Open source · local only · fixed recipe

Your wallet,
mined from memory.

You wait once per recovery. An attacker pays for every guess.

No physical seed required. No account. No server to trust.

No seed to carry Runs locally Fixed public recipe

“Mined” means recomputed through 10,000 Argon2id memory-hard jobs—not cryptocurrency mining. The same exact inputs recreate the same wallet.

The work raises the cost of each guess. It cannot make a weak, personal, or reused password strong.

your computer local only

$ bunx brainvault

BRAINVAULT · deterministic wallet recovery

Work preset level 4 · 10,000 shards

Password •••••••••••••••• typing works

✓ Canonical root derived

Fingerprint a8f4·2d91

First address 0x••••••••••••••••••••••••••••••••••••••••

Private material stays hidden until exact confirmation.

No required seed backupRecovery comes from exact inputs, not from preserving one physical copy.

No remote trustYour secret stays on the computer you control. There is no BrainVault account.

Memory-hard by designStandardized Argon2id v0x13 spends 256 MiB per numbered job instead of relying on a home-grown fast hash.

One fixed recipeFaster computers may reduce the wait. They are never allowed to change the wallet.

01 / The seed problem

Twelve words.
A lifetime of hiding them.

A seed phrase is a bearer key. Anyone who photographs, copies, or finds it can control the wallet. Protecting every copy becomes a permanent physical-security job.

Lose the last readable copy and nobody can help. BrainVault removes the required physical seed backup: exact inputs recreate the wallet from a public recipe instead.

If it is foundThe finder has the key.

If it is lostYou no longer have the key.

02 / Why brainwallets failed

They removed the paper—and made guessing cheap.

The original idea was irresistible: remember a phrase and recreate a wallet anywhere. But people chose predictable phrases, and early tools turned each phrase into a key with math designed to run fast.

Attackers could test enormous dictionaries offline. A sentence felt private to its owner while remaining easy for a machine to predict.

Predictable human phrase + Fast, repeatable hash = Cheap guesses at scale

At a glance

A different standard for long-term recovery.

BrainVault does not pretend to beat a random seed at raw entropy. It solves a different problem: carrying one physical master key through decades. It is built as a public, fixed, memory-first recipe that independent implementations can preserve.

MnemonicProven · seed copy BrainVaultMemory-first BrainwalletAvoid

Swipe horizontally to compare all three →

What matters	Standard mnemonic12 or 24 seed wordsProven default	BrainVaultMemory-first recoveryMemory-first choice	Classic brainwalletHuman phrase + fast hashAvoid
What must survive	Copy requiredA readable 12- or 24-word physical or digital copy.	No required copyExact username, secret, shard count, and multiplier.	Memory + recipeThe exact phrase and original derivation recipe.
Starting entropy	Strong128 or 256 generated bits when created correctly.	Input-dependent59.54 bits with the built-in generator; unknown for a human-created secret.	Usually weakHuman phrases are patterned and cannot be honestly scored.
One offline guess	Cheap guess · vast spaceRelatively cheap to validate, but properly generated entropy is enormous.	10,000 costly jobsNumbered Argon2id work at the recommended setting.	Usually one fast hashLarge dictionary attacks stay cheap.
Physical discovery	Bearer keyFinding the seed copy is enough to take the wallet.	Nothing required to findAn optional backup reintroduces this risk.	No artifact · still guessableWeak phrases can be attacked without finding anything.
Recovery experience	FastWidely supported once the seed is available.	Deliberate waitHardware-dependent work on every recovery.	Instant for attackers tooEvery dictionary guess is also instant.
Wallet compatibility	Native standardBroad BIP-39 wallet support.	Standard outputCreates BIP-39 mnemonics and established Ethereum paths after derivation.	Varies by toolMay not follow a maintained standard.
Permanent failure	Lose the last copyLoss, damage, or theft can be final.	Forget an exact inputA typo opens a different wallet; a weak choice can be guessed.	Guessed or forgottenEither failure can be final.
Best fit	Established defaultBest when you can secure a physical seed for life.	Memory-first standardBest when you accept deliberate work and exact-input discipline.	Do not useIts convenience came from making attacks cheap.

All three fail if malware or a camera captures private material during recovery. BrainVault changes storage and guessing economics; it does not make the surrounding computer trusted.

03 / The BrainVault difference

Every guess has to do the work.

The recommended setting runs 10,000 numbered Argon2id jobs. You repeat the work when you recover. An attacker repeats it for every candidate secret.

YouOne candidate

Recover occasionally, using the exact secret you already know.

AttackerEvery candidate

Pay the full time and memory cost again for every guess.

01Local only

Enter exact details

Username, password, and work settings are read only on your computer.

Why: one changed character intentionally opens a different wallet.

02Memory-hard

Make guessing costly

The recommended setting performs 10,000 memory-heavy Argon2id jobs.

Why: mass password guessing must pay a large memory bill every time.

03Deterministic

Combine in fixed order

Fast and slow machines may finish jobs differently. BrainVault always combines them by number.

Why: hardware and worker count can change waiting time, never the wallet.

04Standard output

Create one wallet root

The fixed result is converted into wallet seed words and optional site passwords.

Why: the same root recreates the same outputs without a BrainVault account.

PRIMARY wallet

A 24-word wallet with both standard and Ledger Live Ethereum address families.

SECONDARY wallet

A completely separate 12-word wallet with the same two address families.

Site passwords

Repeatable per-site credentials, revealed only on a temporary private screen.

When importing either wallet, leave the optional BIP-39 passphrase empty. PRIMARY and SECONDARY are separate wallets, not two versions of the same one.

For experts: see the exact versioned recipe

Input bytes: NFKD normalization, then exact UTF-8
Each numbered job: Argon2id v0x13 · 262,144 KiB · t=1 · p=1 · 32 bytes
Combination: Domain-bound BLAKE3 fold in numeric shard order
Wallet import: Frozen derivation paths · empty optional BIP-39 passphrase

04 / Your recovery secret

Generate it. Recover it twice. Keep it in your head.

BrainVault makes each guess expensive. Your secret still determines how many useful guesses an attacker has to try.

Quantified randomness59.54 bits

Ten random characters

BrainVault can generate ten independent letters and numbers using your operating system’s secure random source. Learn the exact capitalization.

bunx brainvault --suggest-password

Why: machine choices have countable strength. BrainVault shows the result once, requires an exact repeat, and then clears that temporary screen.

Before fundingRequired practice

Recover it independently

Close the first session. Later, enter everything again from memory and compare the complete first receiving address.

Why: repeating it immediately proves typing. A fresh recovery proves that your actual long-term recovery process works.

Backup-firstOptional

Generate, then back it up

Use the random option and preserve the exact secret offline. You keep BrainVault’s deterministic recovery while adding protection against forgetting.

The copy becomes sensitive physical material. Anyone who learns the complete recovery inputs can recreate the wallet.

See the real flow

One terminal.
Nothing sent away.

The recording uses public demonstration inputs and a wallet that must never receive funds.

Local terminal Private output hidden No secrets on this site

Real CLI sequence, public demo secret. Enter real recovery inputs only in your own trusted terminal.

05 / Run

Choose how much you want to verify.

Every route must produce the same wallet. The difference is what you inspect before entering a real secret.

Fast start01

Try the published package

bunx downloads BrainVault from npm and starts it. Use public demo inputs first.

bunx brainvault

Source verification1 / 3

No install scripts. Downloading the package cannot quietly run a build step.
Binary hash check. The fast Apple helper is rejected if its bytes changed.
No silent fallback. A selected engine either works correctly or stops.

Audited copy02

Inspect an exact package

Place one fixed version on disk without letting it execute, then inspect those exact files.

mkdir brainvault-audit
cd brainvault-audit
bun init -y
bun add --exact --ignore-scripts \
  brainvault@2.1.0

Source verification2 / 3

Why this is stronger ↓

Source checkout03

Rebuild it yourself

Read the source, lock every dependency, and prove that the fast native program comes from that source.

cd xln/brainvault
bun install --offline \
  --frozen-lockfile --ignore-scripts
bun run verify:source
bun run check
bun ./brainvault --smoke

Source verification3 / 3

06 / State-of-the-art Argon2id

Default work10,000Argon2id jobs in every default recovery—and in every attacker guess.

Measured14.064 sMedian end-to-end wait on the exact M3 Ultra measured below.

Repeated A/B30.27%Faster than the previous safe plan, measured in alternating runs.

Practical for recovery. Expensive for guessing.

You may recover a wallet only a few times. An attacker may need millions of guesses. BrainVault deliberately spends time and memory on every attempt so that repetition is costly.

Other Macs may be slower or faster; no M5 time is claimed until it is measured.

M1 · M2 · M4 · M5

Broad Apple compatibility

The conservative CPU version works across Apple Silicon. It is selected when no faster machine profile has been repeatedly measured.

Exact measured M3 Ultra

Measured acceleration

The tuned GPU and CPU version is automatic only on the exact hardware where its behavior and speed were measured.

Exact test machine: 32 CPU · 80 GPU · 512 GiBThe M3 Ultra configuration behind these numbers.
Work split: 8,000 Metal · 2,000 C/NEONThe GPU and CPU share the same 10,000 fixed jobs.
Concurrency: 8×40 GPU · 32 CPUMany jobs run together; their final order remains fixed.
Working memory: 88 GiB live arenasTemporary memory used during derivation, then wiped where the runtime permits.
Typical total wait: 14.064s vs 20.169sMedian end-to-end time for the new and previous safe plans.
Measured gain: 30.27% fasterThree alternating runs per plan—not a one-run headline.

Why this matters: acceleration may reduce your wait, but it is never allowed to change the wallet. These figures measure speed, not the strength of a human-chosen password.

07 / Maximum paranoia

You do not have to trust the download.

Experts can inspect the recipe, freeze every dependency, rebuild the native helpers, and test known results before using a real password.

Open the maximum-assurance checklistSix steps · intended for expert review SourceDependenciesRebuildVectors

01
Pin one exact version
Verify an immutable commit through another channel. Why: a branch name or web page can change after you review it.
git commit · signed release hash
02
Read the recipe and its dependencies
Inspect frozen parameters, exact package versions, vendored native source, and the manifest. Why: these files determine what will execute.
SPEC-V1.md · primitives/* · bun.lock · MANIFEST.sha256
03
Install without executing package scripts
Prepare an audited cache, disconnect networking, freeze the lockfile, and disable lifecycle scripts. Why: installation should only place reviewed files.
bun install --offline --frozen-lockfile --ignore-scripts
04
Rebuild every native helper twice
Two clean builds must match each other and the bundled Apple binaries. Why: matching bytes connect reviewed source to the fast executable.
bun run verify:source
05
Run known answers and failure tests
Check frozen examples, worker combinations, malformed results, and every available engine. Why: speed paths must never create a different wallet.
bun run check · bun run test:matrix · bun ./brainvault --smoke
06
Recover twice before funding
Close the first run, derive again independently, and compare the complete first address. Why: this tests what you will actually need during recovery.
Offline · no recording · no copied seed

Why there is no generic `bun run build`

TypeScript already runs directly in Bun, so “it compiled” says little. verify:source checks something stronger: clean native builds reproduce the exact bundled binaries.

08 / Verification record See the tests and reproducibility evidence Four independently checkable proof types

These checks apply to one fixed release candidate. They are reproducible evidence, not a guarantee about future code or the strength of a user's password.

Frozen vectors

Known inputs have permanent expected outputs, so protocol drift becomes a test failure.

Release matrix

Worker counts and memory multipliers are checked because performance settings must not reorder results.

Engine parity

Every available implementation must produce the same full root, not merely a matching short fingerprint.

Reproducible builds

The M1-compatible and M3-family native binaries are rebuilt twice and compared byte-for-byte.

Public benchmark vector dc2090d65af300c74384ca36adf16ff993c43f4947ee9a0f09e8055f009c3485

This public demonstration root matched across all available benchmark engines.

Advisory model-assisted reviews

External models were used as advisory reviewers on fixed candidates. Their opinions are not certification and are not part of the trust path. Source, vectors, tests, and reproducible builds are the independently checkable evidence.

09 / Before real money

Failure is permanent. Practice recovery first.

A long input is not automatically a strong input. Eight characters is only basic hygiene. Use a unique password that cannot be guessed from personal facts or reused leaks.
Exact means exact. Capitalization, spaces, username, shard count, and multiplier all matter. A mistake creates a different valid wallet rather than an error message.
There is no reset desk. BrainVault stores nothing and nobody can restore forgotten details. That independence is also the central risk.
Your address reveals financial activity. The first address is safe to receive funds but privacy-sensitive to publish or associate with your identity.
The surrounding computer still matters. Alternate screens cannot defeat cameras, recordings, swap, crash dumps, malware, or a forced power loss.

Nothing stored · nobody to reset it

Recover it twice.
Then fund it.

Derive once, close the session, start again independently, and compare the complete first address—not only the short fingerprint.

Derive Recover again Match full address

Review the run options Read the source ↗

Your wallet,mined from memory.

Twelve words.A lifetime of hiding them.