When you set up a Bitcoin wallet, the screen usually tells you to write down a list of words. And to keep them safe, because anyone who holds them has access to your coins. The wallet just generated a seed phrase for you.
That’s where the story ends for most people. But it puts your security in the hands of a device you can’t inspect. The randomness comes from code you can’t verify.
What if there’s a bug that allows an attacker to guess your words?
The fix is to cut out the black box entirely. Generating your own seed phrase lets you watch every step and take full control. You see where the randomness comes from. You hold the tools in your hands.
In this guide, you’ll learn four trusted methods: coin, dice, playing cards, and Penlock. You’ll also see why randomness matters and how to store the result safely. By the end, you’ll be able to generate a seed phrase you can trust, with full sovereignty.
Why Randomness Is Everything
A seed phrase is a list of words that represents the master password to your wallet. Hold it, and you control the wallet. Lose it, or let it leak, and your money is gone.
That’s why a seed phrase is only as strong as its entropy source. Entropy is the measure of randomness behind those words. If the words are chosen with true randomness, they’re practically impossible to guess.
But if the underlying randomness is weak or predictable, your seed may be reproducible by someone else. This isn’t a theoretical worry. A bug in a generator, a predictable pattern, a list of “memorable” words, any of these can produce a seed that looks fine and is secretly weak.
There are real cases of wallets drained this way, such as the Coldcard firmware flaw that weakened seed generation.
How Much Entropy Do You Need?
Entropy is measured in bits. Each bit represents a coin flip: a single binary choice of one or zero. More bits mean more possible combinations, which means a harder-to-guess seed.
A 12-word seed phrase starts from 128 bits of entropy. A 24-word seed phrase starts from 256 bits. To get a sense of scale: 128 bits gives roughly 340 undecillion possibilities. That’s more combinations than there are atoms in your body.
Brute-forcing even 128 bits with every computer on Earth would take longer than the age of the universe. So from a pure safety standpoint, a 12-word seed is more than enough.
So why would anyone use 24 words? A 24-word seed is nearly impossible to confuse with a shorter phrase, and it can support higher-security use cases. But for most people, a 12-word seed with strong entropy offers the same practical protection as a 24-word one.
What actually matters is not really the number of words, but where their entropy bits come from.
Before You Start
Every physical method here works the same way. Before you begin, get your tools ready and set a few ground rules in place.
What you’ll need:
- Paper and a pencil: A pen is fine, but a pencil allows corrections and survives erasing.
- A hardware wallet: You’ll need it to validate the 12th word, the one that carries the checksum. The wallet will tell you whether a candidate word is valid.
How to work safely:
- Stay offline: Never type the words, photograph them, or save them digitally. The point of these methods is to keep the phrase away from anything connected.
- Keep it private: Work somewhere no one can see. Keep cameras and prying eyes away.
- Don’t say the words out loud: Avoid pronouncing the results as you write them.
- Never choose your own words: “Memorable” or hand-picked words are exactly the weakness these methods avoid. Let the randomness decide.
- Write legibly: A mistyped word is harder to recover than you’d think. The checksum will catch it, but clear handwriting prevents the mistake entirely.
Generate the First 11 Words
The first 11 words of a seed phrase are fully random. You’re going to create them from physical randomness, using one of the following methods depending on what you have on hand.
Coin Flips
The simplest method of all. You just need a coin and the willingness to flip it a lot.
The BIP39 wordlist is exactly 2,048 words, numbered from 0 to 2,047. Using an 11-bit binary index, the same words are numbered from 00000000000 (0) to 11111111111 (2,047). So an 11-bit number represents a word’s position in the list.
Flip your coin 11 times, read the results as a binary number, and that number tells you which of the 2,048 words to write down. For example, 00000000000 = abandon.
Repeat that for each of the 11 words. That’s 121 flips in total.
How to do it:
- Print the wordlist: You’ll need the BIP39 binary indexed wordlist to look up words.
- Pick a mapping: Decide that heads = 1 and tails = 0. Write it down so you don’t forget mid-set.
- Flip and record: Flip the coin 11 times and write down each result in row number 1.
- Find your word: Look up that number in your BIP39 wordlist. That’s your first word.
- Repeat: Flip, record, and look up until you have 11 words written down.
If you want mathematically pure randomness, because no coin is perfectly balanced, you can use the Von Neumann method: flip twice per bit. Heads-then-tails is a 0, tails-then-heads is a 1, and discard any heads-heads or tails-tails pair. It doubles your flips but guarantees an unbiased result.
Dice Rolls
Coins and dice generate entropy the same way: one physical event, one bit. And their security is identical: both are just an even 50/50 per event. Dice are just the faster, more convenient version, because you can roll several at once.
The BIP39 wordlist has 2,048 words, numbered 0 to 2,047. An 11-bit number is exactly big enough to hold any of those positions (2¹¹ = 2,048). So if you can produce 11 random bits, you’ve got one word.
How to do it:
- Print the wordlist: You’ll need the BIP39 binary indexed wordlist to look up words.
- Set your mapping: Decide that 1, 2, 3 = 0 and 4, 5, 6 = 1. Write it down.
- Roll a handful of dice: You can use as many dice as you can read cleanly. More dice means fewer throws.
- Read in a fixed order: Record each bit, always left to right.
- Group into 11-bit numbers: Every 11 bits gives a value from 0 to 2047.
- Find your word: Look up that number in the BIP39 wordlist.
- Repeat: Roll, record, and look up until you have 11 words written down.
The bias in a normal die is tiny and costs a negligible amount of entropy. However, well-made “casino” dice remove the question entirely. You can also debias: roll twice: (0, 1) is a 0, (1, 0) is a 1, and discard (0, 0) or (1, 1). It doubles your rolls but guarantees unbiased bits.
If you’d rather not manage binary bits at all, the BitBox dice method maps dice rolls straight through a printed lookup table. It’s a clean, no-math way to do the same thing.
Playing Cards
This is the method behind the Bull Bitcoin tutorial, iterated from SeedPicker Solitaire. A shuffled card deck holds more randomness than you need, and a printed lookup table turns card pairs (“tuples”) into words.
An ordered pair of cards has 52 × 51 = 2,652 possibilities, which is more than enough for the 2,048-word list. Because there are more pairs than words, some pairs are blank.
How to do it:
- Print the lookup table: You’ll need the two-card-tuple table that maps card pairs to BIP39 words.
- Shuffle thoroughly: Shuffle a standard 52-card deck at least 7 times. A poor shuffle is the real weakness in this method. A well-shuffled deck is what produces the entropy.
- Draw a pair: Draw the top card and place it on the left, and the next card and place it on the right.
- Find your word: Locate the ordered pair in the table. If it yields a word, record it and return the cards. If the entry is blank, return the cards. Blanks are normal.
- Repeat: Shuffle, draw, and look up until you have 11 words written down.
Cards present no real physical bias, unlike a worn coin or die. The only variable is shuffling. So shuffle thoroughly each time, and the deck gives you all the entropy you need.
Penlock
The most complete method of the four, as it can also split your seed into shares and recover it later. Penlock, a printed, paper tool, is inspired by Andrew Poelstra’s Codex32.
Penlock uses a set of printed tiles. Each word is picked by drawing two tiles: the first tile picks one of 32 columns (5 bits), the second picks one of 64 number-dot combinations (6 bits), for 32 × 64 = 2,048 possibilities. So the first 11 words give you 121 bits, exactly what a 12-word seed is built on.
How to do it:
- Print the kit: You’ll need the worksheet (double-sided), the tiles (double-sided), and the wordlist.
- Cut the tiles: Use scissors or a paper trimmer to cut the 32 tiles, then make sure their value is identical on both sides.
- Shuffle thoroughly: As with a deck of cards, a proper shuffle is what guarantees each draw is uniform.
- Pick a tile at random: Look at its number, find the matching column on the wordlist, and return it.
- Shuffle thoroughly again: That’s what keeps each of the 32/64 outcomes equally likely and the 5 + 6 bits honest.
- Pick a second tile: Look at its number-and-dot combination to find the exact word in that column.
- Record the word: Write the first 4 letters on the worksheet under the seed phrase. If you’re planning to split or recover your seed later, also note the 2-character checksum (the grayed digits).
- Repeat: Shuffle, pick, and look up until you have 11 words written down.
The tiles carry no meaningful physical bias. Your entropy comes entirely from how well you shuffle. So shuffle thoroughly before every draw.
As a note, writing only the first four letters of a word uniquely identifies that word, as no two BIP39 words share them.
Generate the 12th Word
The 12th word is different from the first 11. It isn’t fully random. It carries the last of your entropy plus a checksum: a short fingerprint of all the words before it.
That’s why you can’t just pick a random 12th word and why it’s impractical to compute by hand. The checksum requires a cryptographic hash, something no pen-and-paper method can reliably do.
So instead of computing it, you test it with a hardware wallet.
How to do it:
- Generate a candidate 12th word: Use the same physical method you used for the others.
- Enter your seed phrase: Start the wallet’s restore/recovery process and enter your 11 words plus the candidate, in order.
- Check the result: If the wallet accepts the phrase, you’re done. Record the 12th word. If it rejects it, the checksum didn’t match, so move back to step 1 and try again. On average this takes about 16 tries, since only 1 in 16 words is valid.
Some wallets let you change just the 12th word and retry quickly; others make you restart recovery from the first word each time. If yours is the second kind, be ready to re-enter your seed phrase candidate each time.
Verify Your Seed
Generating a seed is only the first half. Before you trust it, confirm it works.
How to do it:
- Confirm every word and its position: Read the phrase back against your notes, word by word, in order. A single wrong or misplaced word is a different (empty) wallet.
- Confirm your receive address: Note the receive address your wallet derives from the seed. Then wipe the device and restore it from your seed phrase. Test the recovery properly, not just the app. Confirm the same address appears again. If it does, your seed is correct and truly recoverable.
- Test receive and send: Send a small amount to your receive address and watch it arrive. Then send it back out. This confirms your keys and addresses work end to end, not just that they exist.
Protect Your Seed Phrase
A seed only survives if it’s handled and stored correctly. These steps turn a correct phrase into one that’s safe for the long term.
- Destroy all generation notes: Burn dice logs, tile records, card-pair notes, and scratch paper, leaving no trace of the process.
- Consider a passphrase or multi-sig: A passphrase (the “25th word”) adds a second secret on top of your seed; multi-sig spreads control across multiple keys. Both raise the bar for anyone trying to take your funds. Each comes with its own trade-offs, so weigh them carefully.
- Use a metal backup: Paper becomes brittle, burns, or water-damages, and ink fades. A metal seed phrase storage plate survives the test of time, fire, and flood. Plus, it can be made tamper-evident to make any attempt to read your seed visible.
- Store it properly: A backup only helps if you can reach it when you need it. The right way to store a seed phrase covers location, redundancy, and the mistakes that quietly cost people their coins.
Conclusion
You don’t have to trust a black box to generate your seed phrase. Some reliable methods put the randomness in your own hands. You can watch every step, and the result is a strong, valid 12-word seed you can verify with tools you control.
Flipping a coin is the simplest. Using dice offers the same entropy and can be faster. Picking cards is the most tactile, turning randomness into a game. Penlock doesn’t just generate your seed; it can split it into a 2-of-3 backup and recover it later.
Whichever method you choose, these approaches are only as strong as how you carry them out. True randomness, careful verification, and a proper backup are the difference between control and irreversible loss.
Penlock is a purpose-built tool designed for generating a seed you can trust. Nothing improvised. Discover Penlock, the complete kit ready to use.