Complete physical entropy procedure

Before you begin

Decide the complete wallet configuration before generating words: signer model, firmware, single-signature or multisignature policy, address type, passphrase policy, backup media, recovery device, and who must be able to recover the wallet later.

Inspect the generation materials

• Confirm exactly 2,048 unique English BIP39 word slips are present.
• Set the four blank write-in slips aside. They are never part of the entropy draw.
• Reject missing, duplicated, marked, stained, damaged, or differently sized slips.
• Confirm folds and paper weight do not make any slip detectable by touch.
• Prefer the open print files when you do not want to trust a manufactured set.

A purchased set introduces supply-chain trust. Its completeness and uniformity must be checked independently before it is used.

A blank can hold the separately calculated final word in the taped-slip alternative. It can also replace one defective official-word slip before generation: copy that exact word, remove the defective original, and then re-verify that the pool contains one copy of every official word.

Generate the words

1. Remove cameras, microphones, connected computers, phones, and other observers from the workspace.
2. Place only the 2,048 verified official-word slips in a clean, opaque container large enough to separate and mix every slip. Keep all blanks outside the container.
3. Mix longer than feels necessary. Break apart clumps and ensure slips do not remain stacked.
4. Without looking, draw one slip. Read it only after it has cleared the container.
5. Write the word in the next numbered position on both paper backup cards.
6. Return that same slip to the container before making another selection.
7. Remix the entire set before every draw.
8. Stop after 11 recorded words for a 12-word phrase, or 23 for a 24-word phrase.

Entropy assumptions and limits

Eleven ideal independent uniform draws from 2,048 equally likely outcomes contain 121 bits of structural capacity. Twenty-three contain 253 bits. These are not measurements of a particular physical session.

The figures require all of the following assumptions:

• the complete official vocabulary is present exactly once;
• no slip can be distinguished before selection;
• the container and mixing method do not favor a region or cluster;
• the selected slip is replaced every time;
• each selection is made without observation or conscious choice.

For 12- and 24-word phrases, BIP39 begins with 128 or 256 entropy bits; the standard does not prescribe how those bits are generated. HAT39 is an independent manual-generation convention whose output is BIP39-valid; it is not a new requirement added to BIP39.

Complete the final word

The first 11 or 23 words leave 7 or 3 entropy bits unresolved. HAT39 fixes those bits to zero, calculates the standard BIP39 checksum, and obtains the checksum-valid final word with the lowest official word-list index.

Device procedure

1. Use a device or offline tool listed in the documented compatibility table.
2. Enter only the 11 or 23 words in the offline environment.
3. Select its deterministic zero-suffix path or manually choose the lowest-index valid candidate.
4. Write the result into position 12 or 24 on both backups.
5. Confirm that both written copies match before continuing.

Prove recovery before funding

Checksum validity detects only some errors. It does not prove that spelling, word order, passphrase, derivation path, address type, multisignature policy, or device configuration are correct.

1. Initialize the intended wallet with the completed phrase and exact intended configuration.
2. Record the master fingerprint where the device exposes one. Otherwise record a known first receive address together with the precise wallet settings.
3. Use the wallet’s built-in backup check or perform a controlled recovery on a dedicated device.
4. Confirm the same fingerprint or receive address is reproduced.
5. Receive and spend a small test amount.
6. Only then consider depositing meaningful funds.

Store backups in separate failure domains

Paper is an immediate recording medium. It is vulnerable to fire, water, fading, separation, theft, discovery, pests, and accidental disposal. Move at least one verified copy to durable storage appropriate to your threat model.

• Keep verified copies in distinct physical locations.
• Do not photograph, scan, email, message, or cloud-sync them.
• Plan inheritance and emergency access without placing instructions and secret material together unnecessarily.
• Periodically confirm that the backup remains readable and the recovery process remains understood.

Temporary taped-slip backup—not the recommended entropy procedure

Drawing and taping slips without replacement creates an immediate physical backup, but it changes the outcome distribution, prevents repeated words, and creates a dangerous incomplete remainder.

Stop after taping 11 or 23 entropy slips. Do not draw position 12 or 24. Calculate the lowest-index checksum-valid final word separately, write it on one of the blanks that stayed outside the draw pool, and tape that blank into the final position.

Technical references

• BIP39 specification ↗
• Documented final-word compatibility and primary sources
• Open print materials, hashes, and generators

This reference is educational. It does not guarantee protection against user error, device compromise, physical coercion, loss, or implementation defects.