DEVLOG #1 - 24Words

24Words is an experiment in replacing passwords with 24-word BIP39 recovery phrases.

Instead of creating a password, every account receives a randomly generated recovery phrase which becomes the only credential. The idea comes from cryptocurrency wallets, which already trust these phrases with assets worth millions.

To prove the concept, I built 24Storage, a small cloud storage service where users can upload, download and manage files using only their recovery phrase.

How it works

The authentication flow is simple:

• Generate a 24-word phrase
• Show it once
• Hash it
• Store the hash
• Create a session

Logging in simply hashes the entered phrase and compares it to the stored hash.

A surprising bug

One of the biggest issues was discovering that bcrypt ignores everything after 72 bytes.

A normal 24-word mnemonic is much longer than that, meaning different phrases could authenticate as the same user if they shared the same beginning.

The solution was to SHA-256 hash the mnemonic first before passing it into bcrypt. A regression test now verifies that changing even the final word causes authentication to fail.

Building 24Storage

Authentication alone isn’t very interesting, so I built a real application around it.

Each account receives 100 MB of free storage with uploads, downloads, deletion and storage tracking.

Uploaded files are stored using random UUIDs instead of user supplied filenames, and file ownership is always checked before serving downloads.

SQLite replaced an early in-memory database so accounts survive server restarts, while rate limiting protects login attempts.

Deployment

Getting the project online ended up being almost as difficult as building it.

I first tried Oracle Cloud Free Tier because of its generous resources, but creating and provisioning virtual machines was frustrating and unreliable.

Google Cloud worked much better, with easier networking and better documentation, but its free tier requires a credit card for verification, making it less accessible.

Eventually I deployed the entire stack to a VPS running the React frontend, Express backend, SQLite database and file storage.

Try it yourself

24Words is now live.

Create an account, save your generated recovery phrase, and try logging back in with it.

Every account includes 100 MB of free storage through 24Storage.

Final thoughts

This project started with one question:

Can recovery phrases replace passwords?

The answer appears to be yes.

The interesting part wasn’t generating mnemonics, it was everything around them: hashing, sessions, storage, deployment, testing and handling the small security details that make the system practical.