Roll the dice: generating your own entropy

Every bitcoin wallet is built on one enormous random number. Your twelve or twenty-four recovery words are just that number, written in a form a human can copy down. Everything else — every address, every signature, every coin you will ever hold — grows out of it.

Normally your device picks that number for you, in a fraction of a second, using a random number generator sealed inside a chip. It almost certainly does this well. But you cannot watch it happen, you cannot check it afterwards, and you have no way of knowing whether the chip is doing what it claims. You are taking it on faith.

Rolling dice removes the faith. You generate the randomness yourself, on a table, in front of your own eyes, and hand it to the device already made. Nothing about the chip's honesty matters any more, because you did the one part that had to be secret.

It costs you about twenty minutes and a little care. Here is how it works, and — more importantly — the handful of ways people accidentally ruin it.

Overhead shot: a single white casino die mid-roll on a dark surface, with a notebook and pen beside it showing a column of handwritten numbers.

Image to come

How many times do I roll?

Each roll of a six-sided die adds a fixed amount of randomness, so the number of rolls is not something you can negotiate with. The two counts that matter:

• 50 rolls makes a 12-word wallet.
• 99 rolls makes a 24-word wallet.
• Some wallets ask for more — around 154 for 24 words — because they do the arithmetic a less efficient way. Follow whatever number your device asks for.

Ninety-nine rolls is a genuine sitting. It takes most people fifteen or twenty minutes to roll and record carefully, and that is the correct pace. Stopping at eighty because your hand is tired does not make the wallet slightly weaker — it removes a chunk of the protection you sat down to build, and nothing on the screen will warn you that it happened.

The rule everyone is tempted to break

At some point the die will do something that feels wrong. Four sixes in a row. The same number five times. A run that looks so obviously not random that the temptation to roll it again is almost physical.

Do not roll it again. Write it down.

The same applies to helping the randomness along. Rolling 1, 2, 3, 4, 5, 6 in sequence over and over would sail past the safety checks on most devices — they count how often each face appeared, not what order it came in — and would produce a wallet that could be guessed in moments. Those checks exist to catch a die that has come to rest in a crack, not a person being creative.

Record every roll, in order, as it happens. Read the die from directly above rather than at an angle. Use one die and roll it repeatedly rather than throwing a handful and reading them together, because reading five dice at once is how numbers get transposed.

Close-up of a hardware wallet screen partway through dice entry, showing the roll counter (e.g. "47 / 99") and the digits entered so far.

Image to come

Are my dice good enough?

This is the question people worry about most, and it is the one that matters least.

Real dice are never perfectly even. People have actually measured this properly — studies rolling dice hundreds of thousands of times have found individual faces turning up around 1.3% to 1.4% more often than they should. Cheap moulded dice are worse than casino dice with sharp square edges.

The effect on your wallet is almost nothing. Below is what happens to the randomness as the die gets progressively worse, starting from a perfect one and ending at a die so skewed you would notice it across the room.

24 words · 99 rolls 12 words · 50 rolls Security thresholds

Bits of randomness by die fairness

Die	24 words (99 rolls)	12 words (50 rolls)
A perfectly fair die	255.9	128.0
A cheap die, 2% bias	253.1	127.8
One face 8% high	244.9	123.7
One face 20% high	229.9	116.1
One face 50% high	198.0	100.0

Read the orange bars first. A 24-word wallet begins with a colossal surplus and keeps it: even the deliberately absurd final case leaves it far above the line that counts. You could roll with a genuinely bad die and still end up with a wallet nobody is guessing.

Now read the green bars. A 12-word wallet starts level with the 128-bit mark and has nowhere to go but down. By the last case it has fallen through both thresholds.

That comparison is the practical argument for rolling 99 times instead of 50. If you are going to the trouble of doing this by hand, the extra forty-nine rolls buy you a margin so large that the fairness of your dice stops being a question worth asking.

Do not try to correct for bias by discarding rolls you dislike. That does far more damage than any real die ever would.

Your rolls are not a backup

Here is the part that catches people out, and it is worth reading twice.

There is no agreed standard for turning dice rolls into wallet words. Different wallets do the conversion differently — there are at least five methods in circulation — which means the same 99 rolls will produce a completely different wallet on a different device.

It is not even stable over time on one device. SeedSigner changed its method in 2022, so rolls recorded before that no longer rebuild the same wallet on current firmware.

So: your recovery words are the backup. Write them down carefully, exactly as the device shows them, in order. The column of dice rolls in your notebook is working paper, not a safety net — destroy it once the words are recorded and confirmed, and never file it away imagining it could rebuild the wallet later. It cannot.

Why the last word is not really yours

You may notice that the final word of your phrase seems fixed, or that the device has to work it out for you rather than letting you pick. That is normal and it is not the dice being ignored.

The last word is mostly a checksum — a small built-in error check, calculated from all the words before it. It is quietly one of the most useful things in the whole design: if you copy a word down wrong, the phrase gets rejected when you try to restore it, instead of silently opening a different, empty wallet and leaving you to work out what happened.

Checking that your device did what it said

It is possible to verify that a device converts rolls the way it claims. You roll a short test set, run the same rolls through an independent tool, and see whether you get the same words out. If they match, the device is honest about its method.

This is a genuinely advanced exercise, and it carries one rule with no exceptions.

• Only ever do this with throwaway test rolls, on a wallet holding nothing, which you wipe afterwards.
• Never type the rolls or the words of a real wallet into anything except the device itself — not a website, not an offline copy of one, not a notes app, not a spreadsheet.
• Anything that asks you to enter an existing recovery phrase to "verify" or "validate" it is stealing from you, however official it looks.

Finishing up

The dice were the interesting part. They are not the part that keeps your bitcoin safe — the ordinary, boring steps are, and they are the same ones as for any other wallet.

• Write the recovery words on paper or metal, in order, offline. Never photograph them.
• Restore the wallet onto a wiped device, or run your device's own backup check, before sending it anything.
• Send a small test amount first and confirm it arrives.
• Note which device and firmware version you used, since the dice method belongs to that version.

Read the habits that undo all of this

Roll counts, the differences between wallets, and the dice-fairness figures charted above are drawn from an AI-assisted analysis of dice entropy across wallet implementations published alongside SeedSigner's own dice research. Devices change between firmware releases — check the roll count and method in your own device's current documentation before creating a wallet you intend to fund.