Dice Check – verify a SeedSigner dice seed

Did the SeedSigner get it right? Dice rolls in, BIP39 words out – offline, in your hands.

In dice mode the SeedSigner turns 50 rolls into 12 words or 99 rolls into 24 words. The math is openly documented: SHA-256 over the string of digits, then the BIP39 word list. If you don't want to take the device's word for it, do the math yourself once. That is exactly what this page does – no server, no connection, no third-party code. Everything lives in this one file.

⚠ Throwaway seeds only

The string of digits IS the seed. Whoever knows the 99 digits owns the wallet. So never check a seed here that will ever hold coins.
You are testing the method, not your real seed. If the device computes practice digits correctly, it computes everything correctly. Your real seed never leaves the device.
For anything serious, go offline: save the file, disconnect, double-click it. It works exactly the same. Close the browser afterwards.
A browser is not a vault: extensions, the clipboard and screen recording can watch. One more reason for throwaway seeds.

1. Enter the dice rolls

2. Words from the display (optional, for automatic comparison)

3. Result

Entropy (SHA-256 of the digits, hex):

Compare word by word with the device. All words identical = the device computed correctly. A mismatch almost always means a typo between your sheet and the device – check the digits, repeat the run. Then hit "Clear everything" and close the window.

What exactly happens here

Same math as the SeedSigner (SeedSigner OS 0.8.7, src/seedsigner/helpers/mnemonic_generation.py): the digits are taken as text and hashed with SHA-256. 99 rolls give 32 bytes = 256 bits = 24 words; for 50 rolls only the first 16 bytes = 128 bits = 12 words are used.
BIP39: a checksum is appended to the entropy (the first 8 or 4 bits of SHA-256 of the entropy), then everything is cut into 11-bit chunks. Each chunk is a number from 0 to 2047 pointing at a word in the official English word list.
Two engines: SHA-256 is computed once with the browser's built-in WebCrypto and once with a small, readable JavaScript implementation. A result is only shown if both agree.
Word list verified: the 2048 words are embedded in this file. On load their SHA-256 is computed and compared with the known value of the official list (2f5eed53…24dbda, identical to bip39_english.txt in the workshop pack).
Self-test: on load, both examples from the SeedSigner documentation (docs/dice_verification.md) are computed. The self-test only turns green if both match.
Nothing leaves the browser: the page carries a Content Security Policy that forbids every connection. Check for yourself: F12 → Network tab → apart from loading the page itself, no request appears, not even while computing.

Second opinion – don't trust the checker blindly either

A verification tool is an attack surface too. If you are serious, cross-check with a second, independent code base:

The script from the workshop pack: verify_dice_seed.py (Python standard library only, plus bip39_english.txt), run without arguments so it prompts for the digits. Works on Tails without network. The wrapper dice-check.sh checks both files against SHA256SUMS first.
Ian Coleman's BIP39 tool (bip39-standalone.html, opened offline): "Show entropy details" → actively click entropy type "Base 10", set "Mnemonic Length" to "24 Words" (or "12 Words"), then paste the digits. If the default "Use Raw Entropy" stays selected, nothing is hashed and the words differ. Never use the "Dice" mode – it turns every 6 into a 0 and produces different words while everything looks fine.
If two tools and the device agree, the method is proven. Then you roll the real seed – and never type it anywhere again.