magic-wormhole uses a 256-word list, so the two-word default provides 16 bits of entropy. But the code goes into PAKE, not a symmetric encryption key, so an att

magic-wormhole uses a 256-word list, so the two-word default provides 16 bits of entropy. But the code goes into PAKE, not a symmetric encryption key, so an attacker only gets one shot to guess it (it's an interactive protocol, so they must commit to their guess in the first message, and don't discover whether they're correct or not until the second message). It's basically spending interactivity (and single-use-ness) to buy adequate security for a short secret. Magic-wormhole is not useful for encrypting long-term data-at-rest (because the sender needs to stick around to perform the key-exchange protocol with the receiver), nor is it useful for encrypting data to multiple parties (because the code is single-use). But it's great for getting a single file to a single person, or to establish a full-strength session key for continued use later.