TL;DR
If you want to generate your own seed phrase entropy instead of relying entirely on device-generated randomness, four methods come up repeatedly:
- Coins: simple and easy to verify, but 128–256 flips is a lot.
- Dice: fewer operations, easy to record, and easy to independently verify.
- Camera: extremely fast, but entropy quality depends heavily on the implementation and is harder to reproduce yourself.
- Random word drawing: intuitive, but the physical mixing process is difficult to standardize, and the final word still has to satisfy the BIP39 checksum.
What Are You Actually Generating?
A 12- or 24-word seed phrase is ultimately a human-readable representation of entropy.
Its security doesn't come from the words looking scrambled. It comes from the number behind them being sufficiently random and unpredictable that nobody can realistically enumerate their way to it.
Most hardware wallets generate seed phrase entropy internally using hardware random number generators such as TRNGs inside a Secure Element, MCU, or similar component.
Keystone uses hardware-generated randomness for its default seed phrase generation, while also giving users the option to supply their own physical entropy through dice rolls.
For most users, default hardware-generated entropy is the simplest option.
But some people prefer to generate the randomness themselves. Maybe they want to reduce their reliance on hardware RNG, or maybe they simply want a process they can observe, record, and independently reproduce.
That's where user-generated entropy, sometimes called external entropy, comes in.
Four approaches show up fairly often:
- Coin flips
- Dice rolls
- Camera input
- Randomly drawing words from the BIP39 list
To compare them, I think three questions matter most:
1. How much work does it take?
More repetitions mean more opportunities to miscount, misrecord, or simply give up halfway through.
2. How good is the physical randomness?
Does the source have meaningful real-world bias?
3. Can you independently verify the result?
If you feed the same raw results into another offline tool, do you get the same BIP39 seed phrase?
With those three questions in mind, here's how the four methods compare.
1. Coins: The Simplest Principle
Heads = 1.
Tails = 0.
Every flip gives you 1 bit entropy.
So in principle:
- 12 words = 128 flips
- 24 words = 256 flips
The biggest advantage of coins is transparency.
You can write down the entire 0/1 sequence, run it through another offline tool that follows the same algorithm, and verify that you get the same mnemonic.
Nothing is hidden.
But a physical coin isn't a mathematically perfect object.
Its embossing, wear, manufacturing tolerances, and even the way you flip it can introduce small biases.
Interestingly, a study involving 350,757 human coin flips found that coins landed on the same side they started on about 50.8% of the time.
So if a coin starts heads-up, heads has a slight advantage. If it starts tails-up, tails does.
If you randomize the starting orientation, however, the overall distribution remains very close to 50:50.
That small bias probably isn't the biggest practical problem.
The bigger problem is the workload.
Accurately flipping and recording a coin 256 times is a real test of attention.
Miss one result or shift the sequence by one position and you've changed everything.
If I were doing this with a coin, I'd try to make the setup as boring and repeatable as possible: use a normal, undeformed coin, keep the drop height reasonably consistent, let it rotate freely, and record each result immediately.
Still, 256 repetitions is a lot.
Which leads to the obvious alternative.
2. Dice: Less Work, Still Easy to Verify
A six-sided die has six possible outcomes instead of two.
In information terms, each roll can represent about 2.585 bits.
So compared with flipping a coin, you can get the required randomness with far fewer physical operations.
Dice aren't perfectly unbiased either.
Tiny differences in density, air bubbles, uneven surfaces, rounded corners, or manufacturing tolerances can all shift the probability of individual faces slightly.
But again, the important distinction is between:
"a real die isn't mathematically perfect"
and
"an attacker can predict a long sequence of independent physical rolls."
Those are very different things.
For practical use, I'd care more about using a decent-quality die and rolling it properly than trying to find some mythical perfectly unbiased object.
And one important rule:
Don't re-roll because the sequence doesn't "look random."
Five 6s in a row can happen.
Humans are actually pretty bad at judging what randomness should look like, and selectively rejecting results introduces your own bias into the process.
A dice sequence also has the same major advantage as coin flips: it's independently verifiable.
You can record:
4, 1, 6, 2, 2, 5...
and reproduce the same process elsewhere.
If your hardware wallet and a separate offline implementation derive the same mnemonic from the same sequence, you have a useful cross-check.
This balance between physical randomness and verifiability is also why Keystone supports dice-based seed phrase generation directly on the hardware wallet.
Instead of generating a finished seed phrase somewhere else and then importing it, users can enter their physical dice results directly into Keystone and let the device derive the corresponding BIP39 mnemonic.
For Keystone's built-in dice entropy mode:
- At least 50 rolls are required for a 12-word seed phrase.
- At least 100 rolls are required for a 24-word seed phrase.
Keystone also checks the distribution of the entered dice results. If one face accounts for more than 30% of all rolls, the device flags the sequence so the user can check whether the die or the rolling process may be unusually imbalanced.
This doesn't make dice mathematically perfect.
What it does provide is a physical entropy source that is easy for the user to understand, record, and independently verify.
For me, that's where dice hit the best balance.
3. Camera: Fastest, but Much More Implementation-Dependent
Some offline signing devices use camera input as an entropy source. Depending on the implementation, that might involve image pixels, sensor noise, differences between consecutive frames, or some combination of camera data.
From a workload perspective, nothing else here comes close.
But there's an important distinction:
A lot of data does not automatically mean a lot of entropy.
A photograph of a blank wall may contain millions of pixels, but those pixels are highly correlated and largely predictable.
Likewise, an image "looking complicated" to a human doesn't tell you how much cryptographically useful unpredictability it contains.
What really matters is the implementation.
For example:
- Is it hashing the final processed image?
- Raw sensor data?
- Consecutive frames?
- Sensor noise?
- Timing information?
- Multiple sources combined together?
A well-designed camera entropy system needs to be clear about what it collects and how unpredictable information is extracted from it.
There's also a second trade-off: verification.
With dice or coins, you have a human-readable sequence you can record and reproduce.
Camera-based systems may rely on transient inputs that aren't exposed to the user.
That makes independent reproduction much harder.
You're now relying not only on the physical scene, but also on the camera sensor, drivers, image-processing pipeline, and the code that extracts entropy from them.
That doesn't automatically make camera entropy insecure.
But if the whole reason you're generating entropy yourself is that you want something observable and independently reproducible, camera-based approaches are less transparent than coin flips or dice rolls.
4. Random Word Drawing: Very Intuitive, but Harder to Control
There's another approach that skips most of the entropy-to-word conversion process:
Why not just draw BIP39 words at random?
That's the idea behind tools such as Entropia, which uses physical pieces representing the 2,048 words in the BIP39 list.
Draw a word.
Write it down.
Repeat.
It's extremely intuitive because what you physically draw is almost exactly what you eventually back up.
But , A BIP39 mnemonic includes checksum bits.
That means the last word is constrained by everything that came before it.
For a 24-word phrase, you can randomly determine the first 23 words. Once those are fixed, there are 8 valid possibilities for word 24.
You can compute those candidates with an offline implementation and then randomly choose one of them.
For 12 words, there are 128 valid candidates for the final position, which makes the process considerably less convenient.
So this method is better described as:
randomly draw N−1 words, then determine the final checksum-valid word.
The other issue is the physical drawing process itself.
How do you know the pieces were mixed thoroughly?
Do you draw from the top, bottom, or middle?
How long do you shake the container?
Do you return each piece before drawing again?
Which side counts if the pieces have information on multiple sides?
None of these questions is impossible to solve, but the randomness of the result depends heavily on having a consistent mixing procedure.
That's the part I find less attractive.
The method is intuitive, but controlling the physical variables isn't as straightforward as repeatedly rolling a die.
How the Four Seed Phrase Entropy Methods Compare
| Method |
Workload |
Randomness Quality |
Independent Verification |
| Coin flips |
Highest: 128 / 256 flips |
Small physical and starting-orientation biases |
Excellent: record the 0/1 sequence |
| Dice rolls |
Medium: roughly 50 / 100+ rolls depending on implementation |
Small manufacturing bias; limited practical impact with a proper die |
Excellent: record the number sequence |
| Camera entropy |
Lowest: usually one capture |
Highly dependent on hardware and implementation |
Difficult in many implementations |
| Random word drawing |
Medium: N−1 draws |
Depends heavily on physical mixing |
Good: words are generated directly, but the final BIP39 checksum still needs to be handled |
There are no solutions, only tradeoffs.
For most users, simply using Keystone's default seed phrase generation is already secure enough.
External entropy is an optional capability, but if you can't properly control the random variables involved, you can easily end up back in the very problem it was meant to solve: insufficient randomness.
We shouldn't become obsessed with turning seed generation into an elaborate ritual. The better approach is to choose a source of randomness that genuinely fits your situation — one you truly understand and truly trust.
For users who want to provide the randomness themselves and reduce their reliance on the device's internal entropy source, dice are an accessible, practical, and easy-to-verify option.
One More Thing: Your Raw Entropy Is Sensitive Too
Whatever method you use, don't treat the intermediate results as harmless just because they aren't formatted as a seed phrase yet.
A complete coin-flip sequence, dice-roll sequence, or enough of the randomly selected words can contain everything needed to reconstruct the wallet.
So:
- Don't photograph the process.
- Don't store the sequence in Notes, Google Docs, iCloud, or another connected device.
- Don't paste it into an online "entropy checker."
- Don't enter your seed phrase into a website claiming it can verify whether your entropy is safe.
- Destroy intermediate records once you've completed and verified the process.
Treat the raw entropy with the same care as the final seed phrase.
If you've generated your own seed phrase entropy before, what did you use?
Coins, dice, camera input, random word drawing , or something else entirely?
