r/Bitcoin: generating seeds with physical dice after losing trust in RNGs
reddit-dice-seed-generation
https://www.reddit.com/r/Bitcoin/comments/1vdl4h3/generating_your_own_seed_with_physical_dice_99/
Latest reviewed change
source content difference between and
The Reddit thread gained a new participant comment comparing the cost of dice to annual banking losses.
Actually the opposite is true. Casino dice, if not carefully chosen, may be intentionally made to be biased for some very obvious purposes. In the future if a hacker know that some one is using these kind of casino dicss to generate the seed phrase that will also greatly reduce the entropy of seed phrase. Casino dices may not even be as good as a regular dices.
"Always being unpredictable" is the way to go. If you are gonna use dice, go ahead, but don't tell others that you use which brand of dice.
+
+comment: p2dqket
+parent: t1_p1bniq6
+author: WeekendQuant
+created_utc: 1786152914
First lines only. The complete diff is in the timeline below.
- Organisation
- Evidence role
- Community discussion
- Published
- not established
- Source changes
- 4
- Detected differences
- 4
- Unreviewed
- 0
- Copies held
- 5
Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .
This post is held twice: here, with this project's own note on why it matters, and again as part of the conversation captured at , which is polled for changes. Both copies are the same post; neither is a separate event.
Snapshot and diff bodies for this chain monitor are held in the local evidence archive but withheld from the public site because they can contain the addresses of people who published nothing themselves. Capture times and reviewed change summaries remain available below.
Held captures
-
The Reddit thread gained a new participant comment comparing the cost of dice to annual banking losses.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 8 lines
Actually the opposite is true. Casino dice, if not carefully chosen, may be intentionally made to be biased for some very obvious purposes. In the future if a hacker know that some one is using these kind of casino dicss to generate the seed phrase that will also greatly reduce the entropy of seed phrase. Casino dices may not even be as good as a regular dices. "Always being unpredictable" is the way to go. If you are gonna use dice, go ahead, but don't tell others that you use which brand of dice. + +comment: p2dqket +parent: t1_p1bniq6 +author: WeekendQuant +created_utc: 1786152914 +edited: false +body: +Huh? $30 for two dice is nothing compared to what I lose in $ each year to the banking system.Extracted text as captured
post: 1vdl4h3 author: Proof-Professor-1030 created_utc: 1785684836 title: Generating your own seed with physical dice: 99 rolls ≈ 256 bits of entropy (why I stopped trusting RNGs for cold storage) body: Something that finally clicked for me after years in Bitcoin: when your hardware wallet generates a seed, you're trusting its RNG and its firmware with literally everything. For most people that's a reasonable trust tradeoff. But you don't have to make it. You can generate a BIP39 seed entirely from physical dice: **- 99 rolls of a standard 6-sided die ≈ 256 bits of entropy → a 24-word seed.** **- 50 rolls ≈ 128 bits → a 12-word seed.** The math: each roll gives you log2(6) ≈ 2.585 bits. 99 × 2.585 ≈ 256. BIP39 adds a checksum on top, which is where the last word comes from — you compute it once, offline, or let an air-gapped device like a SeedSigner derive it. Why bother? 1. **You control the entropy source.** Dice have no firmware, no supply chain, no update mechanism. You can audit them by rolling a few hundred times and checking the distribution. 2. **The seed is born offline.** It's generated on paper, in a room with no cameras, and only ever touches an air-gapped device after that. Tampered-device and bad-RNG concerns just evaporate. 3. **It forces you to understand what a seed actually is** — a big number, not a magical artifact of your wallet brand. That understanding changes how you think about backups, passphrases and multisig. I wrote up the full procedure (including how to compute the checksum, common mistakes like reusing dice patterns, and how to verify the result on an air-gapped device) as part of a free self-custody guide: [https://self-custody.cc/](https://self-custody.cc/) — the Dice Seeds section. No ads, nothing for sale, EN/DE/ES. Curious who else here has done dice-generated seeds and whether you went 12 or 24 words, and why. comment: p19uydy parent: t3_1vdl4h3 author: DiamondHandsDarrell created_utc: 1785685897 edited: false body: One problem is people don't understand how difficult it is to program an application to create random numbers. They put their trust in wallets, thinking they did things right.Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
Two comments by cleankiwii asking how to convert 99 dice rolls into seed words were deleted.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 8 lines
comment: p1b7u44 parent: t3_1vdl4h3 -author: cleankiwii +author: [deleted] created_utc: 1785699164 edited: false body: -i want to do it, how do i convert the 99 1-6 ranged numbers into words? btw why is 99 instead of 100 for 24 words since 12 require 50 +[deleted] comment: p1b7u5v parent: t1_p19uydy comment: p1fk0rq parent: t1_p1fiob4 -author: cleankiwii +author: [deleted] created_utc: 1785758752 edited: false body: -it doesn’t seem right, how can up have a 4 digit numbers using only 4 dice rolls? 50/12=4,167 little more than 4 rolls for each word? +[deleted] comment: p1flzta parent: t3_1vdl4h3Extracted text as captured
post: 1vdl4h3 author: Proof-Professor-1030 created_utc: 1785684836 title: Generating your own seed with physical dice: 99 rolls ≈ 256 bits of entropy (why I stopped trusting RNGs for cold storage) body: Something that finally clicked for me after years in Bitcoin: when your hardware wallet generates a seed, you're trusting its RNG and its firmware with literally everything. For most people that's a reasonable trust tradeoff. But you don't have to make it. You can generate a BIP39 seed entirely from physical dice: **- 99 rolls of a standard 6-sided die ≈ 256 bits of entropy → a 24-word seed.** **- 50 rolls ≈ 128 bits → a 12-word seed.** The math: each roll gives you log2(6) ≈ 2.585 bits. 99 × 2.585 ≈ 256. BIP39 adds a checksum on top, which is where the last word comes from — you compute it once, offline, or let an air-gapped device like a SeedSigner derive it. Why bother? 1. **You control the entropy source.** Dice have no firmware, no supply chain, no update mechanism. You can audit them by rolling a few hundred times and checking the distribution. 2. **The seed is born offline.** It's generated on paper, in a room with no cameras, and only ever touches an air-gapped device after that. Tampered-device and bad-RNG concerns just evaporate. 3. **It forces you to understand what a seed actually is** — a big number, not a magical artifact of your wallet brand. That understanding changes how you think about backups, passphrases and multisig. I wrote up the full procedure (including how to compute the checksum, common mistakes like reusing dice patterns, and how to verify the result on an air-gapped device) as part of a free self-custody guide: [https://self-custody.cc/](https://self-custody.cc/) — the Dice Seeds section. No ads, nothing for sale, EN/DE/ES. Curious who else here has done dice-generated seeds and whether you went 12 or 24 words, and why. comment: p19uydy parent: t3_1vdl4h3 author: DiamondHandsDarrell created_utc: 1785685897 edited: false body: One problem is people don't understand how difficult it is to program an application to create random numbers. They put their trust in wallets, thinking they did things right.Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
The thread gained comments joking about randomly selecting seed words and cautioning that casino dice could be biased and reveal a seed-generation method.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 18 lines
edited: false body: There are 2048 bip39 words so 1d32+1d64 would be most efficient of all. + +comment: p1tkw0r +parent: t1_p1ani3y +author: ibrewcoffeeonthemoon +created_utc: 1785921646 +edited: false +body: +If you have this level of luck, you should just start picking random 24 words and you will land on someone's wallet very soon. 😁 + +comment: p1tp9x9 +parent: t1_p1aqkwi +author: ibrewcoffeeonthemoon +created_utc: 1785923730 +edited: false +body: +Actually the opposite is true. Casino dice, if not carefully chosen, may be intentionally made to be biased for some very obvious purposes. In the future if a hacker know that some one is using these kind of casino dicss to generate the seed phrase that will also greatly reduce the entropy of seed phrase. Casino dices may not even be as good as a regular dices. + +"Always being unpredictable" is the way to go. If you are gonna use dice, go ahead, but don't tell others that you use which brand of dice.Extracted text as captured
post: 1vdl4h3 author: Proof-Professor-1030 created_utc: 1785684836 title: Generating your own seed with physical dice: 99 rolls ≈ 256 bits of entropy (why I stopped trusting RNGs for cold storage) body: Something that finally clicked for me after years in Bitcoin: when your hardware wallet generates a seed, you're trusting its RNG and its firmware with literally everything. For most people that's a reasonable trust tradeoff. But you don't have to make it. You can generate a BIP39 seed entirely from physical dice: **- 99 rolls of a standard 6-sided die ≈ 256 bits of entropy → a 24-word seed.** **- 50 rolls ≈ 128 bits → a 12-word seed.** The math: each roll gives you log2(6) ≈ 2.585 bits. 99 × 2.585 ≈ 256. BIP39 adds a checksum on top, which is where the last word comes from — you compute it once, offline, or let an air-gapped device like a SeedSigner derive it. Why bother? 1. **You control the entropy source.** Dice have no firmware, no supply chain, no update mechanism. You can audit them by rolling a few hundred times and checking the distribution. 2. **The seed is born offline.** It's generated on paper, in a room with no cameras, and only ever touches an air-gapped device after that. Tampered-device and bad-RNG concerns just evaporate. 3. **It forces you to understand what a seed actually is** — a big number, not a magical artifact of your wallet brand. That understanding changes how you think about backups, passphrases and multisig. I wrote up the full procedure (including how to compute the checksum, common mistakes like reusing dice patterns, and how to verify the result on an air-gapped device) as part of a free self-custody guide: [https://self-custody.cc/](https://self-custody.cc/) — the Dice Seeds section. No ads, nothing for sale, EN/DE/ES. Curious who else here has done dice-generated seeds and whether you went 12 or 24 words, and why. comment: p19uydy parent: t3_1vdl4h3 author: DiamondHandsDarrell created_utc: 1785685897 edited: false body: One problem is people don't understand how difficult it is to program an application to create random numbers. They put their trust in wallets, thinking they did things right.Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
The Reddit thread gained 1 new comment proposing a dice-to-word method.
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 8 lines
body: https://x.com/FinneJay/status/1737662786941968736?s=19 + +comment: p1qem82 +parent: t1_p1fce6k +author: icheyne +created_utc: 1785879048 +edited: false +body: +There are 2048 bip39 words so 1d32+1d64 would be most efficient of all.Extracted text as captured
post: 1vdl4h3 author: Proof-Professor-1030 created_utc: 1785684836 title: Generating your own seed with physical dice: 99 rolls ≈ 256 bits of entropy (why I stopped trusting RNGs for cold storage) body: Something that finally clicked for me after years in Bitcoin: when your hardware wallet generates a seed, you're trusting its RNG and its firmware with literally everything. For most people that's a reasonable trust tradeoff. But you don't have to make it. You can generate a BIP39 seed entirely from physical dice: **- 99 rolls of a standard 6-sided die ≈ 256 bits of entropy → a 24-word seed.** **- 50 rolls ≈ 128 bits → a 12-word seed.** The math: each roll gives you log2(6) ≈ 2.585 bits. 99 × 2.585 ≈ 256. BIP39 adds a checksum on top, which is where the last word comes from — you compute it once, offline, or let an air-gapped device like a SeedSigner derive it. Why bother? 1. **You control the entropy source.** Dice have no firmware, no supply chain, no update mechanism. You can audit them by rolling a few hundred times and checking the distribution. 2. **The seed is born offline.** It's generated on paper, in a room with no cameras, and only ever touches an air-gapped device after that. Tampered-device and bad-RNG concerns just evaporate. 3. **It forces you to understand what a seed actually is** — a big number, not a magical artifact of your wallet brand. That understanding changes how you think about backups, passphrases and multisig. I wrote up the full procedure (including how to compute the checksum, common mistakes like reusing dice patterns, and how to verify the result on an air-gapped device) as part of a free self-custody guide: [https://self-custody.cc/](https://self-custody.cc/) — the Dice Seeds section. No ads, nothing for sale, EN/DE/ES. Curious who else here has done dice-generated seeds and whether you went 12 or 24 words, and why. comment: p19uydy parent: t3_1vdl4h3 author: DiamondHandsDarrell created_utc: 1785685897 edited: false body: One problem is people don't understand how difficult it is to program an application to create random numbers. They put their trust in wallets, thinking they did things right.Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
-
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 0 lines
Extracted text as captured
post: 1vdl4h3 author: Proof-Professor-1030 created_utc: 1785684836 title: Generating your own seed with physical dice: 99 rolls ≈ 256 bits of entropy (why I stopped trusting RNGs for cold storage) body: Something that finally clicked for me after years in Bitcoin: when your hardware wallet generates a seed, you're trusting its RNG and its firmware with literally everything. For most people that's a reasonable trust tradeoff. But you don't have to make it. You can generate a BIP39 seed entirely from physical dice: **- 99 rolls of a standard 6-sided die ≈ 256 bits of entropy → a 24-word seed.** **- 50 rolls ≈ 128 bits → a 12-word seed.** The math: each roll gives you log2(6) ≈ 2.585 bits. 99 × 2.585 ≈ 256. BIP39 adds a checksum on top, which is where the last word comes from — you compute it once, offline, or let an air-gapped device like a SeedSigner derive it. Why bother? 1. **You control the entropy source.** Dice have no firmware, no supply chain, no update mechanism. You can audit them by rolling a few hundred times and checking the distribution. 2. **The seed is born offline.** It's generated on paper, in a room with no cameras, and only ever touches an air-gapped device after that. Tampered-device and bad-RNG concerns just evaporate. 3. **It forces you to understand what a seed actually is** — a big number, not a magical artifact of your wallet brand. That understanding changes how you think about backups, passphrases and multisig. I wrote up the full procedure (including how to compute the checksum, common mistakes like reusing dice patterns, and how to verify the result on an air-gapped device) as part of a free self-custody guide: [https://self-custody.cc/](https://self-custody.cc/) — the Dice Seeds section. No ads, nothing for sale, EN/DE/ES. Curious who else here has done dice-generated seeds and whether you went 12 or 24 words, and why. comment: p19uydy parent: t3_1vdl4h3 author: DiamondHandsDarrell created_utc: 1785685897 edited: false body: One problem is people don't understand how difficult it is to program an application to create random numbers. They put their trust in wallets, thinking they did things right.Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
0 presentation-noise differences. Sidebar, ticker and other page chrome churn that our review classified as not being changes to what the source says.
The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.
Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.
Compare the screenshot or a quotation against the original while it is available.