Roll the dice: generating your own entropy

Every bitcoin wallet is built on one enormous random number. Your twelve or twenty-four recovery words are just that number, written in a form a human can copy down. Everything else — every address, every signature, every coin you will ever hold — grows out of it.

Normally your device picks that number for you, in a fraction of a second, using a random number generator sealed inside a chip. It almost certainly does this well. But you cannot watch it happen, you cannot check it afterwards, and you have no way of knowing whether the chip is doing what it claims. You are taking it on faith.

Rolling dice removes the faith. You generate the randomness yourself, on a table, in front of your own eyes, and hand it to the device already made. Nothing about the chip's honesty matters any more, because you did the one part that had to be secret.

It costs you about twenty minutes and a little care. Here is how it works, and — more importantly — the handful of ways people accidentally ruin it.

Why dice, and not one of the other ways

Dice are not the best method available. It is worth being straight about that, because the case for them is more interesting than the usual one.

There are six practical ways to produce the number, and they separate along three lines: what you have to get hold of before you can begin, how much work the method itself demands, and how much of the finished result you are able to check. Every method is excellent on one of those and pays for it on another.

Six ways to make the number

What each one costs you

No row wins outright

nothing to pay herea small costa real costwhere the method gives up the most

MethodBefore you startThe work itselfWhat you can check

The device makes the number

Built-in generatorthe default almost everywhere

Before you startNothing to gatherThe work itselfInstant, automaticWhat you can checkThe input, not at all

Camera noiseSeedSigner photographs a scene

Before you startNothing to gatherThe work itselfPoint, look, acceptWhat you can checkNothing outside the device

You make the number, the device converts it

Dice, device convertswhat this guide covers

Before you startOne dieThe work itself99 rolls, typed inWhat you can checkEvery word, with effort

You make the number and the words

Coin flips11 flips per word

Before you startCoins and a word listThe work itselfBinary, by hand, 253 timesWhat you can checkOnly the checksum word

Dice on a worksheetrolls straight to words

Before you startDice and a worksheetThe work itselfRolls, re-rolls, lookupsWhat you can checkOnly the checksum word

Drawing paper slipspull words from a bag

Before you startCut out 2048 slipsThe work itselfDraw, replace, type inWhat you can checkOnly the checksum word

The top two rows ask nothing of you at all — no equipment, no procedure, nothing to get wrong. What you give up is the ability to check the input. A generator sealed in a chip produces a number you cannot observe, reproduce, or test, and a photograph of your kitchen has no external record to compare against either. If you are content to trust the manufacturer's engineering, this is the sensible choice and there is no shame in it.

The bottom three go the other way. You do the conversion yourself, on paper, so the device never touches your randomness — it only computes the final checksum word. That is about as little trust as this task can be reduced to. The price is either in setup or in labour: 253 coin flips converted from binary by hand, or a worksheet of rolls and re-rolls, or an evening spent cutting out two thousand and forty-eight paper slips before you have generated a single word.

Dice with the device doing the conversion sits in the middle and is never the winner of anything. It needs a die you probably already own, it takes twenty minutes of dull rolling, and the conversion happens somewhere you cannot see. But nothing about it is bad. It is the only one of the six with no expensive corner — and unlike the top two, the part you cannot see is at least checkable afterwards, which is what the section on verifying the conversion further down is for.

That is the honest argument for the method in this guide: not that it beats the alternatives, but that it is the only one that never asks you for very much.

How many times do I roll?

Each roll of a six-sided die adds a fixed amount of randomness, so the number of rolls is not something you can negotiate with. The two counts that matter:

• 50 rolls makes a 12-word wallet.
• 99 rolls makes a 24-word wallet.
• Some wallets ask for more — around 154 for 24 words — because they do the arithmetic a less efficient way. Follow whatever number your device asks for.

Ninety-nine rolls is a genuine sitting. It takes most people fifteen or twenty minutes to roll and record carefully, and that is the correct pace. Stopping at eighty because your hand is tired does not make the wallet slightly weaker — it removes a chunk of the protection you sat down to build, and nothing on the screen will warn you that it happened.

The rule everyone is tempted to break

At some point the die will do something that feels wrong. Four sixes in a row. The same number five times. A run that looks so obviously not random that the temptation to roll it again is almost physical.

Do not roll it again. Write it down.

The same applies to helping the randomness along. Rolling 1, 2, 3, 4, 5, 6 in sequence over and over would sail past the safety checks on most devices — they count how often each face appeared, not what order it came in — and would produce a wallet that could be guessed in moments. Those checks exist to catch a die that has come to rest in a crack, not a person being creative.

Record every roll, in order, as it happens. Read the die from directly above rather than at an angle. Use one die and roll it repeatedly rather than throwing a handful and reading them together, because reading five dice at once is how numbers get transposed.

Close-up of a hardware wallet screen partway through dice entry, showing the roll counter (e.g. "47 / 99") and the digits entered so far.

Image to come

Are my dice good enough?

This is the question people worry about most, and it is the one that matters least.

Real dice are never perfectly even. People have actually measured this properly — a 1971 Psychometrika study rolling dice a few million times found even faces turning up about 1.4% more often than they should, and a 2009 automated re-run of a classic 1894 dice experiment, published in CHANCE, found a comparable 1.3% bias. Cheap moulded dice are worse than casino dice with sharp square edges.

The effect on your wallet is almost nothing. Below is what happens to the randomness as the die gets progressively worse, starting from a perfect one and ending at a die so skewed you would notice it across the room.

Bias stress test

How much randomness survives?

99 rolls keep a wide margin

24 words · 99 rolls 12 words · 50 rolls Security thresholds

Die fairness 24 words 99 rolls 12 words 50 rolls

A perfectly fair die 255.9bits 128.0bits

A cheap die, 2% bias 253.1bits 127.8bits

One face 8% high 244.9bits 123.7bits

One face 20% high 229.9bits 116.1bits

One face 50% high 198.0bits 100.0bits

Read the orange bars first. A 24-word wallet begins with a colossal surplus and keeps it: even the deliberately absurd final case leaves it far above the line that counts. You could roll with a genuinely bad die and still end up with a wallet nobody is guessing.

Now read the green bars. A 12-word wallet starts level with the 128-bit mark and has nowhere to go but down. By the last case it has fallen through both thresholds.

That comparison is the practical argument for rolling 99 times instead of 50. If you are going to the trouble of doing this by hand, the extra forty-nine rolls buy you a margin so large that the fairness of your dice stops being a question worth asking.

Do not try to correct for bias by discarding rolls you dislike. That does far more damage than any real die ever would.

Your rolls are not a backup

Here is the part that catches people out, and it is worth reading twice.

There is no agreed standard for turning dice rolls into wallet words. Different wallets do the conversion differently — Keith Mukai's survey of seventeen implementations finds five distinct methods in circulation, and three wallets sharing one of them still disagree with each other — which means the same 99 rolls will produce a completely different wallet on a different device.

It is not even stable over time on one device. SeedSigner changed its method in 2022, so rolls recorded before that no longer rebuild the same wallet on current firmware.

So: your recovery words are the backup. Write them down carefully, exactly as the device shows them, in order. The column of dice rolls in your notebook is working paper, not a safety net — destroy it once the words are recorded and confirmed, and never file it away imagining it could rebuild the wallet later. It cannot.

Why the last word is not really yours

You may notice that the final word of your phrase seems fixed, or that the device has to work it out for you rather than letting you pick. That is normal and it is not the dice being ignored.

The last word is mostly a checksum — a small built-in error check, calculated from all the words before it. It is quietly one of the most useful things in the whole design: if you copy a word down wrong, the phrase gets rejected when you try to restore it, instead of silently opening a different, empty wallet and leaving you to work out what happened.

Checking that your device did what it said

It is possible to verify that a device converts rolls the way it claims. You roll a short test set, run the same rolls through an independent tool, and see whether you get the same words out. If they match, the device is honest about its method.

This is a genuinely advanced exercise, and it carries one rule with no exceptions.

• Only ever do this with a test sequence, on a wallet holding nothing that you wipe afterwards. Never with the rolls behind a wallet you use.
• Never type the rolls or the words of a real wallet into anything except the device itself — not a website, not an offline copy of one, not a notes app, not a spreadsheet.
• Anything that asks you to enter an existing recovery phrase to "verify" or "validate" it is stealing from you, however official it looks.

Finishing up

The dice were the interesting part. They are not the part that keeps your bitcoin safe — the ordinary, boring steps are, and they are the same ones as for any other wallet.

• Write the recovery words on paper or metal, in order, offline. Never photograph them.
• Restore the wallet onto a wiped device, or run your device's own backup check, before sending it anything.
• Send a small test amount first and confirm it arrives.
• Note which device and firmware version you used, since the dice method belongs to that version.

Read the habits that undo all of this

Method comparison, cross-device warning, and verification steps after Keith Mukai’s Dice to seed . Dice-bias figures from Iversen, Longcor, Mosteller, Gilbert & Youtz, Psychometrika 36(1), 1971, and Labby, CHANCE 22(4), 2009.