Checking…

BIP-39 Seed Phrase — Offline Working Sheet

Print this and follow it on paper. Do not write your words on this sheet if you plan to keep it anywhere insecure.

Pre-flight safety checklist

When using this for a real wallet, this computer will be disconnected from the internet (Wi-Fi off / airplane mode / ethernet unplugged) and will stay disconnected for the rest of that session.
I will write my final phrase down by hand on paper (or stamp it in metal) — never type, save, screenshot, photograph, email, or cloud-sync it anywhere.
I am in a private location where no one can see my screen, my dice/coin rolls, or what I write down.

Generating each word's 11 bits of randomness

Every word is a number from 0 to 2047. You need 11 of them for a 12-word phrase, or 23 for a 24-word phrase. The calculator works out the final word for you.

Method A — Coin flips or 11 dice (simplest, no bias, no rerolls)
  1. Flip a fair coin 11 times for one word — or roll one die 11 times, or throw 11 dice at once and read them left to right in an order you fixed before throwing.
  2. Write down Heads = 1, Tails = 0 (with dice, odd = 1, even = 0 — or split the faces, 1,2,3 = 0 and 4,5,6 = 1, which is equally even), in the order you flipped or rolled.
  3. You now have an 11-digit binary number, e.g. 01011010110.
  4. Look that binary number up in the word reference table.
  5. Repeat for every word.
Method B — Dice (5 six-sided dice per word)
  1. Roll 5 dice. Subtract 1 from each face, so each die reads 0–5.
  2. Combine them as a base-6 number:
    (d1 × 1296) + (d2 × 216) + (d3 × 36) + (d4 × 6) + d5
  3. The result is somewhere in 0–7775.
  4. If the result is 2048 or higher, discard it and reroll all 5 dice for that word. This happens just over 70% of the time — that is expected and correct, not an error. Do not try to "fix" a high number by subtracting or wrapping it; that would bias your entropy.
  5. Once you have a number in 0–2047, look it up in the word reference table.
  6. Repeat for every word.
Method C — Index Dice (1 marked D6 + 3 D10's; read it, do not compute it)
  1. Mark one d6 with a permanent pen: two faces 0, two faces 1, two faces 2 — two per value, never three and three, or the split is uneven. No pen? A plain d6 does the same job if you read faces 1,2 = 0, 3,4 = 1, 5,6 = 2.
  2. Use three d10s in three different colours and give each colour its place before you throw — say red = hundreds, blue = tens, green = units — then keep that for the whole phrase. Identical dice leave you deciding which is which after they land, and a die read in the wrong place is a different word. Write your colours in the slots below.
  3. Throw the marked d6 and the hundreds d10 first, on their own, and place each in its slot. A d10 showing 10 counts as 0.
  4. Read those two as a two-digit number. 21 or higher — pick up those two dice only and throw them again, until they read 20 or lower. In practice: the d6 shows 2 and the d10 shows anything but 0. This is legal only because the last two dice have not been thrown yet — you are throwing a fresh pair, not steering a result you have already seen.
  5. Now throw the tens and units d10s and place them. Read the four digits left to right as one number — d6 = thousands, then hundreds, tens, units. That number is the index. Nothing is added, multiplied or looked up.
  6. If it reads 2048 or higher, discard it and throw all four dice again. Valid indexes are 0000–2047. Starting with two dice leaves only about one word in forty landing here — that is expected and correct, not an error.
  7. Never trim a high number to fit, and never change a single die once all four are down. There are exactly two legal rerolls and no third: those first two dice before the other two are thrown, or all four together. Changing one die to make a number fit makes some words 1.25× likelier than others, and worse if you reroll more than one, with nothing on the paper to show it happened.
  8. Prefer one throw? Throw all four at once and reroll all four on 2048 or higher. Equally correct, just slower — about one throw in three goes in the bin.
  9. Paper is optional. The same four numbers can be typed into the Index Dice box on the page (it was called Decimal dice up to v2.0.0), which names the word and refuses anything out of range — the grid below is for working on paper first, not instead. Either way the dice are yours and the tool never generates the numbers.
marked d6d10d10d10
THOUSANDSHUNDREDSTENSUNITS
0   1   20–90–90–9
PLACE DIE HEREPLACE DIE HEREPLACE DIE HEREPLACE DIE HERE
thousands — marked d6hundreds — colour ______tens — colour ______units — colour ______

The last word: the remaining bits

Your 11 or 23 words do not fill the phrase exactly. A few entropy bits are left over, and the calculator will show you every word that could validly finish the phrase — one row per possible value of those leftover bits. Those bits are real entropy: generate them the same careful way, then use the number as the row.

Method 1 — one flip per leftover bit. Nothing is ever discarded.
  1. Flip a fair coin once per bit, in order. Heads = 1, Tails = 0.
  2. That binary number is the row number. Nothing to add, divide or look up.
  3. No coin in the house? Any die with an even number of faces is one. Split its faces down the middle — on a d6 1,2,3 = 0 and 4,5,6 = 1, on a d10 1–5 = 0 and 6–10 = 1 — or read odd = 1, even = 0. Both splits are exactly even; pick one and keep it for the whole phrase.
  4. Every result is a valid row, so no throw on this route is ever wasted. That is what makes it the easier of the two at every length.
12 words15 words18 words21 words24 words
7 bits left over6 bits left over5 bits left over4 bits left over3 bits left over
rows 0–127rows 0–63rows 0–31rows 0–15rows 0–7
Method 2 — or read a decimal number off d10s, and discard what is too big
  1. 12 words, 7 bits: one d6 read as a coin for the hundreds plus two d10s → 0–199. Discard 128 or higher — about 36% of throws.
  2. 15 words, 6 bits: two d10s → 0–99. Discard 64 or higher — about 36%.
  3. 18 words, 5 bits: two d10s → 0–99. Discard 32 or higher — about 68%, which is a lot of binning for nothing; use Method 1 here.
  4. 21 words, 4 bits: one d6 read as a coin for the tens plus one d10 → 0–19. Discard 16 or higher — about 20%.
  5. 24 words, 3 bits: one d10 → 0–9. Discard 8 or 9 — 20%. A single 8-sided die also does it: roll it and subtract 1.
  6. Give each die its place before you throw, as with Method C above. A d10 showing 10 counts as 0. Nothing is divided and nothing is trimmed.
An invalid roll is not a failed roll. Throwing the whole thing away when it lands above the last row is what makes every row exactly as likely as every other. Keeping a roll because it was nearly in range is the only way to get this step wrong.

Never reduce a too-large roll with modulo, wrap it around, or simply pick a row that looks good. Discard and reroll.

Roll grid

Write each index in the column for the length you are building. The last word is never rolled — it carries the checksum and the calculator works it out from the words above it, which is why the tail of every column is dashed out. Write the numbers here if you must, never the finished phrase.

Roll #12-word15-word18-word21-word24-word
1
2
3
4
5
6
7
8
9
10
11
12—
13—
14—
15——
16——
17——
18———
19———
20———
21————
22————
23————
Free, independently created tool, provided as-is with no warranty and no liability. Not affiliated with any wallet manufacturer, exchange, or the Bitcoin Improvement Proposals project. Verify results independently before relying on this for anything of real value.
bip39toolbox.com

BIP-39 Offline Toolbox

Checksum calculator, phrase verifier, missing-word recovery and entropy converter — all running locally in your browser, on words you generated yourself.

What bip39toolbox.com can do for you

Safety firstWhen you are working on a real wallet this runs offline, on your own computer, never on a website. It refuses to run when served over the internet at all — that refusal is a hard gate, not a warning you can click past. Seven ways to check it instead of trusting itOne window collects every check you can actually run: the hash to compare against a page that is not this one, a one-line command that makes an unrelated program agree with its arithmetic, the self-test it ran when it opened, your own browser confirming it fetched nothing, and the word lists rehashed against the official ones. Each check says what it proves and what it leaves open, because a page that only listed reassurances would be indistinguishable from one written by whoever tampered with it. Generate the word that completes a phraseEnter the words you produced with your own dice or coins and it works out every word that can validly finish the phrase. The last word is not free: it carries the checksum, so only certain words fit, and the tool shows you all of them rather than choosing for you. All five BIP-39 lengths12, 15, 18, 21 or 24 words, not just the common two. Most wallets only offer 12 or 24, so the other three are rarely seen — but they are entirely valid, and a tool that rejected them would tell you your phrase was broken when it was not. Verify a phrase you already haveEnter all of it and find out whether the checksum holds. If it does not, you are told which word is most likely at fault and offered the near-misses from the word list, because a single mistyped word is the usual cause. Find a swapped pairAny two words the wrong way round, not just neighbours. If swapping words 3 and 9 makes the checksum pass, it says so precisely, instead of leaving you to guess which of sixty-six possible pairs went astray. Find a grid mix-upWallets show a phrase in columns, and it is very easy to copy the words down the columns when they were meant to be read across the rows. Every word is then correct and only the order is wrong — which looks exactly like a ruined backup. The tool spots that and prints the phrase in the right order. Recover one or two words you cannot readLeave the boxes blank and it lists every word that fits, from anywhere in the phrase. Two blanks work too, as long as you can still make out a few letters of one of them — faded ink and bad handwriting rarely destroy a word completely. Convert entropy to phrase and backEither direction, as hex or binary. Neither one invents anything: it is the same eleven-bits-per-word mapping the calculator uses, read forwards or backwards, so you can check the tool against itself. Dice and coin calculatorsType the faces you actually rolled and it does the arithmetic, so you are not converting base-6 in your head at two in the morning. It also tells you when to discard a roll, which is what keeps the result unbiased. A calculator for the last few bits tooIt appears in section 3, with the list of candidate words, because that is the point at which you need it. The final word needs a row number, and that is between three and seven bits of your own randomness. Flip a coin once per bit and tap the flips in — heads, tails, in order — and it reads off the row and the word, with nothing to discard, because every result of those flips is a row. Any die with an even number of faces is a coin if you split it down the middle, and if you would rather read a decimal number off d10s it takes that instead and says when a throw has to be binned. A wizard that walks you through the diceOne screen per word, with the dice drawn on it: the marked D6 as a square, the three D10s as coloured kites, each showing the number you tapped and repeating it underneath. It says which dice to throw, and it gives you the word to write down — then clears it before the next throw, so your phrase is never all on the screen at once. It refuses the throws that would bias the result and tells you which dice to pick up, so the part of Index Dice that needs understanding is the part it does for you. Index Dice, with a worksheet you can printFour dice — one marked D6 and three D10s — give a four-digit number that is the word's index outright, with no arithmetic at any step. Throw the first two on their own and most dead rolls are caught before you touch the other two, which is 15% fewer throws than rolling four at a time. The two-page worksheet opens in its own window and prints, so you can sit down with the dice and a pen and type nothing until the end. The full BIP-39 tableAll 2048 words with their index and 11-bit binary, searchable. Useful if you back up as numbers rather than words, and useful for checking that this file's list is the official one. Ten official languagesEvery word list BIP-39 defines, with English always selected on load. There is no official German list, so there is none here — a phrase built against an unofficial list is restorable by no wallet at all. A simple view and an advanced oneThe page opens with four technical tools folded away — raw entropy conversion, five-dice base-6 arithmetic, the full 2048-word list and the inactivity safeguard — so a first-timer reaches the guided wizard without scrolling past machinery they do not need yet. One button unfolds all of it, each section opens on its own if you want only one, and no warning, check or safeguard is ever hidden by either view. Answers, offline36 questions and answers built into the file, from what a checksum is to what to do when you cannot read a word. They work with the network off, which is exactly when you need them and exactly when a website cannot help you. Know which version you haveThe file states its own version and carries its full change history. Nothing phones home to check for updates — you compare it against the published list yourself, whenever you choose. Save a copyKeep a spare on another machine. No install, no account, nothing to update, and no service that can be retired underneath you — a copy in a drawer will still run in ten years.
And why you can check it rather than trust it: zero network requests, enforced by the browser · it refuses to run from a website · it re-proves its own arithmetic every time it loads · the whole source is one click away · nothing is stored but your light/dark preference · one button wipes every field, and an idle timer does it for you · the print sheet never contains your words · and one window walks you through checking every one of these.
Running self-test…
Re-proving the checksum math in your browser.

Why should I trust this?

You shouldn't — not on this file's word. Nothing written on this page is evidence of its own honesty, because a tampered copy would say every word of it too. What you can do instead is check it, and most of the checks take a minute: compare its hash against one published somewhere else, make an unrelated program agree with its arithmetic, read the self-test it just ran, have your own browser confirm it asked the network for nothing, and read the code.

Opens in a separate window, with the exact commands for each operating system, the live results from this copy, and — for every check — what it proves and what it leaves open. All of it works offline.

File integrity self-check

SHA-256 of this page as loaded: computing…

Verifying this file wasn't tampered with, if it was given to you by a third person and not downloaded directly from bip39toolbox.com

Did someone give you this file? If it reached you as an email attachment, a chat message, a USB stick or a shared folder — anything other than you going to bip39toolbox.com and downloading it yourself — then check it before you type a real seed phrase into it. A single altered character could silently hand your phrase to someone else.

For the best security, download it yourself from bip39toolbox.com. That is the recommended way to get this file, and it is the one case where an extra check is least likely to be needed. A copy that passed through someone else's hands is where it matters most.

Opens the step-by-step instructions in a separate window. Everything runs on this machine; nothing is sent anywhere.

BIP-39 Offline Toolbox

A seed phrase checksum calculator, verifier, missing-word recovery tool and entropy converter in one HTML file — running entirely on your own machine, with the network off. No accounts, no server, no dependencies, nothing to install. Free, and small enough to read in a text editor.

🔒 This calculator only runs when opened as a local file

You are viewing this page over the internet (), and the calculator is switched off. That is deliberate: typing a real seed phrase into any page served by a website means trusting the server, the connection and everyone in between. Download the file and open it from your own disk, and there is nothing left to trust but the file itself — which you can read.
  1. Download the file with the button below
  2. When using it for a real wallet, disconnect the device from the internet
  3. Double-click the downloaded file — it opens in your browser from disk, not from a website
  4. The calculator unlocks by itself once it sees it is running locally

🧪 Try it first, with nothing at stake

A practice run walks you through making a word with four dice — the throws, the two rerolls that are legal, and the word that comes out — using numbers written into this page rather than any of your own. It is the one thing here that works on a website, precisely because you type nothing into it and there is nothing for a server to see.

Clearly labelled throughout, and the words it produces are the same for every reader — which is exactly why they must never be used for funds.

🖨 The printable dice kit

Two pages you can work from away from the screen: page one teaches the throw, page two is a slot per die and a 23-row grid to write your indexes into. Print it, sit down with four dice and a pen, and type nothing until the end.

One small HTML page, openable and printable offline forever, with no reader to install. Your print dialog will save it as a PDF if you would rather have one.

What it does

Safety first

When you are working on a real wallet, the program runs offline, on your own computer — not on a website, not on anyone's server. Disconnect the machine, open the file from your disk, and nothing you type can leave the room. It enforces this rather than suggesting it: served over the internet, the calculator switches itself off and will not be argued with.

Generate

Enter the words you produced with your own dice or coins and it works out the word that completes the phrase. That final word is not free: it carries the checksum, so only certain words fit. The tool lists every one of them and lets you choose with your own randomness, because choosing by preference is how people quietly hand themselves a weaker phrase than they think they have.

All five lengths

BIP-39 defines five phrase lengths — 12, 15, 18, 21 and 24 words — and this handles all of them. Most wallets only ever offer 12 or 24, so the other three are uncommon but perfectly valid. A tool that only knew two would tell you your 18-word phrase was broken when the phrase was fine and the tool was not.

Verify

Enter a phrase you already have and find out whether the checksum holds. If it does not, you are not left with the word “invalid”: it points at the word most likely to be wrong and shows the near-misses from the official list, since one mistyped or misremembered word is much the commonest cause.

Every word right, wrong order

Wallets display a phrase in a grid, and copying the words down the columns when they were meant to be read across the rows is an easy mistake to make once and impossible to spot afterwards. Every word is correct and only the sequence is wrong, which looks exactly like a destroyed backup. This finds it, names the grid, and prints the phrase in the right order. It also tests every pair of words swapped, not just neighbouring ones.

Recover what you cannot read

Leave a box blank and it lists every word that fits that position. Two blanks also work, provided you can still make out a few letters of one of them — faded ink, poor handwriting and a badly struck steel plate rarely destroy a word completely, and the letters you can see are what make it solvable. When it genuinely cannot narrow the answer, it says so rather than handing you thousands of guesses.

Convert either way

Raw entropy in, phrase out — or a phrase in and its entropy back, as hex or binary. Neither direction invents anything; it is the same eleven-bits-per-word mapping the calculator uses, read forwards or backwards, which means you can use it to check the tool against itself.

Dice calculators & guides

Type the faces you actually rolled and it does the arithmetic, so you are not converting base-6 in your head. It tells you when to discard a roll and why — that discarding is not fussiness, it is the only thing keeping the result unbiased. There is a printable sheet for working away from the screen, and it never contains your words.

Index Dice, and a worksheet for it

Four dice — one D6 you mark 0 0 1 1 2 2 and three D10s — produce a four-digit number that is the word's index, with no arithmetic at any point. Throw the first two on their own and the rolls that can never come good are caught while only two dice are down: 2.5% of words have to be started over instead of 31.7%, and you throw about 15% fewer dice. A two-page worksheet opens in its own window and prints, with the die slots, both legal rerolls and a 23-row grid to write the indexes into.

A guided dice wizard

You do not have to read the worksheet first. A wizard takes one word at a time and draws the dice on the screen — the D6 you marked as a square, the three D10s as coloured kites — so matching a picture to the die in your hand replaces working out which one the text means. You tap the numbers they landed on and it hands you the word to write on paper — then wipes it from the screen before the next throw, so the phrase is never displayed all at once. It also enforces the parts that are easy to get wrong, refusing a throw that would bias the result and naming exactly which dice to pick up again, which is the difference between a method being correct and being followed correctly.

The full BIP-39 table

All 2048 words with their index and 11-bit binary, searchable. Useful if you back your phrase up as numbers rather than words, and useful for satisfying yourself that the list inside this file is the official one rather than something approximate.

Simple first, advanced on request

This file does a great deal, and a first-time reader should not have to scroll past raw entropy conversion and base-6 dice arithmetic to reach the part that walks them through making a word. So it opens with four technical tools folded away, each still showing its heading and a line saying what it is, and one button unfolds the lot. What is never folded away is anything that matters to safety: the warnings, the checklist, the load-time self-test, the hash panels and the disclaimer are on the page in both views.

Nothing left to work out by hand

The dice and the coins are yours; the arithmetic is not. Every throw goes into a box that names the word or refuses the roll — including the last few bits, the row number for the final word, which used to be a paragraph of base-6 arithmetic and is now one flip per bit with nothing ever discarded. Every refusal says why binning a roll is what makes the result unbiased, rather than leaving it looking like a mistake you made.

Answers built in

36 questions and answers travel inside the file: what a checksum is, why the last word is not free, what to do when a word is unreadable, and what this tool deliberately will not tell you. They work with the network off, which is precisely when you need them and precisely when a website is no use to you.

Checks, not claims

Once the file is open, a window headed Why should I trust this? collects the seven checks a reader can actually perform: comparing its hash against the value on a different page of this site, making an unrelated program reproduce its arithmetic from a single one-line command, reading the self-test it ran on load, having the browser confirm it fetched nothing at all, and rehashing all ten word lists against the official ones. Every check is printed with what it proves and what it leaves open — a page that listed only reassurances would read exactly the same whoever had written it.

Yours to keep

No install, no account, no expiry. It is one file. Nothing phones home to check a version — the file states which version it is and you compare that against the published list yourself, whenever you choose. Nothing stops working when a service is retired, and a copy on a USB stick in a drawer will still run in ten years.

Ten languages

Every official BIP-39 word list, with English always selected when the file opens. There is no official German list, so there is none here: a phrase built against a non-standard list is restorable by no wallet, which makes it not a backup but a loss with extra steps.

Why you can check it rather than trust it

Check the download before you trust it

Downloading from here is better than accepting a copy from someone else, but it is not a substitute for checking. Compute the file's SHA-256 after downloading and compare it against the hash published at bip39toolbox.com/hash — deliberately a different page from this one, so that replacing the download would not be enough to fool the check. The file explains exactly how, for each operating system, once you open it.

Found a mistake? Have a suggestion?

Corrections, unclear wording, and anything that behaves wrongly in your browser are all worth reporting — this tool has been improved by exactly that kind of message. Write to suggestions@bip39toolbox.com.

Never send a seed phrase, part of one, or any wallet detail. Not to this address, not to anyone, ever. Anything that looks like a seed phrase is deleted without being read. Nobody who legitimately helps you will ever need those words.

Nobody from this site will ever email you first, or ever ask you for your phrase. The only mail that could ever come from here is a direct reply to a message you sent yourself — and there is no guarantee of one. Anything unsolicited, and anything asking you to "verify" or "confirm" or "restore" your wallet, is a fraud regardless of what the sender address appears to say.

One person, no support desk, no guaranteed reply — silence is the normal outcome, not a sign anything went wrong. It is read, but treat it as a suggestion box rather than a help line — the answers to most questions are already in the file itself, under Help.

Free, independently created, provided as-is with no warranty and no liability. Not affiliated with any wallet manufacturer, exchange, or the Bitcoin Improvement Proposals project. Verify results independently before relying on this for anything of real value. The full disclaimer is in the file.

Help

New to this, or stuck? Start here.

What a seed phrase is, why the last word is not free to be anything, what to do when you cannot read one of your words, how to use every part of this tool — and what this file will not tell you.

Opens in a separate window. Every answer is already inside this file, so it works with the network off. Use your browser's find (Cmd/Ctrl+F) to search it.

Version

You are running —

This file never checks for updates by itself — it makes no network requests at all, which is the whole point of it. To find out whether a newer version exists, open bip39toolbox.com/versions and compare it against the version number above. Do that while this machine is still connected, before you disconnect it to work on a real wallet: once it is offline the button cannot reach the page, and the address is written out above so you can check it from a phone instead.

Before you begin — required checklist

The tool below stays locked until all three are checked.
Prints the checklist and the dice/coin guide only — never any words you have entered.
Walks through making a word with four dice using example numbers written into this file. No dice needed, nothing to tick first, and nothing you do in it is real.
Simple view

Generating your own entropy (the words you provide)

Each word needs to be chosen with 11 bits of genuine randomness (a number from 0 to 2047). Here are four reliable ways to do it using dice or coins.

Coin flips or 11 dice (simplest, no bias, no rerolls)

Flip a fair coin 11 times per word. Heads = 1, Tails = 0, in order. That gives you an 11-digit binary number (e.g. 01011010110) — paste it straight into the search box below.
No coin? Dice do the same job. Read odd = 1, even = 0 — a die's six faces split three and three, so that is exactly as fair as a coin flip. Either roll one die 11 times, or throw 11 dice at once and read them in a fixed order, left to right. Decide that order before you throw: picking it after seeing how they landed lets you steer the result. No arithmetic either way, and nothing is ever discarded.

Dice (5 six-sided dice per word)

advanced

Base-6 arithmetic on five ordinary dice, with two fair ways to discard the rolls that fall out of range. Correct, and more work than Index Dice — which needs no arithmetic at all.

Roll 5 dice. Subtract 1 from each face (so each die = 0–5), then combine as a base-6 number: (d1×1296)+(d2×216)+(d3×36)+(d4×6)+d5. This gives 0–7775 — more values than the 2048 you need, so some rolls have to be thrown away. There are two fair ways to do that:
Faces rolled — five dice, in order
Enter the five faces exactly as they landed, 1 to 6. Nothing is stored.

Index Dice (1 marked D6 + 3 D10's)

Four dice give you a four-digit number, and that number is the word — no multiplying, no adding, nothing to look up. Mark one D6 with a permanent pen first: two faces 0, two faces 1, two faces 2 — two per value, never three and three, or the split is uneven.
  • marked D6 → 0, 1 or 2  (thousands)
  • three D10s in three different colours → 0–9, reading 10 as 0  (hundreds, tens, units)
Give each colour a place before you throw — say red = hundreds, blue = tens, green = units — and keep it for the whole phrase. Three identical dice leave you deciding which is which after they land, and a die read in the wrong place is a different word.
Throw the first two dice on their own
  1. Throw only the marked D6 and the hundreds D10. Leave the other two alone.
  2. Those two read 21 or higher → throw those two again, until they read 20 or lower. In practice: the D6 shows 2 and the D10 shows anything but 0.
  3. Now throw tens and units, and read all four digits left to right.
  4. 2048 or higher → throw all four again. That is only 2.5% of words, about one in 40 — against 31.7% if you throw all four at once.
This is safe only because the last two dice have not been thrown yet — you are throwing a fresh pair, not steering a result you have already seen. Once all four dice are down, never change just one of them to make the number fit: that makes some words 1.25× likelier than others — worse still if you reroll the tens die too — silently, with nothing to show for it on the paper. Two legal rerolls — those two before the rest are thrown, or all four together — and no third.
An invalid roll is not a failed roll. Throwing away everything from 2048 up is what makes every valid index equally likely — it is the mathematical reason this method is unbiased, not a nuisance it puts up with.
2.5% rerolls against 31.7% is the whole point of splitting the throw: the pair that can never come good is spotted while only two dice are down, so it costs two dice to fix instead of four. Would rather throw all four at once? Do that and reroll all four on 2048 or higher — equally correct, and what this card said before v2.1.0, just slower.
No permanent pen? Any plain D6 does — faces 1,2 = 0   3,4 = 1   5,6 = 2 — but enter the 0, 1 or 2 below, never the face.
in throw order — the marked D6 and hundreds first, then tens and units
·
Enter the marked D6 value and the three D10 results. Nothing is stored.

The full BIP-39 word list

advanced

All 2048 words with their index and 11-bit binary, searchable. Useful if you back a phrase up as numbers rather than words, or want to satisfy yourself that the list in this file is the official one.

1. Choose what you're doing

The ten official BIP-39 lists. English is always the list on load.

2. Enter your words (in order)

Type each word you generated with dice or another random method. Only official BIP-39 words are accepted — the box turns green when a word matches exactly.

Entropy ↔ phrase

advanced

Convert raw bits to a phrase and back, as hex or binary. For anyone who already has entropy from somewhere else, or who wants to check this tool against itself by running the same mapping in both directions.

Convert either way between the raw bits and the words. Neither direction invents anything — it is the same 11-bits-per-word mapping the calculator above uses, read forwards or backwards.

For anyone who generated all the bits in one go — a coin-flip log, or a hex string from an offline generator — rather than word by word. Paste 128 bits (32 hex characters, or 128 binary digits) for a 12-word phrase, or 256 bits (64 hex, or 256 binary) for 24 words. The checksum word is computed for you, so this produces the complete phrase.

The other direction: phrase → entropy

Reads whatever is in the word boxes above and shows the entropy behind it, plus the index and 11-bit binary of every word. Useful for checking this tool against another one, or for writing the numbers down as a backup that does not depend on the English word list.

This is a second, independent route to the same phrase — useful as a cross-check against the word-by-word path above. It is not a random number generator: the bits must be yours, from dice, coins or hardware. Never paste entropy that came from a website.

How this works

A 12-word BIP-39 phrase encodes 128 bits of entropy + a 4-bit checksum (132 bits total ÷ 11 = 12 words). A 24-word phrase encodes 256 bits + an 8-bit checksum (264 ÷ 11 = 24 words). Your 11 (or 23) words already supply 121 (or 253) bits. That leaves 7 unknown entropy bits (12-word) or 3 unknown entropy bits (24-word) still needed before the checksum can be computed — this tool lists every word that could correctly complete your phrase for each possible value of those remaining bits, so you can pick one using your own independent randomness (e.g. roll a die to land on one of the rows below), rather than letting software choose for you.
Word list source & integrity
The 2048-word list embedded in this file was pulled directly from the official Bitcoin BIPs repository (bitcoin/bips, bip-0039/english.txt) and its SHA-256 hash was verified to match the published official checksum (2f5eed53a4727b4bf8880d8f3f199efc90e58503646d9ff8eff3a2ed3b24dbda) before being embedded here. A human-readable, indexed version of the same list is also available at:
github.com/hatgit/BIP39-wordlist-printable-en (for offline reference/printing only — this calculator does not load anything from that link).

Danger zone

When you're finished, clear everything from memory, and optionally remove the file itself from your computer.
What "master delete" does and does not cover. It clears and then re-reads every word input, the manual entry field, the results table and the final phrase, and it overwrites the tracked entropy byte arrays with zeroes. That much is genuinely verified rather than assumed.

It cannot overwrite JavaScript strings. Strings are immutable in JavaScript, so the words you typed, the assembled phrase, and the generated table markup may survive as unreachable copies in the browser's heap until garbage collection gets to them — there is no way for this page to scrub them in place. It also cannot touch your browser history, the disk cache, or OS-level swap and hibernation files.

So treat this button as tidying the screen and the buffers it can reach, not as a secure wipe. Closing the tab, quitting the browser, or working from an offline live-boot session that discards all state on shutdown remain the real mitigations — which is exactly why this note refuses to claim more than it can prove.

Inactivity safeguard

advanced

Optionally run “master delete” by itself after a set number of idle minutes, in case you walk away mid-phrase. Off unless you switch it on.

Off by default. In case you walk away mid-session with real words on screen. You'll get a 30-second warning first, and any keypress, click, or scroll resets the timer.

Disclaimer

This is a free, independently created tool, provided as-is and free of charge, with no warranty of any kind, express or implied. It is not affiliated with, endorsed by, or supported by any wallet manufacturer, exchange, or the Bitcoin Improvement Proposals project. You use this software entirely at your own risk. The creator(s) of this tool accept no responsibility and no liability whatsoever for any loss of funds, loss of access to a wallet, loss of data, or any other direct, indirect, incidental, or consequential damages arising from the use, misuse, or inability to use this software — including but not limited to software errors, user error, hardware failure, or the loss, theft, or exposure of a written seed phrase. Always independently verify results (see the "Word list source & integrity" section above) before relying on this tool for anything of real value.