Every hardware wallet generates your seed phrase for you, using a random number generator you cannot audit. If that generator is faulty or backdoored, your bitcoin is gone and you will never know why.
There is a way around it: produce the randomness yourself, with a coin. A coin has no firmware, no supply chain and no update server. This guide takes you from zero to a valid 24-word seed phrase, one flip at a time. No maths beyond adding up numbers, no computer needed until the very last step.
What you need
- A coin. Any coin.
- A pen (not a pencil).
- The printable sheets below, on paper.
- A quiet room, alone.
Download and print these four files before you start:
- Coin Flip Seed Guide (PDF) - this same guide, on paper, so you can follow it with no screen in the room.
- Coin Flip Seed Sheet (PDF) - where you record the 256 flips of your seed phrase.
- Coin Flip Passphrase Sheet (PDF) - the same thing for an 8-word passphrase.
- BIP39 Word List (PDF) - the 2048 official words, numbered 0 to 2047.
Rules before you start
- Do it alone, with the door closed.
- No phones in the room. Cover any webcam and unplug smart speakers.
- Never type anything into a device that is online. Not into a notes app, not into a browser, not "just to check".
- Do not say the results out loud.
- Flip the coin properly: from your thumb, letting it land on the table. Vary the height and the force.
Step 1: Decide what heads means
Heads = 1. Tails = 0. That's the whole convention. Write it at the top of your sheet so you never doubt it halfway through.
Step 2: Understand the sheet (30 seconds)
Open the Coin Flip Seed Sheet. It has 24 rows, one per word of your seed phrase. Each row has 11 boxes, labelled 1024, 512, 256, 128, 64, 32, 16, 8, 4, 2, 1.
Each box is one coin flip:
- Heads - write a
1in the box. - Tails - write a
0in the box.
Always write something, never leave a box blank. A blank box has to mean one thing only: "I have not flipped for this one yet". If you only marked the heads, you could never tell an empty box apart from a tails you already flipped, and re-flipping it would silently change your seed phrase.
Step 3: Flip the coin 253 times (rows 1 to 23)
Start at row 1, box 1024, and work left to right, row by row, all the way to row 23.
- 11 flips per row.
- 23 rows.
- 253 flips.
You can take a break whenever you want: the first blank box is always where you left off. That is the whole point of writing a 0 for tails, and it is why you should never go back and "correct" a box that already has a digit in it.
Step 4: Row 24 gets only 3 flips
Look at row 24 on the sheet: the last 8 boxes are greyed out. Do not flip those.
- Flip 3 times only: the boxes
1024,512and256, writing your1s and0s as usual. - Leave the 8 grey boxes empty. They are the checksum, and it will be calculated for you in Step 7.
You have now flipped the coin 253 + 3 = 256 times. That is the full 256 bits of entropy of a 24-word seed phrase.
Step 5: Add up each row
Go row by row and add the numbers printed under the boxes that hold a 1. Boxes with a 0 add nothing, so you can ignore them. Write the result in the Sum column.
Example: if in one row you wrote a 1 under 512, 256, 32, 16 and 2, then:
512 + 256 + 32 + 16 + 2 = 818
Write 818 in the Sum box of that row. Every sum will be a number between 0 and 2047. If you get anything above 2047, you added a number twice: redo that row's sum.
Do this for rows 1 to 23. Leave row 24's sum empty, it is not complete yet.
Step 6: Look up your words
Open the BIP39 Word List. The words are numbered from 0 to 2047, exactly like your sums, so there is nothing to adjust.
Find each sum in the list and write the word in the Word column of your sheet.
Following the example above, 818 is the word green.
Double-check every word as you write it. Some pairs look alike on paper, so copy them letter by letter.
You now have words 1 to 23.
Step 7: Get the 24th word
The last word is special: it carries your 3 remaining flips plus 8 bits that are calculated from all the previous words. This is the checksum, the thing that makes a seed phrase valid or invalid, and it is the only step you cannot do with a pen, because it requires a SHA-256 hash.
Most devices will show you 8 possible words for position 24, one for each combination of your 3 flips. Only one of them matches what you flipped, and this is how you find it:
SeedSigner - the only one that takes your flips directly. On a SeedSigner: Seeds → + Create a seed → Calc 12th/24th word → 24 words. Type in your 23 words, and when it asks for the remaining entropy choose coin flips and enter the 3 flips of row 24 (heads = 1, tails = 0, in that order). It gives you word 24 straight away, with no list to choose from.
Coldcard Mk4 and Q. On a Coldcard: Import Existing → 12/18/24 Words → 24 Words, and type your 23 words. After the 23rd word, the Coldcard computes and shows the 8 valid options for word 24. Pick yours with the rule above.
Krux. On a Krux: New Mnemonic → Words, and type your 23 words. For the 24th, its keypad only lets you type words with a valid checksum, so use the rule above to type the one that matches your flips. If you leave it empty, Krux picks a valid word by itself and your 3 flips are simply not used.
Foundation Passport (firmware 2.3.0 and later). Passport accepts a 23-word import and calculates the checksum word for you. It does not ask for the 3 extra flips of row 24, so those flips are not part of the result: your seed ends up with 253 bits of entropy instead of 256, which is still far beyond anything that can be brute-forced.
An offline computer, if you have none of the above. Download the Ian Coleman BIP39 tool before you start, move the single HTML file to a computer with no internet connection, open it, select Binary [0-1] as the entropy type and type the 256 digits exactly as they are on your sheet (row by row, left to right, including the 3 of row 24). It shows the complete 24-word phrase, checksum included. Shut the computer down when you are done.
Step 8: Load the phrase into your wallet
Type the 24 words into your hardware wallet as a wallet restore. If the device rejects the phrase, the checksum is wrong: a word was misread or a sum was miscalculated. Go back to your sheet and check each row.
Once the wallet accepts it, send a small amount of bitcoin, wipe the device, and restore it from your written backup. Do this before moving any serious amount. A backup you have not tested is not a backup.
Step 9: Destroy the sheet
Your seed sheet is a plaintext copy of your private keys. Once your words are stamped on metal and you have tested the restore:
- Burn the sheet, or shred it and dispose of the pieces separately.
- Never photograph it, never scan it, never keep it "just for now" in a drawer.
The same method, for an 8-word passphrase
A passphrase (sometimes called the "25th word") is a second secret that unlocks a completely different wallet. Picking it out of your head is the classic mistake: attack dictionaries are built from songs, books, names and dates. Flip for it instead.
Use the Coin Flip Passphrase Sheet, which holds two passphrases of 8 words each:
- Flip 11 times per word, writing a
1for heads and a0for tails, exactly as before. - Do it for the 8 words: 88 flips per passphrase.
- Add up each row and write the sum, from
0to2047. - Look up each sum in the BIP39 Word List and write the word.
There is no checksum here, so all 8 words come straight off the sheet. Nothing to calculate, no device needed.
Write the passphrase in lowercase, with a single space between words, and no capitals, numbers or accents. Eight words give you 88 bits of entropy, which is plenty.
Common mistakes
- Flipping 264 times. Row 24 only takes 3 flips. The 8 grey boxes are the checksum.
- Starting the word list at 1. The list runs from 0 to 2047, and so do your sums. No adding 1 anywhere.
- Leaving the tails boxes blank. Write the
0. A blank box must always mean "not flipped yet", otherwise you will re-flip a box you had already resolved and change your seed phrase without noticing. - Reusing the same coin flip for two boxes. One flip, one box.
- Typing the words into a phone "just to check". That is how seeds leak.
- Skipping the restore test. Test with a small amount before you trust the backup.
- Keeping the paper sheet. It is a full copy of your keys.
Sources
Some sources we used to write this post:
- ¿Confías en tu semilla? No confíes, hazla tú mismo - Estudio Bitcoin - the manual method this guide is based on, in Spanish.
- BIP39: Mnemonic code for generating deterministic keys - the specification behind the 11 bits per word and the checksum.
- BIP39 English word list - the official 2048 words, in the order used by our printable list.
- COLDCARD Paranoid Guide - the 8 valid options shown after the 23rd word.
- Krux - Generating a Mnemonic - the checksum-aware keypad for the last word.
- Passport 2.3.0 release notes - the 11 or 23 word import.
- SeedSigner 0.5.1 release - the coin flip entropy option in the final word calculation.
Visit our Website
Once you have generated your seed phrase, you need a good device to hold it. On TheBitcoinHole.com we compare the features of the top hardware wallets, so you can pick the right one:
Support Us
There are different ways to support our work:
Support Us on Ko-fi