Reference · Bitcoin seed generation
Building a seed by drawing BIP-39 words from a physical set, one at a time, rather than rolling for entropy and computing them. Companion to Dice to seed, which covers the methods that start from rolls.
This document is not complete and not everything in it has been verified.
The words you draw are the phrase itself, with only the final word computed.
Take a complete set of the 2048 BIP-39 words as physical objects: printed slips, tiles, or tablets. The words you draw from it are the seed.
Twenty-three draws give a 24-word seed. Eleven give a 12-word one. Both are ordinary BIP-39 phrases and both are a normal way to use this method; the shorter one is not a degraded version of the longer. A signing device then completes the phrase with a final word, which carries the checksum and so cannot be chosen freely.
Nothing is converted along the way. There is no hashing, no lookup table, and no arithmetic of any kind between the draw and the phrase.
Only the first of these is arithmetic. The rest are handling and no published measurement of how strongly human drawing correlates consecutive picks is known here, which is the same gap the dice document records for human handling. The advice is therefore conservative rather than measured. The same concern is set out for dice in Dice to seed §4.
All 2048 words have to be present, exactly once each. A missing word can never be drawn, a duplicated one is drawn twice as often, and the finished phrase carries no evidence of either.
A printed table is exposed to the same mistake and is far easier to audit, since it can be compared against the wordlist line by line where a physical set has to be counted. The worksheets surveyed for the dice document turned up only capitalization artifacts, which are harmless. A missing tile is not.
Short labels are sufficient and are not a shortcut. Every BIP-39 word is uniquely identified by its first four letters, verified against the wordlist for this document, so a tile carrying three or four characters is unambiguous.
Not a survey. These are the sets encountered so far, recorded to be checked rather than recommended.
| Set | Form | Notes |
|---|---|---|
| SeedSigner/SeedPills | Print your own | Python generates OpenSCAD source for a grid of two-sided pills; a full set is 1024 pieces. Pinned at 1acc11e, no license stated |
| Entropia | Commercial tablets | Two-sided tablets carrying 3 to 4 letter labels, 1024 pieces for the full 2048 words. Sold by several vendors; not verified here |
| Cut-up wordlist | Paper | Costs nothing and is the hardest to get right, since 2048 slips must be cut, checked, and kept complete |
To do: verify each set against the wordlist the way the dice worksheets were, and record what a set has to carry to be listed.
There is no arithmetic for a device to get wrong. The word you draw is the word you write down, so nothing stands between the entropy and the phrase.
That narrows the trust question to a single point: the final word is the device's only contribution and the only place it can misbehave. Foundation Passport is worth knowing about here, because it supplies that word from its own random number generator rather than showing you the valid choices.
It also means there is nothing to cross-check. Where a method computes the phrase from something else, that something else is a separate record which reproduces the seed on any other implementation, and comparing the two is how you catch a device that lied. Here the draw and the phrase are the same thing, so there is no second opinion available to get. Dice to seed §5 builds its whole argument on that difference.
The final word carries the checksum, but not only the checksum. A few bits of the seed come from whoever settles that word rather than from your draws.
| You draw | Phrase | Bits from your draws | Valid final words | Bits from the choice |
|---|---|---|---|---|
| 11 | 12 words | 121 of 128 | 128 | 7 |
| 23 | 24 words | 253 of 256 | 8 | 3 |
Who supplies those bits is not fixed and at least one device asks you. SeedSigner's Calc Final Word tool takes 11 or 23 words and then lets you set the spare bits from coin flips, from a BIP-39 word you choose, or from zeros. Whether other implementations offer the same choice was not established here.
The options are not equivalent. Coin flips make those bits random like the rest. Zeros make them fixed and public, which leaves 121 or 253 bits of real entropy rather than 128 or 256: still far past any attacker, but chosen rather than stumbled into.
At the other end, Foundation Passport picks the final word with its own random number generator instead of showing you the valid ones, so those bits are the device's and not yours.
This document ends at a BIP-39 phrase. Schemes that produce a different artifact are out of scope however hand-friendly they are, including codex32 (BIP-93), whose output is a BIP-32 master seed.
A word set is also specific to one wordlist. SLIP-39 uses 1024 words rather than 2048. Of those, 553 are also BIP-39 words sitting at different positions, so a phrase drawn from the wrong set looks entirely plausible and is not the seed you think it is.
A dice worksheet hands you a printed table and has you roll to choose a row. A bag of tiles has you reach in and choose one directly. What differs is the selector, not the method. Both produce 23 freely chosen words and leave the same final word to the device.
This is clearest in the schemes that use both at once. SeedPicker has you draw a paper ticket and roll a six-sided die, the pair addressing one word between them.
The consequence is that everything Dice to seed §12 establishes about the worksheet method applies here: which devices will complete a hand-built phrase, which vendors publish tables, and the fact that the capability is far more widespread than the advertising suggests.