DIY Seed Generation

Your entire wallet grows from one random number (see Private Keys). Normally you trust a device to pick that number for you. This guide shows you how to pick it yourself, with dice, so the randomness provably comes from your own hands. After a 2026 firmware flaw in a popular commercial signing device turned out to have silently weakened device-generated seeds for five years, this stopped being a paranoid hobby and became plain good practice.

Why Not Trust the Device?

When a wallet generates a seed for you, you are trusting three things: that its random number generator is strong, that its code has no bugs or backdoors, and that the device was not tampered with before it reached you. Any one failure can produce a seed an attacker can guess. Dice remove all three trust assumptions at once. You can see the rolls, you can do the math, and nobody can weaken physics.

What You Need

• Dice. Casino-grade if you can get them; five or ten at a time speeds things up.
• An air-gapped machine that has never touched the internet. A Raspberry Pi Zero 1.3 is ideal since it has no WiFi or Bluetooth at all. A SeedSigner also works, and does most of the math for you.
• Pen and paper for working notes. You will destroy these afterward.
• A metal backup plate for the final seed. Paper burns and fades; metal does not.
• Privacy. No cameras, no phones, no smartwatches, no observers. Treat the session like handling the money itself, because you are.

The Method: 256 Rolls to 24 Words

A 24-word seed encodes 256 bits of entropy, and one die roll gives you one honest bit:

• Roll shows 1, 2, or 3: write down 0.
• Roll shows 4, 5, or 6: write down 1.

Do this 256 times, recording the bits in 23 rows of 11 (a 4-4-3 grouping keeps them readable) plus 3 bits on row 24. Each 11-bit row is a number from 0 to 2047, and each of those numbers maps to one word on the BIP39 word list (2,048 words, in order). Convert each row from binary to decimal, look up the word, and rows 1 through 23 of your seed are done.

This half-and-half mapping is also why dice bias barely matters here: a worn die that favours one face still cannot push a "1, 2, 3 or not" split far from even, and any residual skew is spread across 256 independent rolls.

Writing It Out: Paper and Pencil

Rule a sheet into 24 rows of 11 cells, with small gaps after the fourth and eighth cell so each row reads in a 4-4-3 rhythm that is hard to misread. Fill cells left to right as you roll. Row 24 gets only its first 3 cells; the rest arrive with the checksum.

To turn a finished row into its number (0 to 2047), you have two ways to do the multiplication:

• On paper, with the eleven multipliers. Write the powers of two above the columns: 1024, 512, 256, 128, 64, 32, 16, 8, 4, 2, 1. Every cell showing a 1 is worth its column's multiplier; circle those and add them up.
• On the air-gapped machine. The shell does binary for free: echo $((2#10111000101)) prints the same answer with no arithmetic.

Here is a worked row. The bits 101 1100 0101 light up the 1024, 256, 128, 64, 4, and 1 columns, which sum to 1477, and word 1477 on the BIP39 list is "reward":

One gotcha when you look words up: the BIP39 list counts from 0, but most published copies number their lines from 1. Your number 1477 is line 1478 on a 1-numbered list. Off-by-one here means a valid-looking seed with the wrong words, which is exactly the kind of mistake the verification step below exists to catch.

The Last Word: The Checksum

Word 24 is special. Its 11 bits are your 3 remaining rolled bits plus an 8-bit checksum, which is the first 8 bits of the SHA-256 hash of your 256 bits of entropy. The checksum is what lets any wallet detect a mistyped seed later.

Do not compute this step with improvised shell commands, because hashing the wrong representation of your bits produces the wrong checksum. Use a proper BIP39 tool on your air-gapped machine (the well-known open-source BIP39 page works offline), or let a SeedSigner take your dice rolls and derive the words for you. The point of doing it yourself is that you can also check it yourself: run the tool, confirm word 24, and you have verified the whole chain.

Verify Before You Trust

On the air-gapped machine, enter your 24 words into a wallet like Sparrow. If the wallet accepts the phrase, your checksum and conversions are correct. If it rejects it, recheck row 24 first, then your binary-to-decimal conversions. Nothing is at risk during a rejection; there are no funds involved yet.

Then treat it like any new wallet: stamp the words into metal, burn the paper, and run a full backup verification before the seed ever holds serious money.