Isn't an 8-character password enough?

Eight characters is the floor NIST sets for services, not a target for your master secret. Even eight fully random ASCII characters reach only about 52 bits, and human-picked ones score far lower — which is why the same standard demands screening against breach lists.

Why not just use my phone number for the second factor?

Because a phone number is registered to a real person in most jurisdictions, which welds the nym to your identity. A TOTP secret or a security key proves possession of a key and names nobody.

Can I keep the recovery seed in cloud notes or a password manager?

That turns an offline backup into an online exposure. The seed's checksum catches typos, not theft — anything that syncs is a place the whole nym can be copied from without you noticing.

What if one word of my seed is wrong when I need it?

If the words are numbered, a single bad word can be hunted down: try candidates from the 2,048-word list in that position and let the checksum reject the failures. A 4-bit checksum passes only about 1 wrong sequence in 16, so the search converges fast.

Build an anonymous identity

Nym Key — Keys and passphrases for a pseudonymous online | nymkey.com

An anonymous online identity — a nym — is not an account you sign up for but a set of secrets only you control: a passphrase measured in bits of entropy, a second factor that refreshes every 30 seconds, and a recovery seed of 12 or 24 words. This guide walks through each layer with the real numbers behind it, so the nym survives a lost laptop without ever pointing back at you.

Measure

Bits are the common currency: about 12.9 per list word, 6.55 per random character, 11 per seed word. Decide the strength first — 65 bits or better for the master secret — then generate to the target.

Factor

The second factor is a possession proof, not an identity document. Six digits every 30 seconds, or a 32-byte key that never leaves its hardware — either way, the phone number stays out of it.

Recover

Twelve words rebuild everything; twenty-four rebuild it with a wider margin. The backup counts only after a test restore, and it lives where water, fire, and cloud sync cannot reach.

A nym is not a person in hiding; it is a set of keys that exactly one person can use.

Measure the secret before you trust it: bits first, confidence second.

What a nym actually is

A nym is a bundle of secrets you generate yourself — not a profile you register.

An anonymous online identity does not begin with a signup form. It begins with three artifacts made on your own hardware: a passphrase whose strength you can compute, a second factor that proves you hold a key, and a recovery seed that can rebuild everything after a device dies. None of these artifacts contains your name.

The design rule is separation. The nym's keys, addresses, and recovery material never touch the accounts, phone number, or inbox of the real person. If any secret is shared between the two sets, the nym is a costume rather than an identity.

Everything below is sized in bits of entropy, because bits are the only unit that lets a six-word sentence, a sixteen-character string, and a twelve-word seed be compared on one scale.

The layers, drawn to scale

Each card is one artifact you create yourself; none of them is bought or registered.

When the rules were written

The key terms of this guide, drawn to one scale

The numbers in one place

Common secrets converted to one scale: bits of entropy, or possibilities per window.
Secret	Size	Strength	Defined by
Word passphrase	4 words	about 52 bits	7,776-word list
Word passphrase	5 words	about 65 bits	7,776-word list
Word passphrase	6 words	about 78 bits	7,776-word list
Random password	12 characters	about 79 bits	94 printable ASCII
Random password	16 characters	about 105 bits	94 printable ASCII
Recovery seed	12 words	128 bits + 4-bit checksum	BIP-39
Recovery seed	24 words	256 bits + 8-bit checksum	BIP-39
One-time code	6 digits	1,000,000 codes per 30 s	RFC 6238

Common secrets converted to one scale: bits of entropy, or possibilities per window.

Objections worth answering

Isn't an 8-character password enough?: Eight characters is the floor NIST sets for services, not a target for your master secret. Even eight fully random ASCII characters reach only about 52 bits, and human-picked ones score far lower — which is why the same standard demands screening against breach lists.
Why not just use my phone number for the second factor?: Because a phone number is registered to a real person in most jurisdictions, which welds the nym to your identity. A TOTP secret or a security key proves possession of a key and names nobody.
Can I keep the recovery seed in cloud notes or a password manager?: That turns an offline backup into an online exposure. The seed's checksum catches typos, not theft — anything that syncs is a place the whole nym can be copied from without you noticing.
What if one word of my seed is wrong when I need it?: If the words are numbered, a single bad word can be hunted down: try candidates from the 2,048-word list in that position and let the checksum reject the failures. A 4-bit checksum passes only about 1 wrong sequence in 16, so the search converges fast.