Three dice, one word: rolling a seed you can read

Rolling a six-sided die ninety-nine times and hashing the result works, but you cannot check it. You hand a column of digits to a machine and it hands back words, and the step in between is SHA-256 — which no one does in their head. There is a version of this where nothing is hidden, and it needs three dice.

The trick is to stop fighting the arithmetic. A recovery word is one of 2048, and 2048 is two to the eleventh, so a word is exactly eleven bits. A six-sided die cannot produce eleven bits neatly because six is not a power of two, which is why every six-sided method ends in a hash. Eight and sixteen are powers of two. An octal die is three bits. A hex die is four. One octal and two hex dice, thrown together, are 3 + 4 + 4 = 11.

One throw of three dice is one word. Not approximately, not after processing — the faces are the word.

If the conversion needs a computer, you are trusting the computer. This one needs a printed page.

1What you need

Three dice: one eight-sided numbered 1 to 8, and two sixteen-sided numbered 0 to F. A printed dictionary that maps the three faces to a word. A pen and a worksheet. A cup to throw them in, so they tumble rather than getting placed. A hard flat surface, and a room with nothing electronic in it.

You also need a signing device — COLDCARD, SeedSigner and Jade all work — but only for the very last step, and not to generate anything. More on why below.

2The throw

Shake all three dice in the cup and tip them out. Put the octal die on the left and the two hex dice beside it. It does not matter which hex die you put in the middle; they are identical and independent, so there is no ordering to preserve. What matters is that once they are in a row you read them left to right and write down all three characters.

That is one word. Look it up in the dictionary and write the word on the worksheet. Then do it again. You need 23 of them.

Not 24 — and that is the part worth understanding rather than just following.

3Why the last word is not yours to choose

A 24-word phrase is not 24 free words. It is 256 bits of secret plus an 8-bit checksum, and 24 × 11 = 264 = 256 + 8. Those eight checksum bits live in the last word, which is why the twenty-fourth word is mostly a verification digit rather than randomness. Your 23 throws are 253 bits. The last word carries the remaining three bits of secret, followed by a checksum computed over everything.

Three bits is eight possibilities. So there are exactly eight words that can legally finish your phrase, and which of the eight you pick is the last of your randomness — the checksum part is then forced.

The same method shortens to a 12-word seed, and the arithmetic there is worth knowing because it is not the same shape: 11 throws are 121 bits against a 128-bit seed, which leaves seven free bits rather than three — 128 valid endings to choose from instead of eight. Bring Your Own Entropy covers that case.

Nobody computes a SHA-256 checksum with a pen. So this is the one step where the device earns its place: you enter your 23 words, it shows you the eight valid endings, and you throw the octal die one last time to choose between them. Faces 1 to 8, options one to eight. The device did not generate anything; it did arithmetic you could not do by hand, in front of you, on a wallet whose entropy you had already fixed.

4The detail that quietly ruins it

The octal die is numbered 1 to 8, not 0 to 7.

This sounds like pedantry and is not. The dictionary is organised in eight blocks of 256 words, and the leading digit selects the block — but as a label, not as a multiplier. Block 1 is the first 256 words, so the dictionary opens at 100 for abandon and ends at 8FF for zoo. Read the die as 0 to 7 and treat the digit as a multiplier, and every word lands 256 places from where it belongs.

Nothing would warn you. The phrase would still be 23 valid words, the device would still offer eight endings, and the wallet would still work perfectly — it would simply be a different wallet than the one your worksheet describes. You would only find out when you tried to restore from the sheet and arrived somewhere empty.

The safeguard costs nothing: use the printed dictionary as the authority and do not do the arithmetic yourself. The codes on the page already account for it.

5Check it before you trust it

The whole appeal of this method is that no step requires trust, so the last thing to do is confirm the words you wrote are the words your dice actually chose. The Entropy Workshop takes the same three-character codes, does the same lookup, and shows you the phrase and the first addresses. Download it and run it offline; it fetches nothing and generates nothing.

If its words match your worksheet, your transcription is clean. If they do not, you have a copying error rather than a broken wallet — which is exactly the sort of thing you want to discover before funding it.

Your recovery words are the backup. The worksheet full of dice codes is a receipt, not a key.

6Is this better than 99 rolls?

It is not more secure. Both give you 256 bits from dice you threw yourself, and neither can be improved on in that respect. What changes is how much you have to take on faith.

Hashing six-sided rolls is opaque, and the opacity has a real cost: as rolling your own entropy covers, wallets disagree about how to do it. Some hash the digits as written, some rewrite every 6 to a 0 first, some read the rolls as bits without hashing at all. The same column of rolls can produce completely unrelated wallets on two honest devices, and your notebook does not record which one you used.

The three-dice method has no such ambiguity, because there is no conversion to disagree about. A printed table says what each throw means. The price is buying two kinds of dice and printing a dictionary; the return is a procedure you can follow, check, and explain to someone else without saying "and then it hashes it".

If you already own six-sided dice and a device that accepts them, that method is fine and this one is not urgent. If you are drawn to this at all, it is probably because you want to see every step — and that instinct is the right one.

Sources

The method, the dice, the worksheet and the printed dictionary are the work of D++ and Keysa's workshop at entropy.page. The explanation above is ours; the procedure is theirs.

• entropy.page — Roll Your Own Seed Phrase — the workshop, and where to get the dice and the printouts.
• The BIP39 dictionary — the lookup table itself, running 100 to 8FF. This is the one to print, and the authority on the codes.
• The slide deck — the procedure step by step, and the arithmetic behind the three dice.
• BIP39 — the standard behind the wordlist and the checksum that fixes the last word.