Where the eight comes from
Same arithmetic as everywhere in this section: 32 to the power of the prefix length. Eight characters is 32 to the eighth, which is about 1.1 trillion attempts on average. At a million keys per second that is roughly thirteen days of continuous work on one machine.
Thirteen days is not impossible. It is not even expensive if you rent the machine. What it is, is a commitment. An opportunist copying an address into a forum post is not doing this. Somebody targeting a specific market with a specific plan might.
The eight is therefore a judgement about attacker behaviour rather than a hard boundary. The page says so at the top and the table below shows the neighbouring lengths so you can pick your own line.
| Prefix | Average attempts | One machine | A rented cluster |
|---|---|---|---|
| 6 | 1.07 billion | Twenty minutes | Seconds |
| 7 | 34.4 billion | Ten hours | A few minutes |
| 8 | 1.1 trillion | Thirteen days | A few hours |
| 9 | 35.2 trillion | Over a year | A few days |
What eight characters buy you
A real filter, for the first time. If two addresses agree on eight characters and you did not get both from the same place, one of two things is true: they are the same address, or somebody spent days of compute on you specifically. The second is rare enough to be worth noticing when it happens.
It also buys a sensible default habit. Comparing eight characters instead of four costs you about two extra seconds of attention and raises the attacker's bill by a factor of a million. There are very few checks in this subject with that ratio.
What people get wrong about it
People read the thirteen days figure as a wall. It is a wall for one attacker on one desktop. Rented compute is priced by the hour and available to anybody with a card, so thirteen machine days is a few hours and a modest bill. The right way to read the table is as an ordering, not as a schedule.
The other error is symmetry. An attacker only has to match the prefix once, then reuse that address against thousands of readers. You have to do the comparison every single time. The economics are lopsided in the attacker's favour and no amount of prefix checking fixes that.
This is exactly why the key section exists. A signature check does not degrade with repetition and does not care how much compute anybody rented.
What would move it
Cheaper compute moves the boundary right, meaning you need to compare more characters over time. Nothing about this has ever moved left. A number written here today should be treated as an optimistic floor five years from now.
A change in address length would also move it, but the total length is fixed at fifty six and there is no sign of that changing.
Questions people ask
How many characters should I actually compare?
All of them, by pasting both strings and letting a machine compare. If you are doing it by eye, take a run from the middle rather than the start.
Does the market use an eight character vanity prefix?
The published addresses share a short recognisable opening. Read that as a convenience, not as a security property, for the reasons on this page.