Flip a coin, roll dice, or draw a card physically — then see the wallet those events produce. Nothing here generates randomness on its own — you supply every bit.
Beta software. This tool is experimental and should be used only for testing. Do not rely on it to secure real bitcoin, and never test with funds you cannot afford to lose.
Never enter an existing recovery phrase into any page — including this one, which is why there is nowhere here to do it.
The entire tool is this one self-contained file: no external stylesheet, script, font, or network request. Put it on a USB stick and open it on an air-gapped machine, which is where any sequence worth checking belongs — even a test one.
This self-contained file is running from your disk, not the network. Copy it to a USB stick or an air-gapped machine and it behaves exactly the same. Check it against the published checksum below before you trust anything it shows you.
Running from:
Check that this is the file that was published, rather than whatever happened to arrive:
certutil -hashfile entropy-offline.html SHA256Windows
shasum -a 256 entropy-offline.htmlmacOS, Linux
Compare that against entropy-offline.html.sha256, published beside this page.
Compare that against the published entropy-offline.html.sha256, which sits beside this page on selfcustody.ca. That one line is the only thing you need the network for, and you can fetch it from anywhere.
Set the conversion your device uses, enter your sequence, and compare the words and addresses side by side. If they disagree, try another conversion before blaming the device.
Final word
Updating for the selected ending…
Compare this against your device. If it disagrees, your device may use a different conversion — that is common and does not mean either is broken.
The picture is a LifeHash of the fingerprint’s four bytes — the same icon Sparrow draws for this wallet, so the two can be compared at a glance. Workshop releases before 2026-09-01 hashed the eight characters instead, the lifehash.info convention, and their icons look nothing like these.
mThe root of the tree, and the only key here that reproduces the master fingerprint below. Anything holding it can move every coin this phrase will ever control.
Spends this account and nothing else. It is the level a yprv or zprv exists at, so it is what to match against a device showing one.
On its own it reports its own fingerprint, not the master one — it cannot see that far up. The descriptor below carries the origin and does.
The recovery words as numbers: each word’s place in the BIP39 list, four digits per word, in the order they appear above. SeedSigner and compatible signing devices scan it. The numeric code is a grid — the size of the job if you punch it into metal.
CompactSeedQR encodes the same BIP39 entropy as smaller binary data. SeedSigner, Krux, Jade and Passport support it; use the numeric SeedQR for COLDCARD Q.
Both codes are the phrase in another alphabet, nothing weaker. Anything that reads either one can spend the wallet. If you use a passphrase, enter it separately on the signer after scanning.
Paste an address shown by another wallet. This page checks receive and change indices 0–999 for the account path and address type above, entirely offline.
Checked locally on this page
The public half, and what a watch-only wallet means by your xpub. It derives every address below and signs nothing, so it cannot move coins — but it shows your whole balance and history. Not something to post.
Same key, different version bytes. A wallet showing one and a device showing the other do not disagree.
The account key in the form wallets take directly — Sparrow, Bitcoin Core, most coordinators. Naming the script type is what stops it being imported as the wrong one, the mistake that makes a restored wallet look empty.
<0;1> covers receiving and change together. The eight characters after the # are a checksum, so a mistyped line is caught rather than silently watching the wrong account. No private key; signs nothing.
The <0;1> form comes from BIP389, which is still a draft. Sparrow and current Bitcoin Core read it; older software may not, and will usually say the descriptor is malformed rather than guess. If that happens, import these two instead — receiving first, then change. They describe the same wallet.
Receiving
Change
Two plain-text files for two different jobs. The private one restores and spends; the watch-only one cannot spend, but still reveals the wallet’s addresses and history.
Recovery words, SeedQR digits, fingerprints, paths and private keys. It records whether a BIP39 passphrase was used, but never includes the passphrase value. The wallet.dat holds the same account’s private key and descriptors, in the file format Bitcoin Core opens.
Download:
Account public keys, checked descriptors and the first five addresses on each branch. Safe from spending, not private from balance and history.
Download:
The number your rolls became, before it was written out as words:
A coin gives exactly one bit, so 256 flips are 256 bits and go straight in unchanged. You can check that mapping by hand.
A six-sided die face carries log₂(6) = 2.58 bits, which is not a whole number, so the rolls are hashed with SHA-256 instead and the result used as the entropy. That is what COLDCARD, SeedSigner, Krux and Gordian all do, and it is why 99 rolls is the number you see everywhere.
Three dice at once sidestep the problem rather than solving it. Eight faces is three bits and sixteen is four, so an octal die and two hex dice throw 3 + 4 + 4 = 11 bits together — which is one word index exactly, with no remainder to hash away and no bias to correct. A 24-word seed takes 23 throws of all three dice, then one final octal throw to select among eight checksum-valid endings. A 12-word seed takes 11 three-dice throws, then one octal and one hex die to select among 128 endings. The printed dictionary names every word directly; the six-sided-die method instead needs 99 rolls and calculates a checksum you cannot see.
Cards shorten as you draw them, which no other source here does. The first card is one of 52 and worth log₂(52) = 5.70 bits, the next one of 51, and so on — so a whole deck is 225.6 bits rather than 52 × 5.70, and one deck cannot fill a 24-word seed. Shuffle it and keep drawing. All three conversions above use every card: the two hash modes encode the same draw differently before SHA-256, while the bit-table mode reads the BIP39 tool’s codes, which run two, four or five bits long depending on the card.
There is no standard here. Four of the conversions in use are offered above, and they disagree with each other on purpose: hashing the digits as rolled, hashing them after rewriting every 6 to a 0, reading them as bits without hashing at all, and looking each word up in a table. The same column of rolls produces four unrelated wallets. Others are not offered — BlueWallet packs bits its own way, and SeedSigner used a different method before February 2022 — so a mismatch against all four still does not mean your device is broken.
Which is the point worth leaving with. Your recovery words are the backup. The column of rolls, flips or cards in your notebook is not, because what you wrote down does not say which of these conversions produced the wallet.
The conversion, hashing, encoding and wallet-format code follows the published specifications. Public-key and Taproot curve operations use Bitcoin Core’s libsecp256k1 compiled to WebAssembly. The surrounding code and its library bridge can still be subtly wrong, so on load the page runs published test vectors and refuses to produce anything if they do not pass:
The values come from FIPS 180-4, RFC 4231, BIP380, and the test vectors published in BIP32, BIP39, BIP84 and BIP86. None was produced by running this code.
This page claims that four named devices convert dice four different ways, and refuses to show a wallet unless it agrees with published test vectors. Both are checkable, so here are the published sources and the places where this Workshop adds its own conservative checks.
These open in a new tab, because leaving this one would lose the rolls you have entered. They need a connection, which the tool itself never does.
base 6 (dice) table and the 6-to-0 rewrite before it. Read it with index.js, which chooses between two behaviours: a fixed word count hashes, while raw uses the table and keeps the last whole 32 bits. Same rolls, different wallets, which is why both are offered above.
Inspired by EntropyLab.
The refusal you get when a sequence looks typed rather than rolled is Workshop-specific, not an implementation of the standards above. Its repetition and dominant-value checks address the same health concerns documented by NIST, and its distribution calculation is Pearson chi-square; the period, step-pattern, compression and card-order heuristics, their thresholds and the combined decision are ours. A reproducible seeded exercise refused 0 of 1,000,000 ideal-model simulations across the supported input profiles; run npm run test:entropy -- --calibrate in the source repository to repeat it. That measures false refusals under those models. It cannot validate a physical entropy source or prove that an entered sequence is unpredictable — this remains a spellcheck, not a randomness test.
Part of SelfCustody.ca. The full procedure and the rules that matter more than this tool does are in Roll the dice and Intro to Self Custody. How to read this page itself is in Bring Your Own Entropy.