Physical draws only. This version contains no random number generator of any kind. Every entropy bit comes from cards you shuffled, drew and typed in by hand. Nothing else is an input.
Wash the deck first. Spread all 52 cards face-down on the table and swirl them around
with both hands for at least 30 seconds, then square them up. A wash destroys the factory order far
faster than riffling does, and every entropy figure below assumes the order is gone. Only then riffle,
seven times or more, with a cut or a strip between each.
Use a sealed deck bought new from a shop (Bee, Bicycle, Copag 310…). Remove jokers and advertising
cards — 52 cards exactly.
Do this on an air-gapped machine.
The entropy is the leading bits of SHA-256 over your exact card sequence, so all 128 (or 256) entropy bits come from cards on the table. The BIP-39 checksum is then computed from that entropy exactly as the standard defines — checksum bits are redundancy, not entropy, so there is nothing to draw for and nothing to choose.
A single mis-transcribed card produces a completely different seed with no warning. Verify mode blanks every input and locks in a fingerprint of what you first entered; re-enter your draws from your paper record and the tool tells you whether they match, and exactly which draw differs if they do not.
A printable sheet with ruled boxes, sized to write in, matching the settings above. Fill it in at the table with a pen, then type it in. Keep the paper until your wallet is restored and tested, then destroy it.
There is no random number generator here to measure, so these tests prove the mapping is correct instead: the official BIP-39 vectors, SHA-256 known-answer tests, golden vectors that pin the entire card-to-seed pipeline to fixed expected output, and a sweep of 8192 derivations checked against an independent BIP-39 implementation and round-tripped back to entropy. Same result on every machine, every time. A golden vector fails only if this page has been altered. The third button runs the heavy test: it substitutes every card position with every legal alternative and demands the seed change each time. That is deliberately not a chi-square over many generated seeds — SHA-256 whitens its output, so a build that threw away a quarter of your cards would still pass every distribution statistic. It does not survive this one.
Everything else here rests on you running the genuine file. Nothing inside a file can establish that: a modified copy would happily tell you it is fine. The check has to come from outside.
Substitute whatever you actually named the file when you saved it.
Compare what you get against the hash published by the author — and compare it in more than one place. A single compromised host can change the file and the hash next to it; it cannot as easily change the same value on an independent channel. Check at least two of: the project site, the code repository, and a signed post on a network the author does not control.
Better still, verify a signature rather than a bare hash, so you are checking a key you already trusted rather than whatever the site says today. If the author publishes one, use it:
minisign -Vm "<file>" -P <author's public key> gpg --verify "<file>.asc" "<file>"
If the hash does not match, do not use the file, and do not use anything you already generated with it.
Clears every card you entered and everything derived from it — the entropy, the seed words, the derivation detail, the draw fingerprint, the shuffle check and all test output — then drops the references after overwriting what can be overwritten. Use it before you walk away from the machine.
Being straight about the limits: a web page cannot scrub RAM. JavaScript strings are immutable and garbage-collected, so overwriting a variable removes the reference but not necessarily the bytes. Nothing here reaches your swap file, hibernation image, downloaded PDFs or printed paper. Reloading afterwards discards the whole JavaScript heap and the text boxes' undo history, and closing the browser is better still.