Where the four comes from
Each character of an onion address carries five bits, because the alphabet has thirty two symbols. To land a chosen prefix of n characters you have to generate keys until one happens to encode to that prefix, which takes about 32 raised to the power n attempts on average.
For four characters that is 32 times 32 times 32 times 32, which is 1,048,576. A million attempts. A plain desktop machine running a standard vanity address generator gets through that in about a second. Even at a hundred times slower than that assumption, it is done inside two minutes.
The four in the title is therefore a threshold rather than a measurement. It marks where the cost of forgery stops being a barrier of any kind.
| Prefix | Average attempts | At 1M keys/sec | At 10k keys/sec |
|---|---|---|---|
| 4 | 1.05 million | About a second | About two minutes |
| 5 | 33.6 million | Half a minute | Under an hour |
| 6 | 1.07 billion | About twenty minutes | A day or so |
| 7 | 34.4 billion | Ten hours | Weeks |
What four characters buy you
Almost nothing on their own, which is the point of the page. They buy a very weak filter against somebody who pasted a completely unrelated address, and nothing beyond that.
They do have one honest use. If a candidate address does not match the first four characters of anything you have seen before, that is a reason to stop. A negative result from a cheap check is still a result. It is the positive result that means nothing.
What people get wrong about it
The universal mistake is to check the beginning and the end and skip the middle. Attackers know that habit and build for it. The beginning is cheap, the end is not part of most people's attention span, and the middle carries the bits that would actually cost something to match.
A related mistake is treating a longer shared prefix as proportionally safer. The cost of a prefix grows by a factor of thirty two per character, so the jump from four to eight is not twice as hard, it is a million times harder. Intuition about linear growth is wrong here in a way that matters.
The last mistake is thinking any of this replaces a signature check. It does not. Prefix comparison is triage, not verification.
What would move it
Faster hardware, and it has been getting faster for a decade. The numbers in the table assume an ordinary machine, not a rack of them. Somebody willing to spend real money moves every row up by two or three characters.
The other thing that moves it is your own comparison length. If you compare sixteen characters instead of four, the cost to the attacker goes up by a factor of about a million million million. That costs you nothing except a little more attention.
Questions people ask
So should I stop comparing prefixes?
No. Compare more of the address, not less. The check is free and the only problem with it is that people stop after four characters.
Is a vanity prefix a bad sign?
Not by itself. Most markets generate one deliberately so their addresses are recognisable. It is a convenience for readers and a convenience for forgers at the same time.