How to Generate a BIP39 Seed Phrase with Dice, Step by Step

To generate a BIP39 seed phrase with dice, roll a fair six-sided die at least 50 times for a 12-word phrase or 99 times for a 24-word phrase, turn the rolls into bits, and finish with a last word that carries the checksum. Each roll adds log₂ 6 ≈ 2.585 bits of entropy, so 50 rolls cover the 128 bits behind 12 words. A signing device such as Coldcard, SeedSigner or Krux can turn the rolls into words for you; without one, you can build each word by hand from 11 even-or-odd rolls and pick the last one with the BIP39 last word calculator. Either way, the randomness comes from the die, not from a chip you have to trust or from your own taste in words.

Dice Rolls at a Glance

Why Roll Dice Instead of Trusting the Wallet’s Generator?

A wallet makes a seed phrase from its random number generator, and you cannot see whether that generator works. Usually it does, but the failures are documented:

• Coldcard, 2021 to 2026. In July 2026 Coinkite disclosed that since a March 2021 firmware change, its Coldcard devices had drawn seeds from MicroPython’s general-purpose software generator instead of their hardware random number generator. It put the effective search space at about 40 bits for the Mk2 and Mk3 and about 72 bits for the Mk4, Mk5 and Q, instead of 128, and attackers regenerated the weak keys offline and stole funds. Coinkite does not consider seeds created with at least 50 fair, independent, private dice rolls at risk from the flaw alone.
• Libbitcoin Explorer, 2023. The bx seed command in versions 3.0.0 to 3.6.0 seeded a Mersenne Twister generator with 32 bits of clock time, so there were at most about 4.29 billion possible seeds, and attackers swept around 29.65 BTC on 12 July 2023 (Milk Sad disclosure).

Dice take the device’s generator out of the picture. The price is time and new ways to make mistakes, covered below. For most people a reputable wallet’s generator is still the practical choice: even for the replacement seeds after its flaw, Coinkite calls dice optional and the fixed firmware’s own seed sufficient. Why a properly generated phrase is beyond brute force is worked out in can you guess a seed phrase.

How Many Dice Rolls Do You Need?

A fair die has six equally likely faces, so a roll carries log₂ 6 ≈ 2.585 bits. Divide the entropy of the phrase by that and round up:

Forty-nine rolls give only 126.7 bits, so 50 is the minimum for 12 words. For 24 words the exact answer is 99.03: 99 rolls fall a tenth of a bit short of 256, which makes no practical difference, and Coldcard, SeedSigner and Krux all ask for 99. Coldcard and Krux accept extra rolls, so a 100th is a free margin.

Coins and other dice work too. A coin flip carries exactly 1 bit, so 12 words need 128 flips. A twenty-sided die carries log₂ 20 ≈ 4.32 bits, and Krux asks for 30 rolls for 12 words and 60 for 24.

Extra rolls never hurt; too few always do, and the hashing method below hides the shortfall. Twenty rolls turn into a random-looking 256-bit value, but an attacker only has to try 6²⁰ roll sequences, about 52 bits.

Method 1: Let a Signing Device Hash the Rolls

The quickest way is a hardware signing device that accepts dice rolls:

• Coldcard: New Seed Words > Advanced > 12 Word Dice Roll or 24 Word Dice Roll. The device warns that no hardware-generated randomness will be mixed in.
• SeedSigner: Tools > New seed (the option with the dice icon), then 12 words (50 rolls) or 24 words (99 rolls).
• Krux: a six-sided (D6) or twenty-sided (D20) mode, with a progress bar for the minimum number of rolls and an entropy estimate.

You enter each roll as it lands. All three then compute SHA-256 over the rolls, written out as text exactly as entered, and use the hash as entropy: all 256 bits for 24 words, the first 128 bits for 12. The formula is public (Coldcard, SeedSigner, Krux), so the same rolls give the same words on all three, and Krux’s documentation says so explicitly. The whole calculation fits in a few lines of Python:

import hashlib

rolls = "123456"  # the example from Coldcard's documentation; a real phrase needs 50 or 99 rolls
digest = hashlib.sha256(rolls.encode("ascii")).hexdigest()
print(digest[:32])  # entropy for 12 words: the first 128 bits
print(digest)       # entropy for 24 words: all 256 bits

For “123456” the hash begins 8d969eef, as in Coldcard’s documentation. The visualizer on How BIP39 works takes those 32 or 64 hex characters and shows the checksum, the 11-bit groups and the words.

Not every tool reads the rolls the same way. SeedSigner’s documentation notes that the “Dice [1-6]” mode of Ian Coleman’s BIP39 page replaces every 6 with a 0 and so gives different words, and tells users to pick that page’s “Base 10” or “Hex” mode instead. To cross-check a device, use a tool with the same formula.

Coldcard can also mix the rolls into its own random value instead of using them alone. In that mode you choose New Seed Words and a length, then add dice rolls or coin flips. Neither the chip nor the die then decides the seed by itself, but the rolls alone no longer reproduce it: to check the result, you record the device’s own value, shown as 24 “TRNG words”, and run Coinkite’s verify_seed_mix.py script.

Method 2: Build Each Word by Hand From 11 Rolls

Without such a device, you can turn the rolls into words yourself. Each BIP39 word stands for an 11-bit number from 0 to 2047, its position in the BIP39 word list, so all you need is a fair way to make bits:

• Even or odd. Roll once per bit: 2, 4 or 6 is a 0, and 1, 3 or 5 is a 1. A coin works the same way, heads for 1 and tails for 0. Each roll gives 1 bit, so 12 words take 128 rolls.
• Two bits when you can. Read 1 as 00, 2 as 01, 3 as 10, 4 as 11, 5 as 0 and 6 as 1. Every bit stays fair, and you average about 1.67 bits per roll, so 128 bits take about 77 rolls.

Then:

1. Write the bits in one row, in the order you rolled them, and cut the row into groups of 11. The first 11 words of a 12-word phrase take 121 bits, the first 23 words of a 24-word phrase 253. Keep the next 7 bits (3 for 24 words) for the last word.
2. Turn each group into a number. Under each 1, write its place value, from 1024 on the left down to 1 on the right, and add them up.
3. Look up the word. Number 0 is abandon and 2047 is zoo. The word list on this site counts from 1 by default, so add 1, or switch its Numbering to 0–2047. With Binary (11 bits) selected, you can type the 11 bits into the search box and skip the arithmetic.
4. Finish with the last word, as described below.

Here is the first word of another official test vector, 7f7f7f7f… (legal winner thank year wave sausage worth useful legal winner thank yellow, public like all test vectors), made from 11 even-or-odd rolls:

512 + 256 + 128 + 64 + 32 + 16 + 8 + 2 + 1 = 1019, and word 1019 (number 1020 when counting from 1) is legal.

Never add dice together: with two dice, a total of 7 comes up six times as often as 2 or 12. Read every die on its own.

Worked Example: The Official Test Vector, Step by Step

The simplest official BIP39 test vector has 128 zero bits of entropy, 00000000000000000000000000000000 in hex, and the phrase “abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about”. It is published with the reference test vectors, so never send funds to it, but zeros are easy to follow by hand. Suppose all 128 of your even-or-odd rolls came up even:

1. The first 121 bits are 0. Cut into eleven groups of 11, each group is 00000000000 = 0, and word 0 is abandon, so the first eleven words are abandon, eleven times.
2. Enter them in the calculator. After eleven times abandon, the last word calculator lists the 128 words that complete a valid phrase.
3. Let the last 7 bits choose. They are 0000000 = 0, so take candidate 0, the first in the list: about.
4. See why it is about. The BIP39 specification takes the first ENT/32 bits of the entropy’s SHA-256 hash as the checksum, 4 bits for 128 bits of entropy. SHA-256 of 16 zero bytes begins with 0x37, binary 0011 0111, so the checksum is 0011. The last word is the 7 free bits followed by the checksum, 0000000 0011 = 3, and word 3 is about, after abandon, ability and able.
5. Check it. On How BIP39 works, the Official test vector button shows the same bits, hash and words, and the BIP39 checksum checker reports the phrase as valid.

The 24-word version works the same way. 253 zero bits give abandon twenty-three times, and the last word is 3 zero bits followed by an 8-bit checksum, 0110 0110, because SHA-256 of 32 zero bytes begins with 0x66. That makes 102, the word art.

How to Choose the Last Word at Random

The last word holds the rest of your entropy and the checksum: 7 random bits and 4 checksum bits in a 12-word phrase, 3 and 8 in a 24-word one. The checksum needs SHA-256, which nobody computes by hand, so a tool finds the candidates and the dice choose among them:

1. Enter the first 11 words (or 23) in the BIP39 last word calculator. It lists every word that gives a valid checksum, in list order: 128 after 11 words, 8 after 23.
2. Make 7 more bits (3 for 24 words) and read them as a binary number from 0 to 127 (0 to 7).
3. Count to that position in the candidate list, starting from 0. The small numbers next to the words are their places in the full list, not their positions among the candidates.

In list order the candidates differ in exactly those free bits, so this keeps the full 128 or 256 bits. Picking the word you like best wastes some of them, and so does always taking the first one. SeedSigner has the same step built in as Calc 12th/24th word, with options to enter coin flips or to fill the free bits with zeros; zeros cost 7 bits and leave 121 for a 12-word phrase.

How to Check the Finished Phrase

• The checksum. Paste the phrase into the BIP39 checksum checker. A valid result confirms that every word is on the list and the last one fits the rest; it says nothing about how random the words are.
• Each step. If you built the words by hand, write your 128 bits as 32 hex digits (each group of 4 bits is one digit from 0 to f) and enter them in the visualizer on How BIP39 works: its groups and words must match yours.
• A second device. For Method 1, enter the same rolls in another tool that uses the same SHA-256 formula; the words must match.
• A real restore. Restore the phrase in the wallet you will use and note the first receiving address, then, before sending funds, restore once more from your written copy: the same address means the backup is right. The restore guide shows which lengths popular wallets accept. Some take only 12 words, Exodus among them, as 12 vs 24 words explains.

Common Mistakes When Rolling a Seed Phrase

• A biased die. Use a die with sharp edges and flush pips, such as a casino die, which is built to stay balanced; game dice have rounded corners and recessed pips. A slight bias costs little: a die that shows 6 one time in five still gives 2.58 bits per roll, about 129 bits in 50 rolls. A strong bias shows in the counts. Coldcard’s firmware rejects a dice-only seed if any number makes up more than 30% of the rolls, and Krux shows an entropy estimate to flag suspicious rolls.
• Skipped or “corrected” rolls. Record every roll as it lands. Re-rolling whenever a number repeats the one before leaves 5 outcomes per roll instead of 6, and 50 rolls then carry about 116 bits, not 129. Coldcard’s instructions are to roll again before every entry, enter only the result shown and reroll unclear or cocked rolls.
• Too few rolls. The hash looks the same whether it came from 20 rolls or 99.
• An app or a computer instead of a die. A dice app brings back a software generator, the thing you set out to avoid; Coldcard tells users not to make up rolls or use an app or computer.
• Notes left behind. The rolls, the bits and the word numbers are your phrase in another form, and anyone with the full sequence can rebuild the wallet. Once the phrase is written down and checked, destroy the worksheets or store them as carefully as the phrase, and don’t photograph them or type them into a phone. Roll where no one, and no camera, can see the table: Coldcard asks users to keep the hash it shows while rolling hidden from people and cameras.
• A last word chosen by taste. It throws away up to 7 bits; let the dice choose, as above.

Once the phrase is done, store it like any other: on paper or metal, offline, in a place you control. How to store a seed phrase compares the options.

Rolling Dice vs Making Up Words

Rolling dice and making up words both take the choice away from the wallet, but only dice keep the randomness. A die has no idea which words are memorable. A person picks words that mean something, follow grammar and come from a few hundred familiar ones, and attackers try exactly those first. BIP39 itself says it is not a way to process user-created sentences into a wallet seed, and the brain wallets people built from phrases they invented were nearly all drained, usually within a day. The last word calculator can make any 11 words valid, but it cannot make them random: if you chose the first 11 yourself, the phrase is still a made-up phrase. The full case, with the documented cracks, is in why you should never create your own seed phrase.

Frequently Asked Questions

Is a phrase made with dice safer than one from a hardware wallet?

Not automatically. Dice remove one thing you have to trust, the device’s random number generator, and add room for human error. Some devices combine sources instead: Trezor mixes its hardware randomness with randomness from the computer or phone, and Coldcard can mix dice into its own value. Either way, a phrase protects nothing if it is stored badly.

Can I use dice with a Trezor or Ledger?

Not to generate the phrase. Ledger devices generate it with a random number generator inside the secure element, and in August 2026 Trezor said it was considering support for user-supplied entropy but could not commit to it yet. Both can restore a phrase you made with dice, as long as they accept its length.

Can I use a coin or a different die?

Yes, if every outcome is equally likely. A coin gives 1 bit per flip and a twenty-sided die about 4.32 bits per roll. For the hand method, dice with 4, 8 or 16 sides are the easiest, because each roll is exactly 2, 3 or 4 bits.

Do I need to keep the dice rolls?

No. Once the words are written down and checked, the rolls only add risk: destroy them, or keep them as safely as the phrase.

Can dice pick my BIP39 passphrase too?

Yes. For passwords and passphrases, Trezor’s guide describes rolling physical dice to select words from a standardized word list, so that the dice provide the randomness rather than your brain. A BIP39 passphrase changes the whole wallet, so back it up separately from the words.

Can I draw words from a hat instead?

Yes, if the draw is fair. Foundation’s Passport documentation describes putting all 2048 words into a container, drawing one at a time and putting it back before the next draw, 11 times for a 12-word phrase or 23 times for 24 words; the device then calculates the final word. It is the same idea as dice, with more paper.