How many dice rolls do I need?

The answer at a glance

Each roll of a fair six-sided die adds about 2.585 bits of randomness. A 12-word seed holds 128 bits and a 24-word seed holds 256 bits (BIP-39, the standard behind seed words).

Where 2.585 comes from

A die has six faces. One roll picks one of 6 outcomes. Two rolls pick one of 6 × 6 = 36. Ten rolls pick one of 6 ^{to the power of 10} = 60,466,176.

Bits count the same thing in powers of two: 1 bit is 2 possibilities, 2 bits are 4, 10 bits are 1,024. One die roll is worth log _{base 2} 6 ≈ 2.585 bits, because 2 ^{to the power of 2.585} ≈ 6. So n rolls give n × 2.585 bits:

• 50 × 2.585 = 129.2 bits: just over the 128 of a 12-word seed. 49 rolls give 126.7, which falls short.
• 99 × 2.585 = 255.9 bits: the 24-word target.

Why 99 and not 100?

99 rolls give 255.9 bits, a hair under 256. Coldcard and Keystone both use 99 as their 256-bit target. The missing tenth of a bit means about 6% fewer possible seeds, out of a number 78 digits long. If you would rather clear 256 outright, roll 100.

More rolls do not make a bigger seed

A 24-word seed holds at most 256 bits, so 128 rolls still give you a 256-bit seed. The extra rolls only buy a margin in case your die or your throws are a little less random than perfect.

Common mistake: thinking that 24 words protect you however they were made. The word count only sets the maximum. Built from 25 rolls on a dice-only option, a seed holds about 65 bits, even though it still comes out as 24 words.

Why roll dice at all?

Normally your hardware wallet makes the randomness for you, and for most people that is fine. BitBox, for example, recommends its normal setup to most users. The catch is that you cannot check a device's random generator yourself.

In July 2026 that gap mattered. A firmware flaw meant some Coldcard devices did not gather enough randomness when they made seeds. Coinkite, the maker, says seeds made on the Mk4, Q and Mk5 before the fix have about 72 bits of entropy rather than the expected 128 bits, that seeds made on older Mk2 and Mk3 firmware (4.0.1 to 4.1.9) were hit harder, and that updating the firmware does not repair an existing seed.

The people who had added their own dice rolls were in a different position. Coinkite's advisory says the flaw does not remove independent entropy that you supplied with dice, and that with at least 50 fair, independent rolls that were never recorded or exposed, it does not consider the seed at risk from this issue alone. Dice let you supply the randomness yourself, so your savings do not rest on one generator you cannot inspect. If you have a Coldcard seed, start here:

• Was my seed affected by the 2026 Coldcard flaw?
• What happened and exactly what to do
• Why three keys from the same maker are not real multisig

Dice can also make things worse

Dice are only as good as the way you use them. BitBox says that creating your own entropy is optional and does not automatically make your wallet more secure. Coldcard puts it this way: The resulting seed is only as strong as the fair, private, and sufficient dice sequence used to create it.

A worn die, numbers you pick instead of throw, results you skip, or a phone camera in the room can leave you with a seed that is weaker, or that someone else knows. If you will not follow the steps below carefully, your device's normal setup is the safer choice.

Every device uses dice its own way

The counts on this page assume that each throw of a six-sided die is entered and counted, which is how Coldcard and Keystone describe it. BitBox02 works differently. Your device's own instructions win over this page.