BIP39 Diceware: How to Roll Dice for a Crypto Seed Phrase

Most crypto holders trust an algorithm to generate their seed phrase. But if you need to prove — to yourself — that your wallet's entropy came from a source no software could have predicted or tampered with, physical dice are the only method that provides that guarantee. Hardware wallet manufacturer Coldcard recommends rolling a minimum of 99 dice before generating a 24-word wallet; Trezor's firmware includes a dice entropy mode by default.

BIP39 diceware is the method of using physical dice to generate entropy that maps to the BIP39 wordlist, producing a verifiably random seed phrase for a cryptocurrency wallet without needing to trust any random number generator.

BIP39 Diceware vs Classic Diceware

The BIP39 and EFF Diceware systems are structurally different despite both using wordlists and randomness. Classic Diceware maps directly from dice rolls to words: five dice produce a five-digit number (11111–66666), which corresponds to a single word in a 7,776-word list. BIP39 cannot work the same way because 2,048 is not a power of six, so dice rolls cannot be converted to BIP39 word indices without rounding bias.

The core difference in the generation method: with BIP39 diceware, the raw dice rolls are fed into SHA-256, which produces a deterministic but unpredictable bit string. That bit string is then split into 11-bit groups, and each group selects a word from the BIP39 wordlist. Hardware wallets handle all of this internally — you enter the dice rolls, the device does the hashing and word mapping.

The BIP39 Wordlist: 2,048 Words and 11 Bits Each

The BIP39 wordlist was specified in 2013 by the Trezor development team as part of Bitcoin Improvement Proposal 39. The 2,048-word count was chosen because 2¹¹ = 2,048, giving each word exactly 11 binary digits — a clean mapping from binary entropy with no wasted probability space.

The English wordlist was further curated with specific requirements:

• No two words share the same first four letters — allowing unambiguous abbreviation to save transcription space
• No words that are commonly confused or sound similar (e.g. "there" / "their")
• Maximum word length of 8 characters
• Only words that are unambiguous in spelling and commonly known

Official BIP39 wordlists exist in nine languages: English, Chinese Simplified, Chinese Traditional, Spanish, French, Italian, Japanese, Korean, Czech, and Portuguese. All use the same 2,048-word structure.

Entropy Math: 12-Word vs 24-Word Phrases

BIP39 phrases come in three lengths. The relationship between phrase length and entropy is straightforward:

Each d6 roll contributes log₂(6) ≈ 2.585 bits of entropy. So 50 rolls yield approximately 129.2 bits — just enough for a 12-word phrase. The 99-roll recommendation for 24-word phrases produces approximately 256 bits, which matches the required entropy exactly.

The checksum bits are not user-generated — they are derived by SHA-256 hashing the entropy and taking the first N bits of the hash as the check value. This means the final word in any BIP39 phrase is partially determined by the preceding words. You cannot roll for it independently.

Step-by-Step: Rolling Dice for a BIP39 Seed Phrase

The most reliable method uses a hardware wallet with a verified dice entropy mode. This example follows the Coldcard Mk4 procedure, which is open-source and independently auditable.

What You Need

• A Coldcard Mk4 hardware wallet (or Trezor Model T / Foundation Passport)
• One standard six-sided die — casino-grade (19mm, flush pips) is preferred for minimising manufacturing bias
• A pen and the metal backup card or BIP39 backup sheet
• A quiet, private location with no cameras

The Procedure

1. Boot the Coldcard and navigate to New Wallet → Dice Rolls.
2. Roll the die once and enter the result (1–6) on the device. Repeat 98 more times for a total of 99 rolls.
3. The Coldcard computes SHA-256 of your complete dice sequence, then XORs the result with entropy from its hardware True Random Number Generator (TRNG). This combined entropy is passed to the BIP39 derivation algorithm.
4. The device displays the 24-word mnemonic on its air-gapped screen. Write every word on the backup card — never type them into any connected device.
5. The Coldcard displays the final word last and shows whether the checksum validates. Confirm it does before proceeding.
6. Store the written backup in a physically secure location — a home safe or fireproof document bag. Consider splitting the phrase across two locations using a Shamir Backup scheme if security requirements demand it.

Without a Hardware Wallet (Advanced Only)

It is technically possible to generate a BIP39 seed phrase from dice rolls using Ian Coleman's open-source BIP39 mnemonic generator, run offline in a browser on an air-gapped machine. Download the tool, verify its SHA-256 hash against the published release signature, then run it with no network connection. Enter your dice-derived hex entropy manually in the "Entropy" field.

This method requires trusting the software environment and verifying the tool's integrity. It is only appropriate for users who can audit JavaScript and verify build reproducibility. For everyone else, a hardware wallet with a dice mode is the correct approach.

Hardware Wallets With Built-In Dice Modes

Coldcard combines user dice rolls with its TRNG via XOR before SHA-256 hashing. This means even if your dice were somehow predictable, the hardware TRNG still contributes independent entropy — and vice versa. The NCSC's guidance on key generation notes that "combining multiple independent entropy sources is always preferable to relying on a single source, however trusted."

A Coldcard Mk4 retails for approximately £130–£150 in the UK and can be purchased directly from the manufacturer or through authorised UK distributors. Look for hardware security keys and physical security accessories at Amazon UK.

Common Mistakes When Using BIP39 Diceware

• Rolling too few dice: Fewer than 50 rolls for a 12-word phrase leaves a measurable entropy shortfall. Always meet or exceed the minimum roll counts in the table above.
• Entering rolls on a connected device: Even an offline browser copy of a BIP39 generator should be used on an air-gapped machine — ideally a freshly booted live OS (Tails or a dedicated Raspberry Pi with no Wi-Fi).
• Photographing the seed phrase: Smartphone photos are automatically backed up to cloud services on most devices. Write only on paper — never photograph the words.
• Trying to choose the last word freely: The final BIP39 word encodes a checksum. Attempting to select it arbitrarily will produce an invalid phrase that most wallets will reject.
• Using biased dice: Toy dice with recessed pips are subtly weighted toward lower numbers. Casino-grade precision dice with flush pips minimise this bias. For the entropy amounts involved in BIP39 generation, the practical difference is small — but the principle matters.
• Storing the seed phrase digitally: Screenshots, cloud notes, password managers — none are appropriate for a seed phrase. Paper, metal backup cards, or split Shamir shares are the standard approaches.

Frequently Asked Questions

What is BIP39 diceware?

BIP39 diceware is the practice of using physical dice rolls to generate raw entropy that is processed via SHA-256 and mapped to the 2,048-word BIP39 wordlist, creating a verifiable mnemonic seed phrase for a cryptocurrency wallet. Hardware wallets including Coldcard and Trezor include built-in dice modes that handle the SHA-256 derivation internally.

What is the BIP39 wordlist size?

The BIP39 English wordlist contains exactly 2,048 words. This was chosen because 2¹¹ = 2,048, so each word encodes exactly 11 bits of entropy with no wasted probability space. Official BIP39 wordlists exist in nine languages — each maintains the 2,048-word count and the first-four-letters uniqueness constraint.

How many dice rolls do I need?

Each standard six-sided die roll contributes log₂(6) ≈ 2.585 bits. You need a minimum of 50 rolls for a 12-word phrase (128 bits) and 99 rolls for a 24-word phrase (256 bits). Coldcard specifies 99 rolls as the standard; Trezor specifies 100.

Can I choose the last word of my BIP39 seed phrase?

No. The final word encodes a checksum derived from SHA-256(entropy). For a 12-word phrase, the last word carries 7 bits of user entropy and a 4-bit checksum. For a 24-word phrase, it carries 3 bits of user entropy and an 8-bit checksum. Hardware wallets calculate and display the correct final word automatically.

Is dice rolling more secure than the hardware wallet's built-in RNG?

Not necessarily more secure — but more verifiable. Certified hardware RNGs (FIPS 140-2 standard) are statistically equivalent to physical dice for practical purposes. The value of dice rolling is that the entropy source is observable and auditable: you can count every roll and confirm the procedure was followed correctly, independent of any software state or firmware version.