Texts/"passwords" as private keys source and transactions

[pbies]

Theory:

Take common passwords from the Internet, convert them to WIF (line by line), import them in Bitcoin Core, check for transactions (these are there, but addresses are empty),
export transactions, mess around with this export to get back commonly used words/texts as private key sources (that had transactions).

Effect:

From 500 000 passwords I've got (SHA256 once and later twice which gives 1M passwords) ca 200 passwords that have been used as source for private key (later converted to WIF).
Each line represents text which converted to private key/WIF (sha256 once and twice) would give address with transactions. So these are "passwords" which people used for their generation of addresses.

These are the passwords:

Code:

01201291
065332245
07111996
0953294511
1985aag
1992422
1unseen1
2063045
20683442
250485
25101970
251079
254948
25703581
2580456
259107al
2598897
259988
2679492
269422679
336783
64156415
644lords
6621034
7388b4c4
7sisters
A#45
adagio123
adagny
afddssdf
agnomical
alexboy1
algoristic
anathema
apogee
ariose
atacamenan
autograph's
avsp55
baniva
barriguda
beaching
beachless
beast's
Bette's
billa
blackseed
blya64
BoingBoing00
But I do not propose all these things
byteme1
cabirean
calyceraceous
calyptra
cd0d4cc32346750408f7d4f5e78ec9a6e5b79a0d
cherried
conch's
Confucian's
crane's
crevasse's
Crisco
datachip60
datorn
daunas
daunts
dave
Devil#2017
downspout
dune2
DuPont
edgarela
edgewise
edwardean
efendim
efever79
effacement's
effaces
effectful
entophytically
extracranial
felling
Ferrari@13579
finnish
fl4tr0n
gastroalbuminorrhea
ghghgh77
glaciometer
Golf001
gordon
grotesque
grouped and combined
hallelujah
hhhsmh
Honshu's
hydroferrocyanic
hyperalgesis
inconsidered
incorrigibility's
infamize
inge
inveighing incessantly
jacket's
kaartje1
Kenyans
knighthood's
knur
latirostres
leinad99
Like attempting to number the waves on the snore of a limitless sea
Lizzie
lomekol1
lx76
M@ster#5555
maike
maker
mandarinate
marcus15
marjam52
Maronite
meanness
Meuse's
micaela
mischievousness
mizzle
mouillure
muslined
myroker
mythologist's
neglectingly
nettlefire
Nova#54
octuple
One@45
orthodome
oscheal
otorrhagia
ototomy
pancreatism
parallelepipedic
pomp and pageantry
preprice
promptness's
proteroglyphic
pusey
pyroheliometer
pyrrhonic
quinoline
raspberry
rattoner
recarbonate
redivertible
replicatory
replight
reprosper
reptility
rhemist
salicylize
sanguinicolous
sarahw
sarcocarcinoma
schizaeaceous
scrofuloderma
scrofulosis
seacoast's
semimagical
seroimmunity
Server#98
settee's
sevim
Shadow4444
shamond
Sign1111
skola190
snowberg
standee
startle
Sudoku
swarbie
t3st1ng
tarnishment
tellurism
TORRES33
trionychoid
Trudeau
truelike
unavertibly
unconfinedness
unique personality
unkemptly
unpounded
untumultuous
ustas
walepiece
warmth's
whoknows420
wilma0823
wingspread's
wondermongering
Wroclaw's
Www$
wyne
yak's
zaki67
zeuxian
zingiber
zyklop

[1714950089]

1714950089

[kaggie]

Beautiful work there. Thanks for sharing.

Code:

01201291
065332245
07111996
0953294511
1985aag
1992422
1unseen1
2063045
20683442
250485
25101970
251079
254948
25703581
2580456
259107al
2598897
259988
2679492
269422679
336783
64156415
644lords
6621034
7388b4c4
7sisters
A#45
adagio123
adagny
afddssdf
agnomical
alexboy1
algoristic
anathema
apogee
ariose
atacamenan
autograph's
avsp55
baniva
barriguda
beaching
beachless
beast's
Bette's
billa
blackseed
blya64
BoingBoing00
But I do not propose all these things
byteme1
cabirean
calyceraceous
calyptra
cd0d4cc32346750408f7d4f5e78ec9a6e5b79a0d
cherried
conch's
Confucian's
crane's
crevasse's
Crisco
datachip60
datorn
daunas
daunts
dave
Devil#2017
downspout
dune2
DuPont
edgarela
edgewise
edwardean
efendim
efever79
effacement's
effaces
effectful
entophytically
extracranial
felling
Ferrari@13579
finnish
fl4tr0n
gastroalbuminorrhea
ghghgh77
glaciometer
Golf001
gordon
grotesque
grouped and combined
hallelujah
hhhsmh
Honshu's
hydroferrocyanic
hyperalgesis
inconsidered
incorrigibility's
infamize
inge
inveighing incessantly
jacket's
kaartje1
Kenyans
knighthood's
knur
latirostres
leinad99
Like attempting to number the waves on the snore of a limitless sea
Lizzie
lomekol1
lx76
M@ster#5555
maike
maker
mandarinate
marcus15
marjam52
Maronite
meanness
Meuse's
micaela
mischievousness
mizzle
mouillure
muslined
myroker
mythologist's
neglectingly
nettlefire
Nova#54
octuple
One@45
orthodome
oscheal
otorrhagia
ototomy
pancreatism
parallelepipedic
pomp and pageantry
preprice
promptness's
proteroglyphic
pusey
pyroheliometer
pyrrhonic
quinoline
raspberry
rattoner
recarbonate
redivertible
replicatory
replight
reprosper
reptility
rhemist
salicylize
sanguinicolous
sarahw
sarcocarcinoma
schizaeaceous
scrofuloderma
scrofulosis
seacoast's
semimagical
seroimmunity
Server#98
settee's
sevim
Shadow4444
shamond
Sign1111
skola190
snowberg
standee
startle
Sudoku
swarbie
t3st1ng
tarnishment
tellurism
TORRES33
trionychoid
Trudeau
truelike
unavertibly
unconfinedness
unique personality
unkemptly
unpounded
untumultuous
ustas
walepiece
warmth's
whoknows420
wilma0823
wingspread's
wondermongering
Wroclaw's
Www$
wyne
yak's
zaki67
zeuxian
zingiber
zyklop

"Like attempting to number the waves on the snore of a limitless sea"

A poetic description of all addresses. So beautiful, nearly numberless in possibility, yet eventually boring.

[khaled0111]

Those are brainwallet and they were very common in bitcoin's early days. No one uses them anymore since they are unsafe and it doesn't matter how many time you hash the password.
Someone already found more than 18k used addresses. You can check his topic here for more details:
Collection of 18.509 found and used Brainwallets

There are many bots monitoring these addresses 24/24 to steal any coins they receive. This why you probably will never find any brain wallet with a balance.

[nc50lc]

Ah, so this is what this other thread of yours is all about: Export private keys that had movement - Bitcoin Core

You basically reinvented "Brainwallet" if you're not aware of the term.

[pooya87]

So what's the point of all this effort that you put into this work? Is it to get lucky and earn some free money if someone was dumb enough to actually hold any coins in any of these keys?
I assure you that you would have earned a lot more money if you had spent your time more constructively.

[pbies]

Those are brainwallet and they were very common in bitcoin's early days. No one uses them anymore since they are unsafe and it doesn't matter how many time you hash the password.
Someone already found more than 18k used addresses. You can check his topic here for more details:
Collection of 18.509 found and used Brainwallets

There are many bots monitoring these addresses 24/24 to steal any coins they receive. This why you probably will never find any brain wallet with a balance.

I have one 8 GB wallet and it does have very many transactions.

Volume of my experimental wallets is 78 GB in size.

I didn't found any address that have any positive balance. Excluding prepared fake wallet with ~150 BTC.

@nc50lc I didn't known the name "brainwallet" but that's right! I am trying brainwallets.

@pooya87 I guess I expected some luck to find any balance, but didn't. I have my job, I do that in free time.

[NeuroticFish]

I guess I expected some luck to find any balance, but didn't.

The thing is.. especially since it was noticed how unsafe brainwallets are, most probably others have done this job already... years ago (this is usually one of the big problems in reinventing the wheel).

[ymgve2]

Could you explain exactly how you convert the passwords into WIF format? Because I can't find any used addresses with those passwords you provided with a simple single or double SHA256 like brainwalletx does.

Also, could you give an example of an address that you found that had coins at some point in time? I suspect that your way of connecting which address correspond to which password is flawed.

[pbies]

Could you explain exactly how you convert the passwords into WIF format? Because I can't find any used addresses with those passwords you provided with a simple single or double SHA256 like brainwalletx does.

Also, could you give an example of an address that you found that had coins at some point in time? I suspect that your way of connecting which address correspond to which password is flawed.

I use Python script for that:

Code:

#!/usr/bin/env python3

import base58
import hashlib
import sys

with open("input.txt","r") as f:
	content = f.readlines()

content = [x.strip() for x in content]

o = open('output.txt','w')

for line in content:
	a=line.encode('utf-8')
	b=hashlib.sha256(a).digest()
	c=b.hex()
	d='80'+c
	f=bytes.fromhex(d)
	g=base58.b58encode_check(f)
	h=g+" 0\n"
	o.write(h)
	i=hashlib.sha256(b).digest()
	j=i.hex()
	k='80'+j
	l=bytes.fromhex(k)
	m=base58.b58encode_check(l)
	n=m+" 0\n"
	o.write(n)

Run under WSL1 on Windows.

Yes, I was doing more research and something is not right with the connection between phrase and address.

I am still in research about the topic.

Now I have managed to get these phrases:

Code:

01201291
065332245
07111996
0953294511
1985aag
1992422
1unseen1
2063045
20683442
250485
25101970
251079
254948
25703581
2580456
259107al
2598897
259988
2679492
269422679
336783
64156415
644lords
6621034
7388b4c4
7sisters
A#45
adagio123
adagny
afddssdf
agnomical
alexboy1
algoristic
anathema
apogee
ariose
atacamenan
autograph's
avsp55
baniva
barriguda
bc1672b798787bf507361247cef6784c7f34cbe13d01da59b369bb050a69792c939adfe6a84f025fb6a1b4e836b94f2c2fff9ba63467bbdb880cd7226f2aa0a9  -
beaching
beachless
beast's
Bette's
billa
blackseed
blya64
BoingBoing00
But I do not propose all these things
byteme1
cabirean
calyceraceous
calyptra
cd0d4cc32346750408f7d4f5e78ec9a6e5b79a0d
cherried
conch's
Confucian's
crane's
crevasse's
Crisco
datachip60
datorn
daunas
daunts
dave
Devil#2017
downspout
dune2
DuPont
edgarela
edgewise
edwardean
efendim
efever79
effacement's
effaces
effectful
entophytically
extracranial
felling
Ferrari@13579
finnish
fl4tr0n
gastroalbuminorrhea
ghghgh77
glaciometer
Golf001
gordon
grotesque
grouped and combined
hallelujah
hhhsmh
Honshu's
hydroferrocyanic
hyperalgesis
inconsidered
incorrigibility's
infamize
inge
inveighing incessantly
jacket's
kaartje1
Kenyans
knighthood's
knur
latirostres
leinad99
Like attempting to number the waves on the snore of a limitless sea
Lizzie
lomekol1
lx76
M@ster#5555
maike
maker
mandarinate
marcus15
marjam52
Maronite
meanness
Meuse's
micaela
mischievousness
mizzle
mouillure
muslined
myroker
mythologist's
neglectingly
nettlefire
Nova#54
octuple
One@45
orthodome
oscheal
otorrhagia
ototomy
pancreatism
parallelepipedic
pomp and pageantry
preprice
promptness's
proteroglyphic
pusey
pyroheliometer
pyrrhonic
quinoline
raspberry
rattoner
recarbonate
redivertible
replicatory
replight
reprosper
reptility
rhemist
salicylize
sanguinicolous
sarahw
sarcocarcinoma
schizaeaceous
scrofuloderma
scrofulosis
seacoast's
semimagical
seroimmunity
Server#98
settee's
sevim
Shadow4444
shamond
Sign1111
skola190
snowberg
standee
startle
Sudoku
swarbie
t3st1ng
tarnishment
tellurism
TORRES33
trionychoid
Trudeau
truelike
unavertibly
unconfinedness
unique personality
unkemptly
unpounded
untumultuous
ustas
walepiece
warmth's
whoknows420
wilma0823
wingspread's
wondermongering
Wroclaw's
Www$
wyne
yak's
zaki67
zeuxian
zingiber
zyklop

[BlackHatCoiner]

Take common passwords from the Internet, convert them to WIF (line by line), import them in Bitcoin Core, check for transactions (these are there, but addresses are empty)

What's a common password? You probably mean hacked passwords which were in sale? Some of these look completely random.

and earn some free money if someone was dumb enough to actually hold any coins in any of these keys?

But, this isn't earning, but theft. Even if there was an idiot, who used a brainwallet whose password wasn't strong enough, it wouldn't mean you can take their money. For the same reason you won't steal them if they'd forgotten their wallet right next to you.

[pbies]

What's a common password? You probably mean hacked passwords which were in sale? Some of these look completely random.

For example:

https://github.com/dwyl/english-words/blob/master/words.zip

And well known passwords that were used in Linux systems by users over the years.

[LoyceV]

Ah, so this is what this other thread of yours is all about: Export private keys that had movement - Bitcoin Core

That means my solution could have been so much faster without using Bitcoin Core at all!

From 500 000 passwords I've got

Where did this list come from? In another topic a link to 40 billion passwords was posted, so why limit yourself to only half a million?

(SHA256 once and later twice which gives 1M passwords)

I tried a few, by entering the sha256 hash into Bitaddress, and the resulting addresses into Blockchair, but none of them show any past transactions. What did I do wrong? I like the challenge of doing the same for those 40 billion leaked passwords.

[pbies]

...

I must have messed sth up with correlation between brainwallet texts and private keys.

Try yourself some solutions! It is fun!

That means my solution could have been so much faster without using Bitcoin Core at all!

Yes, one grep is enough to test all addresses with brainwallets.

I do that in Bitcoin Core, I want to be sure. I place each private key with 0 date so BC scans each private key from the beginning of blockchain.
It takes 2h on my PC with 500k brainwallets.

Importing 40B of "passwords" into Bitcoin Core would take months, I think, that's why I do not go for that amount.

[moderator's note: consecutive posts merged]

[LoyceV]

Importing 40B of "passwords" into Bitcoin Core would take months, I think, that's why I do not go for that amount.

Doesn't Bitcoin Core fit the entire wallet into RAM? Importing billions of addresses will never work.
If you can help me reproduce the address belonging to any of the 200 "passwords", I'd like to use this to give the 40 billion passwords a try. I think "bitcoin-tool" can create addresses from hex private keys, and from there I can sort and compare them at about a billion at a time. It will take a while, but I'm curious enough to want to know how many of those passwords have been used to create a brainwallet.

[kaggie]

What's a common password? You probably mean hacked passwords which were in sale? Some of these look completely random.

But, this isn't earning, but theft. Even if there was an idiot, who used a brainwallet whose password wasn't strong enough, it wouldn't mean you can take their money. For the same reason you won't steal them if they'd forgotten their wallet right next to you.

I would say those particular ones look completely not random. Many of those would be easily the same person based on the non-randomness of them with more ties possible based on the looking up the originating addresses. I'm thinking about the very not even distribution in it: certain numbers and letters are entirely skipped, some are in caps, there is also the inclusion of certain kinds of words.

These are 200 addresses, where there were 18k in the github link. What's the difference? Time?

[hatshepsut93]

This should be a reminder to anyone who wants to make their own brainwallet. There are people out there who have servers for monitoring huge numbers of potential brainwallets, and the moment such address receives coins, they get instantly swept by a bot. Don't think that the passphrase that you came up with is highly complex and unique, it's possible that someone's algorithm will come up with this phrase when they will build their list of potential brainwallets.

[PawGo]

These are 200 addresses, where there were 18k in the github link. What's the difference? Time?

I think the difference is in pool of used phrases. OP wrote:

From 500 000 passwords I've got

0.5mln is not so much, probably if database would be bigger, there results could be closer to 18k.
It is interesting exercise, but I think currently it has not so much sense, as brainwallets are not popular anymore. It could be good to see which phrases were used, but IMHO it is just a sociological experiment (to see how many people created a wallet using dog's name etc.).

[LoyceV]

brainwallets are not popular anymore.

I'm pretty sure some people still use them. Example: me There's only a smal amount in it, and I haven't checked it for years, but I dare to say my setup is complicated enough to never be brute-forced.

I guess the remaining brainwallets in use have decent passwords too. One way to stop "generic" brute-forcing is by adding something personal as a salt, for instance your licence plate. That easily makes it 8 orders of magnitude more difficult to brute-force, and an attacker would have to "multiply" his database of all existing passwords with all existing licence plates.
I'm not using my licence plate, and I'm not disclosing what I'm doing.

[pbies]

...

I tried a few, by entering the sha256 hash into Bitaddress, and the resulting addresses into Blockchair, but none of them show any past transactions. What did I do wrong? I like the challenge of doing the same for those 40 billion leaked passwords.

I was using SHA256 once and twice, so maybe that's why you don't see any transactions.

I double the passwords by using SHA256 once and twice (this makes the process two times longer).

[PlutonowyPokrzycz]

I've checked your code and still don't understand how the list of 200 phrases gets you to addresses with history of transactions.
I've checked them with multiple hashing SHA256 and only three seem to be valid (with just single SHA256):
raspberry, grotesque, mischievousness

Can you please try explaining again? For example this part:

export transactions, mess around with this export to get back commonly used words/texts

How do you mess with transactions? There is not much text within a bitcoin transaction.