Two d16 rolls and one d8 roll give you 11 bits — enough to pick a single word straight out of the 2048-word BIP39 list. Roll physical dice below and this instrument assembles a properly checksummed mnemonic as you go. The checksum bits at the very end are calculated, never rolled, so the last word always needs fewer dice than the rest.
Not sure your dice roll fairly? Check them first at dicecheck.com — opens in a new tab, so your progress here is safe.
Uses the same optional passphrase as above, if you set one, to derive the master key this indexes into. Each index is a fully independent hardened derivation: a leaked child phrase cannot be used to reconstruct the master or any other index — but the master (plus passphrase) can reconstruct every child, so it still needs the same care as the master itself.
16 = 24 and 8 = 23, so two d16 rolls plus one d8 roll give exactly 4+4+3 = 11 bits — the precise width BIP39 uses per word (2048 = 211 words). Each roll is entered in a fixed order: both d16s first, then the d8, with the first d16 contributing the highest-order bits.
A BIP39 phrase appends a checksum to the raw entropy before splitting it into words: 4 bits for a 12-word phrase, 8 bits for a 24-word phrase, always taken from the front of SHA-256(entropy). Those bits land in the low-order end of the final word, so they're never rolled — only calculated. Because 8 = 23 and 16 = 24 divide evenly into 4 and 8, the dice you'd skip are always whole rolls: for 12 words the trailing d8 is dropped (7 bits rolled from both d16s, 4 calculated); for 24 words the second d16 and the d8 are both dropped (3 bits rolled from the first d16 only, 8 calculated).
An extended public key lets software (or a person) generate every receiving address for one account — without ever seeing the private keys that can spend from them. xpub uses the older BIP44 derivation path and legacy address format; zpub uses BIP84 and native segwit (bech32) addresses, which is what most modern wallets default to. Which one you need depends on the wallet you plan to import into — showing both avoids guessing.
BIP85 turns one master phrase into a source of many others: it derives a fully hardened key at m/83696968'/39'/0'/{words}'/{index}', runs it through one more one-way hash, and feeds the result back into the same entropy-to-mnemonic process used above — producing a brand-new, unrelated-looking phrase for each index. Because the derivation is hardened, the relationship only runs one way: the master (with its passphrase) can always reproduce every child, but no child, however many leak, can be used to reconstruct the master or any sibling.
Everything lives in page memory only — there is no localStorage use anywhere in this tool, unlike the dice-fairness testers in this same family. Reloading, closing the tab, or clicking Clear all erases every roll, the mnemonic, and any derived keys. Nothing is ever sent over the network by this page's own code.