The risks of vanity addresses
What a vanity address actually costs you
Every extra character multiplies the work by the size of the alphabet. That is not a gentle curve. On this machine, with every core running:
| Pattern | Ethereum (16 chars) | Bitcoin bech32 (32) | Solana / TRON (58) |
|---|---|---|---|
| 4 characters | seconds | ~1 minute | ~10 minutes |
| 5 characters | ~1 minute | ~30 minutes | ~10 hours |
| 6 characters | ~15 minutes | ~16 hours | ~25 days |
| 7 characters | ~4 hours | ~3 weeks | ~4 years |
| 8 characters | ~3 days | ~2 years | ~230 years |
The readout above the search box computes this live for whatever you type, using the speed actually measured on your hardware rather than a guess. If it says four years, it means four years.
The $160 million lesson
In September 2022 the trading firm Wintermute lost about $160 million from a wallet whose address had been generated by a popular vanity tool called Profanity. The address was fine. The key was not.
Profanity seeded its search from a 32-bit random value. Thirty-two bits is roughly four billion possibilities — a number a GPU can walk through completely. Every key that tool ever produced lived inside a keyspace small enough to exhaust, and once researchers noticed, every Profanity address on every chain became a sitting target. The tool's author had archived the project months earlier and warned people, but the addresses were already funded.
This tool draws every starting scalar from crypto.getRandomValues — the browser's CSPRNG — as a full 256-bit value, and re-draws a fresh one roughly every million candidates. You do not have to take that on faith: it is src/core/vanity.js, it is about eighty lines, and the reasoning is written in the comments.
Address poisoning
This is the risk that actually applies to you, and it is a consequence of the thing you wanted.
A vanity address trains you and your counterparties to recognise a wallet by its first few characters. Attackers know this. The attack works like this: they watch the chain for your transactions, generate an address sharing your first four and last four characters, and send you a dust transaction — or a zero-value token transfer — from it. Now their lookalike sits in your wallet's history, one row away from the real thing. The next time you pay that counterparty, you scroll back, see a familiar-looking address, and copy it.
Third-party and "split-key" vanity services
Some services offer to search for a long pattern on their GPU farm. Two flavours exist:
- They send you a private key. Assume it is compromised. There is no way for you to know they did not keep a copy, and no reason to believe they didn't.
- Split-key. You send a public key, they search for a matching offset, you combine it locally with your private half. This is cryptographically sound in principle — but it only holds if their implementation is honest and their arithmetic is right, and you cannot audit either. Profanity was open source and still broken.
If a pattern is too slow to find on your own machine, the correct response is to want a shorter pattern.
Things this tool deliberately will not do
It does not check balances. Not for generated wallets, not for anything.
A page that generates keys and checks whether they hold funds is not a wallet generator. It is a brute-force scanner, and the only thing separating "educational demo" from "theft" is which addresses it chooses to look up. Such tools are also useless at their stated purpose — searching 2128 possibilities at a thousand per second is not a long shot, it is arithmetic that never terminates — while their real effect is to broadcast every address they touch to whichever RPC provider they use. There is no version of this feature that is worth having, so there is no version of it here. There is no fetch in this codebase and the CSP would refuse one if there were.
Quantum computers
Honest answer: not your problem today, and not a reason to avoid generating a wallet. A cryptographically relevant quantum computer would break the elliptic curve signatures used by every chain here, but no such machine exists and the addresses at risk first would be ones whose public keys are already exposed on-chain. If that changes, it changes for every wallet at once and the chains will have to fork. It is not a vanity-address problem.