<p>Currently, Electrum is more secure than MultiBit as the MultiBit wallets are not encrypted. The next version of MultiBit, version 0.5.9, supports encrypted wallets. (Disclaimer: I am the lead MultiBit dev)</p>

<p>Security in Bitcoin is related to many things. Here are some of them:</p>

<p>1) Is the code open source and do the developers have a track record ?
Both Electrum and MultiBit are open source so you can inspect the code. They have both been developed by pretty much the same people for over a year now.</p>

<p>2) Can you verify that the download you get is the correct one ?
The attack vector here is that an attacker substitutes a trojan instead of the real installer.
The MultiBit installers are all downloaded from a dedicated server via HTTPS and are signed with my PGP key. You can verify this after you download the installer (but before you run it). As long as my private key is not compromised this means only I could have signed it.</p>

<p>I am not exactly sure what Electrum does about signing its builds but I know Thomas (the lead Electrum dev) is very conscious of this area/ attack vector.</p>

<p>3) Are there any servers that can steal your bitcoin ?
MultiBit uses the regular Bitcoin network and they don't have your private keys. Electrum uses (many) of its own custom servers but again these do not have access to your private keys.</p>

<p>4) Both clients are theorectically open to an attack if their network connection is owned and the attacker can feed them completely false information. </p>

<p>5) Both clients (well every client in fact) would be vulnerable to keyloggers capturing passwords which (in combination with the encrypted wallet in MultiBit's case) would give an attacker access to your private keys.</p>

<p>tl;dr At the moment Electrum is more secure. When MultiBit supports encrypted wallets they will be comparable. Good security practices on your machine are also important to keep your bitcoin safe.</p>

CC BY-SA 3.0
2013-04-13T07:20:05.107Z
Thank you for the info. As for the database part, is there any disadvantage to running one of these thin clients, security or otherwise?
cookyjar
CC BY-SA 3.0
2013-04-13T10:35:21.677Z
Because you don't have the complete blockchain you cannot check the transactions so thoroughly. For instance in MultiBit you typically have 4 bitcoind connections and can check that the same transaction has been sent to you by all four. The blocks you can check various things but you are trusting the bitcoind that sent it to you to a certain extent.
jim618
CC BY-SA 3.0
2013-04-13T10:37:36.203Z
Some tasks are more difficult (in MultiBit) because you don't have the blockchain - for instance importing an arbitrary private key. It is better now with bloom filters speeding things up.  Electrum's servers have the whole blockchain so can serve you this data directly.
jim618
CC BY-SA 3.0
2014-03-13T20:45:33.573Z
How's the comparison in 2014. Care to update? Thx!
Gaia
CC BY-SA 3.0
2013-04-12T17:45:42.477Z
2013-04-12T18:46:17.117Z
2013-04-12T18:46:17.117Z
jim618
<p>The only extra danger from using such a client is that by asking the same server about the state of a list of addresses the server can tell that they all belong to the same person.</p>

<p>In that way in reduced privacy to some degree.</p>

CC BY-SA 3.0
2013-05-29T14:45:10.870Z
Not strictly true, a thin client may be tricked into accepting an old state of the ledger as the current state.
cdecker
CC BY-SA 3.0
2013-05-29T07:54:29.787Z
2013-05-29T07:54:29.787Z
HighInBC
<p>How do Electrum and Multibit compare for being safe and secure. Both are open source. Are there any advantages, security wise, to use one or the other?</p>

<p>I'm new to bitcoin and the only reason for considering these thin clients is to not having to maintain a 5gb database file.</p>

CC BY-SA 4.0
2018-10-23T09:40:44.793Z
You can use Electrum Personal Server to have better security.
Janus Troelsen
<security><thin-clients><electrum><multibit>
Are the Thin clients Electrum and Multibit safe and secure?
cookyjar
# Are the Thin clients Electrum and Multibit safe and secure?

(Asked by: username_0 on 2013-04-12)

How do Electrum and Multibit compare for being safe and secure. Both are open source. Are there any advantages, security wise, to use one or the other?

I'm new to bitcoin and the only reason for considering these thin clients is to not having to maintain a 5gb database file.

**Tags:** security, thin-clients, electrum, multibit

> **Comments:**
> **username_1**: You can use Electrum Personal Server to have better security.  

---

## 2 answers

### Answer by username_2 on 2013-04-12. Score: 11

Currently, Electrum is more secure than MultiBit as the MultiBit wallets are not encrypted. The next version of MultiBit, version 0.5.9, supports encrypted wallets. (Disclaimer: I am the lead MultiBit dev)

Security in Bitcoin is related to many things. Here are some of them:

1) Is the code open source and do the developers have a track record ?
Both Electrum and MultiBit are open source so you can inspect the code. They have both been developed by pretty much the same people for over a year now.

2) Can you verify that the download you get is the correct one ?
The attack vector here is that an attacker substitutes a trojan instead of the real installer.
The MultiBit installers are all downloaded from a dedicated server via HTTPS and are signed with my PGP key. You can verify this after you download the installer (but before you run it). As long as my private key is not compromised this means only I could have signed it.

I am not exactly sure what Electrum does about signing its builds but I know Thomas (the lead Electrum dev) is very conscious of this area/ attack vector.

3) Are there any servers that can steal your bitcoin ?
MultiBit uses the regular Bitcoin network and they don't have your private keys. Electrum uses (many) of its own custom servers but again these do not have access to your private keys.

4) Both clients are theorectically open to an attack if their network connection is owned and the attacker can feed them completely false information.

5) Both clients (well every client in fact) would be vulnerable to keyloggers capturing passwords which (in combination with the encrypted wallet in MultiBit's case) would give an attacker access to your private keys.

tl;dr At the moment Electrum is more secure. When MultiBit supports encrypted wallets they will be comparable. Good security practices on your machine are also important to keep your bitcoin safe.

> **Comments:**
> **username_0**: Thank you for the info. As for the database part, is there any disadvantage to running one of these thin clients, security or otherwise?  
> **username_2**: Because you don't have the complete blockchain you cannot check the transactions so thoroughly. For instance in MultiBit you typically have 4 bitcoind connections and can check that the same transaction has been sent to you by all four. The blocks you can check various things but you are trusting the bitcoind that sent it to you to a certain extent.  
> **username_2**: Some tasks are more difficult (in MultiBit) because you don't have the blockchain - for instance importing an arbitrary private key. It is better now with bloom filters speeding things up.  Electrum's servers have the whole blockchain so can serve you this data directly.  
> **username_3**: How's the comparison in 2014. Care to update? Thx!  

---

### Answer by username_4 on 2013-05-29. Score: 1

The only extra danger from using such a client is that by asking the same server about the state of a list of addresses the server can tell that they all belong to the same person.

In that way in reduced privacy to some degree.

> **Comments:**
> **username_5**: Not strictly true, a thin client may be tricked into accepting an old state of the ledger as the current state.  

---

