet, send a small amount to it's address, then send money back (better with offline transaction).