Generating your own seed with physical dice: 99 rolls ≈ 256 bits of entropy (why I stopped trusting RNGs for cold storage)

Something that finally clicked for me after years in Bitcoin: when your hardware wallet generates a seed, you're trusting its RNG and its firmware with literally everything. For most people that's a reasonable trust tradeoff. But you don't have to make it.

You can generate a BIP39 seed entirely from physical dice:

- 99 rolls of a standard 6-sided die ≈ 256 bits of entropy → a 24-word seed.

- 50 rolls ≈ 128 bits → a 12-word seed.

The math: each roll gives you log2(6) ≈ 2.585 bits. 99 × 2.585 ≈ 256. BIP39 adds a checksum on top, which is where the last word comes from — you compute it once, offline, or let an air-gapped device like a SeedSigner derive it.

Why bother?

1. You control the entropy source. Dice have no firmware, no supply chain, no update mechanism. You can audit them by rolling a few hundred times and checking the distribution.

2. The seed is born offline. It's generated on paper, in a room with no cameras, and only ever touches an air-gapped device after that. Tampered-device and bad-RNG concerns just evaporate.

3. It forces you to understand what a seed actually is — a big number, not a magical artifact of your wallet brand. That understanding changes how you think about backups, passphrases and multisig.

I wrote up the full procedure (including how to compute the checksum, common mistakes like reusing dice patterns, and how to verify the result on an air-gapped device) as part of a free self-custody guide: https://self-custody.cc/ — the Dice Seeds section. No ads, nothing for sale, EN/DE/ES.

Curious who else here has done dice-generated seeds and whether you went 12 or 24 words, and why.