The IOTA java script library's getNewAddress function has a security parameter which can take the values 1, 2, or 3. Each value will generate a different address with the same seed - what's the difference?

What makes the address using security level 3 more secure than using 1? Why not always use 3 if it's more secure?

2 Answers 2


The security level affects two things:

  • How hard it is to brute force a signature for a key (or how hard it is to brute force a message that a given signature can be used to sign). This is mostly relevant if some parts of the key have already leaked (e.g. because of address reuse) or if you have a particularly powerful adversary (against normal advisories, every security level should be secure enough)

  • How big the actual signatures are. Level 3 signatures will need 3 transactions' space, so in a typical bundle you will have to add 2 extra transactions to store the other 2 parts of the signature. Therefore using Level 3 signatures requires more PoW and sending more transactions when spending from such an address.


"A security level determines the number of rounds for hashing, which means that a single seed can have 3 different accounts." Source: https://domschiener.gitbooks.io/iota-guide/content/chapter1/seeds-private-keys-and-addresses.html

Of course it is more secure to use security level 3 and it is also advised: "Only use 243-trits (level: 3 - quantum proof) security for addresses" (https://domschiener.gitbooks.io/iota-guide/content/exchange-guidelines/important-principles.html)

I hope this helps answering your questions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.