The math behind why your vault can’t just be brute-forced

It is a fair question: how can 12 words possibly be strong enough to protect a lifetime of notes? The honest answer involves some arithmetic that is worth walking through, because "trust us, it’s secure" is exactly the kind of claim a privacy-first company shouldn’t be asking anyone to take on faith.

Starting with the number

A Prevon Recovery Seed is 12 words drawn from a fixed list of 2,048 possible words. That gives 2^128 possible combinations — roughly 340 undecillion, a number with 39 digits. To put that in perspective: a supercomputer capable of testing a trillion different combinations every single second would still need roughly 10 billion years to work through them all. That is longer than the current age of the universe.

"But what about quantum computers?"

This is the right follow-up question, and it deserves a real answer instead of a dismissal. Quantum computers running Grover’s algorithm can theoretically speed up brute-force search — but only by taking a square root of the problem size, which for a 128-bit key still leaves the equivalent of 128-bit classical security intact after accounting for the algorithm’s real-world overhead. It shrinks the mountain. It does not remove it.

Where the math turns into physics

Even setting aside algorithmic limits, there is a hard physical floor on brute-force search: Landauer’s principle, which describes the minimum energy required to erase or flip a single bit of information. Searching a keyspace of this size, even with a theoretically perfect computer operating at that physical limit, would require more energy than our sun produces across its entire lifetime. This isn’t a security promise. It is the same thermodynamics that governs everything else in the universe, applied to a search problem.

The wait you feel when unlocking your vault is a wall standing between your data and everyone else — including us.

The part that actually makes this hold up: Argon2id

The 2^128 keyspace only matters if turning a guess into an actual attempt is cheap. Most apps turn a password into an unlock key in a fraction of a second, which is exactly what lets an attacker’s computer test billions of guesses per second. Prevon runs your password through Argon2id, a memory-hard key derivation function that forces real memory use and multiple passes to produce a single key. That turns "try a billion guesses a second" into "acquire a billion times that memory footprint, simultaneously, per guess" — which is not a speed problem an attacker can throw more processors at. It is a wall.