Build a BIP39 Passphrase with Dice

Watch Joe’s companion guide, then follow the written method at your own pace. The six-word example is a demonstration, not a length limit. Print the wordlist before generating your own secret offline.

Most passphrase mistakes begin with vocabulary. Four different secrets get called “the password”, and they behave very differently.

Recovery seed

Also called the mnemonic seed or recovery phrase. Usually 12 or 24 words drawn from the BIP39 English list of 2048 words. The final word includes checksum bits as well as entropy bits, so many transcription errors are detectable. These words are the mnemonic, not the binary seed that BIP39 derives from it.

BIP39 passphrase

A technically optional extra string combined with the recovery seed when the wallet is derived. An absent passphrase is treated as an empty string. A different passphrase normally produces a different wallet. It has no checksum and no required wordlist.

Device PIN

Unlocks one particular piece of hardware. It is not part of the wallet and does not travel with your backups. Lose the device and the PIN no longer matters.

EFF wordlist

A 7776-word list published by the Electronic Frontier Foundation for Diceware-style passphrases, one word per five-dice combination. It is a tool for generating the passphrase, not a Bitcoin standard.

This guide uses EFF words to build a BIP39 passphrase. That combination is deliberate: the BIP39 list is optimised for machines to check; the EFF list is optimised for humans rolling dice and writing words by hand.

Arise strongly favours a correctly implemented, strong passphrase for substantial setups. That is an operational philosophy, not universal advice. A passphrase adds a second thing that must survive, be found and be typed exactly. If your arrangement cannot carry that weight reliably, it can make things worse. For the wider picture, see what self-custody actually involves.

Ask someone to invent a strong passphrase and you usually get a pattern: a pet’s name, a meaningful year, a capital letter at the front and a symbol at the end. Familiarity is not a reliable measure of strength.

It fails the first way because it is guessable. Pets, children, streets, teams and anniversaries are the first things an attacker who knows you, or has bought your data, will try. Password-cracking tools are built around exactly these habits: capitalise the first letter, append a year, swap an a for an @. Your creativity lands in the most-searched corner of the space.

It fails the second way because it is hard to reproduce. Was it Biscuit2014! or biscuit_2014? Did the exclamation mark come before the year? Was the dog’s name spelled the way your partner spells it? Years later, under stress, or in the hands of a successor who never heard you say it aloud, those small choices become unknowable.

Fair dice remove personal choice from word selection. Ordinary words and a consistent format make the result easier to read. Neither is a recovery guarantee: accurate records, legible backups and a tested successor path are what make the method useful beyond the day you create it.

This is the property that catches careful people. When you enter a BIP39 passphrase, the device does not check it against anything. It simply derives a wallet from the seed plus whatever you typed. A different string yields a different wallet, and that wallet is completely valid. It will usually be empty.

So a typo does not produce an error. A trailing space does not produce an error. A lowercase letter where you meant uppercase does not produce an error. Each one silently opens a different, usually empty wallet, which can look alarmingly like your funds have vanished.

Print the list first, then take the computer out of the process. The original EFF large wordlist pairs every five-digit code from 11111 to 66666 with a word. The Arise printable keeps every original entry unchanged; it only lays them out for lookup.

One die, five rolls. Roll, write the digit, and repeat four more times. The five digits in the order rolled are the code. This is the simplest method and the hardest to get wrong.

Five dice, one throw. Use dice you can tell apart: different colours or sizes. Declare the reading order before you throw, for example red, white, blue, green, black, and read them in that order every time. Never sort the dice from lowest to highest or read them left to right as they happen to land. Sorting collapses many combinations into one and quietly removes entropy.

Each of the five outcomes is independent. Look up the code, write the word next to it, and move on. If a word repeats, keep it. If you dislike a word, keep it. If a die lands cocked against a book or rolls off the table, redo that roll before you have looked anything up, so the decision cannot be influenced by the word.

This is Joe Turner’s repeatable practical method: dice rolled, codes read in a declared order, words looked up in print, then entered on a SeedSigner holding a disposable seed. Joe’s six-word video demonstration is an example, not a fixed length requirement. You can practise at a table without a screen until the recovery test.

Each fairly rolled EFF word is one of 7776 equally likely possibilities. That is log2(7776), about 12.925 bits per word, measured before formatting. Bits add up linearly with words.

BIP39 treats the passphrase as text; it does not mandate capitals or spacing. The convention below is an Arise operating convention, chosen to make the string easier to read off a metal washer and reduce avoidable transcription choices.

• All uppercase letters.
• Exactly one ordinary ASCII space between words.
• No spaces or characters at the start or end.
• Remove internal hyphens: drop-down becomes DROPDOWN.

Never reroll because a word contains a hyphen. Keep it and normalise it. The original EFF wordlist itself stays unchanged; the convention is applied only to the words you rolled.

One honest footnote. The list contains both yo-yo and yoyo as separate original entries, and both normalise to YOYO. Collisions like this mean the precise entropy of the final formatted string is marginally lower than the pre-format figures above. The difference is small; the table deliberately reports the original random selections, not an exact entropy calculation for the final string.

BIP39 also applies Unicode NFKD normalisation before deriving the binary seed. Different-looking Unicode strings can therefore be equivalent; that does not make case or ordinary ASCII spaces interchangeable. This convention uses plain A–Z letters and ordinary spaces to avoid that extra ambiguity. Record the complete string, not just word initials or the first four letters used by some mnemonic interfaces.

Write the convention down with your recovery instructions. A successor who finds six words on a washer still needs to know they are typed in capitals with single spaces.

Here is a worked example so you can check you understand the lookup and the formatting. Because it is published here, it is known to everyone. It is a teaching string and nothing more.

A passphrase you have not restored is a hypothesis. The test below uses a SeedSigner with a disposable demonstration recovery seed, and Sparrow as a watch-only companion. Device screens and workflows vary by version, so follow the current official documentation for the exact menus.

A passphrase doubles the number of things that must survive. Backups are where most of the real risk lives.

Metal for durability. For a MicroSeed metal-washer backup, plan around its actual usable space and the small printable capital letters you will record. Small lettering may need a magnifying glass to read and check. Before relying on any medium, test that your actual word length fits on it, legibly, with the spaces still obvious.

Complete copies, in different places. Keep multiple complete backups, geographically separated, so a single fire, flood or burglary cannot end recovery. If a long passphrase needs more than one washer, number and document them carefully and make each set redundant. Splitting a secret across pieces creates recovery dependencies: lose one piece and the others may be useless.

Mix media. Paper, steel and memory complement each other. Memory is useful for rehearsal and quick access, but it must never be the sole copy. Illness, injury and time can all interfere with recall.

Separation, with a path back. Storing the recovery seed and the passphrase in different places, where appropriate, means one discovered location does not hand over the wallet. But separation adds physical risk: more locations to secure, more journeys, more people who know something exists. Every extra copy improves survivability and widens exposure. There is no magical arrangement, only tradeoffs you choose consciously.

Separation must never mean that only you can put the pieces together. An authorised successor needs a documented, testable path to both secrets and to the formatting convention. How that path is structured legally is outside this guide and is not legal advice; the operational side is covered in Bitcoin inheritance and self-custody.