My Seed PhraseiNothing leaves this page.
Offline: works with the wi-fi off.
One page: nothing to install.

The page has three panels, and they are the three jobs. Make a new seed: choose a length, press Generate, and your browser's cryptographic randomness draws every word. Roll your own randomness: roll a die, type the numbers in, and the app turns your rolls into the words: slower, and the one route that does not ask you to trust the browser's randomness at all. Finish a seed you already have: if you chose your first 11, 14, 17, 20 or 23 words yourself, by dice, by hand or with another tool, a wallet will reject the phrase unless the last word carries the right checksum, and this page lists every last word that works. The questions below are the fourth thing it does: explain why the last word is special, what the checksum does, and what makes a phrase strong or weak. For a seed that will guard real money, follow the six steps at the top and run this page offline first.

The page has three panels and each one keeps its own buttons and its own seed field. Nothing you press in one panel changes another. Closing a panel empties it, and so does opening a different one — the same as pressing that panel's Clear. A seed left sitting in a folded-away panel is still a seed on the screen of whoever opens the tab next, so it is not left there. Write your words down before you move on: nothing brings them back.

Make a new seed. Choose a length, press Generate, and a finished phrase appears in that panel's field, blurred until the eye reveals it. Clear empties it.

Roll your own randomness. Choose the length you want and the panel tells you how many throws it needs: 50 for a 12-word seed, 100 for 24. Type each throw as you go and the count keeps score. Make a seed turns the finished rolls into words, the eye in the corner of the box covers the numbers the way it covers the words, and Clear wipes the rolls and the seed together.

Finish a seed you already have. Type the words you have and press Find checksum words to list every final word that completes them. Click any one to see the finished phrase, or Pick at random to let the browser's cryptographic generator choose for you. Load example fills the field with the standard's published test phrase, which is safe to experiment with and must never hold funds. Clear empties the field and the list.

Above all three, Verify this page runs the built-in self-test: the page recomputes answers published in the BIP-39 standard, re-derives a seed from a fixed dice vector, and checks its own word list is unaltered.

Beside every seed field: the eye shows or hides the words, copy puts them on the clipboard, and the QR button shows them as a SeedQR a wallet can scan.

Because the last word is not a free choice. It carries a short summary, a checksum, of every word before it, so only a small set of words produce a phrase a wallet will accept. Pick any other and the wallet rejects the whole phrase as invalid. Working out which words qualify is what this page is for.

Far fewer than the 2048 words in the list, and fewer the longer your phrase. The last word has to carry the final scraps of your phrase’s randomness and the whole checksum, so the longer the phrase, the more of that one word is already spoken for. The table counts the checksum in bits, where one bit is a single yes-or-no answer.

Because a longer phrase spends more of its last word on the checksum, leaving less room for choice. Picking one word out of 2048 takes 11 yes-or-no answers, and a bit is one such answer. In a 12-word phrase the checksum claims 4 of the last word’s 11, leaving 7 free, and 7 yes-or-no answers cover 128 endings. In a 24-word phrase the checksum claims 8 and leaves only 3, so just 8 words can finish it. Every extra answer the checksum takes halves what is left to you.

This page only works out the final word. If a word is missing from somewhere in the middle, the checksum still narrows it down (for a 12-word phrase, to roughly 128 of the 2048 possibilities) but that is a different search, and this page does not do it.

No. The checksum is derived from your words, not the other way round, and it is not part of the secret. It exists so a wallet can catch a typo instead of silently opening an empty account. Someone holding only your last word learns nothing useful about the rest.

From the random number generator your browser provides for security work, crypto.getRandomValues. The everyday one, Math.random, is predictable enough that it should never choose a seed phrase, and it appears nowhere in this file. The word list holds exactly 2048 words, a round number in binary, so each draw lands on a word directly instead of being squeezed down to fit. That matters: squeezing is what makes some words come up slightly more often than others. Here every word is exactly as likely as every other.

Panel 1 uses it: press Generate and every word of the seed, including the last, comes from that generator in one press.

One route does not use it at all. Roll your own dice, type the numbers in, and your rolls decide every word; the app only does the arithmetic. That is the slow way, and the only one that does not ask you to take either the browser's generator or this page on trust. The same rolls always make the same words, so a hardware wallet given those same rolls can be used to check this page's answer rather than believe it.

Each throw of a six-sided die is one of six equally likely results, and the app collects enough of them to decide every word: 50 throws for a 12-word seed, 100 for a 24-word one, with a running count so you know when you have enough. Nothing is drawn from the browser.

You are not throwing words. You are throwing the randomness underneath them. A 12-word seed is 128 yes-or-no answers, plus four more worked out from those, and 50 throws is just enough to cover the 128. The app reads the words off that string, eleven answers to a word. So the last word is not left over for you to choose the way it is in the panel below, where you bring your own eleven words and seven answers are still unspoken for. Here its first seven came from your throws like every other word, and the four that finish it are worked out from the 128 you already threw. Nothing is left free, so there is nothing to pick. You can check that for yourself: drop the last word, paste the other eleven into the panel below, and the word your throws produced will be one of the 128 endings it lists.

The same throws always make the same seed. That is the point of doing it this way: a hardware wallet given those same throws produces the same words. That has been checked on a real device, not just worked out on paper, and it lets you check this page rather than believe it. It also means the numbers are exactly as secret as the phrase: anyone who has them can work out every word, on any computer, for ever. Keep them until the words are written down and checked, then destroy the paper you threw onto.

A cheap die is not perfectly fair. If you are unsure about yours, throw more than the minimum: a lopsided die tells you less per throw, and the extra throws make up the difference. What extra throws cannot do is make a seed hold more than its length allows: a 12-word seed tops out at 128 yes-or-no answers however many you throw, so 100 throws make a 12-word seed no stronger than 50 fair ones. If you want more than that, choose more words.

Not entropy; nothing can. Entropy is about how your words were chosen, not about the words themselves, so a genuinely random set can look terrible and a hand-picked one can look fine. What it actually does is hunt for the fingerprints of hand-picking: the same word repeated, words sitting in wordlist order, words bunched into one short stretch of the list. Then it works out how many phrases someone would still have to try if they noticed the same pattern. Treat that as the best case, never as proof your words are random.

It counts in bits. One bit is one yes-or-no answer a guesser has to get right, so every bit lost halves the work they face.

Because “the same word 23 times” is only 2048 different phrases, one for each word in the list, and singling out one in 2048 takes 11 yes-or-no answers. Repeating the word more times adds nothing at all: every word after the first is already decided. A 23-word repeat is exactly as weak as an 11-word repeat, which is the clearest demonstration there is that a long phrase is not automatically a strong one.

The randomness is the same quality: both draw from a proper cryptographic generator, and 24 random words is 24 random words either way. What differs is the machine. A hardware wallet builds the phrase on a device that does one job and never hands it to a computer running everything else you have installed. A browser on an ordinary computer cannot make that promise, which is why the steps above are worth following.

Dice close part of the gap. Roll them yourself and the words no longer rest on the browser's generator being sound, or on this page being the copy that was published: the randomness came off your table. The computer is still the computer, so the six steps still matter, but it is one less thing to take on trust.

Not while you are online, and not in a browser you use for anything else. That answer does not change with how much the wallet holds. A phrase copied today opens the wallet you fund next year just as easily, so “there is nothing in it yet” buys you nothing.

What this page promises is narrow, and you can check it rather than believe it: nothing you type ever leaves it, nothing is saved or logged, and your browser is told to refuse if anything here ever tried to send it. Press Verify this page.

What no web page can promise is the computer it runs on. A browser extension can read every word you type here, and nothing this page does will stop it. Your clipboard can be read by anything running on the machine. Until you close the tab, the phrase is still sitting in the browser’s memory. A computer that is already compromised will not be rescued by a web page.

So if the phrase is real, do it the other way round: save this page, disconnect from the internet, open it in a browser profile with no extensions, and work through the six steps at the top. And if you only want to see how this works, you do not need a real phrase at all: press Load example, or either generate button.

No. The page never sends anything anywhere, and it tells your browser to block the attempt if it ever tried. Nothing at all is fetched from the internet, not a typeface, not an image, not a line of code. Nothing is saved or logged either. That covers this page only, though: a browser extension can read what you type here, and no web page can stop it.

Press Verify this page. It takes a fingerprint of its own built-in word list and checks that against the official BIP-39 one, then works out the endings for nine example phrases whose correct answers are published in the standard. Change a single word in the built-in list and the fingerprint comes out different and the check fails.