103 · Private key creation · lesson 1 of 4

How a seed is made — and where its randomness comes from

Your seed is one very large random number. Everything else — every address, every key, every coin you will ever hold — is worked out from it. Normally the device picks that number and you have no way to check that it picked well. You do not have to leave it at that.

The three steps that turn a random number into words

Three steps, and none of them is clever. Knowing them is what turns every choice further down this page from a preference into something you can reason about.

1. A number is picked. 256 random bits for a 24-word seed, 128 for a 12-word one. This is the only step where randomness enters, and it is the entire subject of this lesson — everything after it is bookkeeping.
2. The number is cut into 11-bit pieces, and each piece is looked up in a list. The list holds exactly 2,048 ordinary words, because 2,048 is how many different values 11 bits can take — one word per piece, no waste. It is the same fixed, public list in every wallet ever made, which is why your words are English and why any wallet can read them.
3. The last word carries a checksum. Part of that final word isn’t your number at all — it’s a short fingerprint of everything before it. That is why exactly 8 of the 2,048 words are valid as the last word of a 24-word seed (128 for 12 words), and it is not a restriction anyone chose — it falls out of the arithmetic.

Four things follow from that, and they are the reason the rest of this page exists.

• Your words are a notation, not a password. Nobody invented them for you and nothing remembers them; they are that one number written in a form a human can copy onto metal without mistakes. Two people who pick the same number get the same wallet, wherever and whenever they do it.
• It is why supplying your own randomness is even possible. Rolling dice is just doing step 1 by hand. The wallet still does steps 2 and 3, exactly as it always would — you are not using a different kind of seed, you are answering the one question the device would otherwise answer alone.
• It is why a wrong word can be silent. Change a word and the checksum usually catches it, which is the beeping error people expect. But a small fraction of wrong combinations pass the check anyway — and then no error appears, because a valid seed is a valid seed. A real, empty, perfectly ordinary wallet opens instead of yours. Proving your backup against this is its own lesson later in the course — Testing a backup, in 103 · Private key creation.
• It is why 12 versus 24 words is a question about the size of the number, and nothing else. Both give you a whole wallet with the same features. The longer one is a bigger number, costs more throws to roll and more metal to store, and defends against an attacker who does not exist yet. We recommend 24 words; 12 is not negligent.

Your four options

These run from most of the randomness being yours to none of it. The last is what almost everybody does, and it is not a wrong answer — but it is a choice, and most people make it without noticing they made it.

What your device allows

This is the part that surprises people. Only Coinkite lets you roll dice on the device itself, so options 2 and 3 belong to one maker. On a Jade or a BitBox02, option 1 is the only route your randomness has. And on Trezor Safe 3, Trezor Safe 5, Trezor Safe 7, Passport Prime, Ledger Nano family there is no route at all — the device generates your seed and that is the end of it.

None of that makes those devices bad. Trezor's position is a considered one: they argue you should never choose your own backup, because people are far worse at randomness than they believe. That is a real argument and the losses back it up. It is simply worth knowing before you buy, rather than after.

And for Bitkey the question does not arise at all. It has no seed phrase to build: it is multisig by design, and the recovery kit holds an encrypted key rather than words. There is nothing here to opt into and nothing being withheld — it sits outside this decision rather than at the bottom of it.

Why anyone bothers

Every hardware wallet generates your seed from a random-number generator you cannot inspect. When it works, this is fine. The problem is the word when: it sits under everything else you do, and you will not find out it failed until the coins are gone.

The argument is a narrow one, and worth keeping narrow. Supplying your own randomness does not make you harder to phish, does not protect a badly stored backup, and does not help at all if you write the words down wrong. It removes exactly one risk — that the device's randomness is not random — and it hands you a different one, which is that you now have to do this carefully.

So there is no single right answer here, and we are not going to pretend there is one. Where your device allows it, add your own throws — that much is our position, because mixing your randomness into the device's own cannot make the result worse (Coinkite says so in its own documentation) and it costs a few minutes and no bookkeeping. Which of the four options that means for you depends on the device in front of you and how far you want to go.

Option 1 is the honest maximum, and it is a real evening's work: for a 24-word seed, about 173 throws and 23 coin flips, each one read off a printed table by hand. Do that because you want the one thing it buys, not because it sounds more serious. And option 4 — letting the device do it — is not a failure. Far more coins are lost to a botched setup than to faulty randomness, and a seed generated normally and backed up properly beats a sovereign seed you lost count halfway through.

What you need

• A die you trust. A fair six-sided die, ideally a sharp-edged casino die rather than the rounded one out of a board game. A cheap moulded die is very slightly biased; it will not ruin a seed on its own, but it is the one input you cannot check afterwards.
• A room with no one in it. No people, no cameras, no smart speaker, no video call left running on a laptop across the room. Phones somewhere else entirely — not face-down on the table.
• The hardware wallet, with no seed on it. A new device, or one you have deliberately wiped. Update the firmware first, so the device you are about to trust is the fixed version.
• Something to write on that is not a phone. Paper and a pen for the seed words — our printable worksheet is made for exactly this. Not a notes app, not a photo, not a password manager, not a laptop. Metal comes later, once the words are confirmed.
• An hour you are not being interrupted in. A hundred rolls entered carefully is genuinely tedious. Losing count halfway and guessing is worse than not doing this at all.

The seven ways this goes wrong

Every one of these has cost somebody their coins, and none of them involves the maths being wrong. rule 07 covers the first and most important.

• Recording the sequence anywhere digital. The list of rolls IS the seed, in a different alphabet. Typing it into a phone to keep count, photographing the tally sheet, or checking the maths on your everyday laptop hands over the wallet as surely as posting the words. Coinkite says to verify only on an offline amnesic system; BitBox says the numbers must never touch an electronic device except the wallet itself. Both mean it literally.
• A die that is not fair. Loaded, chipped, or heavily rounded dice skew the distribution. You cannot detect this from a hundred rolls by eye, and you will not get a warning. Use a sharp-edged die you have no reason to distrust, and if you find one behaving oddly afterwards, start again with a different one.
• Rolling somewhere you are overlooked. A camera that sees the table sees the seed. So does anyone standing behind you, and so does an open laptop lid. This is the failure mode that does not feel like one at the time.
• Losing count. Rolling is dull and it is easy to lose your place at roll seventy. Being under the minimum silently is the danger; being over it costs nothing at all. If you genuinely do not know where you are, keep rolling — extra rolls never weaken the result. This is what the printable worksheet is for: a numbered row per word, filled in as you go, so your place is on the paper rather than in your head.
• Stopping early because it is boring. The device will stop you below its minimum, but only on the methods where the device counts. On a lookup-table method nothing checks you, and eleven words instead of twenty-three is a wallet with a fraction of the strength you think it has.
• Making the rolls up. Typing a plausible-looking string instead of throwing the die is the one mistake that has actually cost people coins. People are extremely bad at inventing randomness, and an attacker searching human-shaped sequences is a well-understood attack. Coinkite spells it out: you cannot fabricate rolls without compromising security.
• Never testing the backup. A seed you rolled yourself is exactly as easy to write down wrong as one the device generated. Wipe the device and restore from your written words before a single satoshi goes in.