Making a wallet

Three ways to get a seed, and they are not equivalent. The setup screen says which is which.

Dice

100 rolls of a six-sided die; 99 would be 255.911 bits, short of 256. The bit count is truncated, never rounded, so it never claims more entropy than you provided. One digit a hundred times is accepted, with a comment; the device does not discard your rolls. ENTROPY.md has the encoding and a worked example to reproduce with sha256sum on any machine.

The device will roll for you if asked, one at a time or the rest at once, from its own generator with the bias removed. The arithmetic stays checkable but those rolls do not, since you did not watch them land; the screen counts them. Only rolling by hand avoids trusting the device.

Letting the device choose

No dice: what every other hardware wallet does by default. It is unverifiable, because a correct generator and a backdoored one both hand you 24 words. The device checks that its generator is present, is not returning a constant, and that the kernel pool is seeded. That catches a broken generator, not a predictable one, and the screen says so. Nothing is generated until you tick that you understand the result cannot be reproduced or checked by hand.

Writing the words down

Shown once. You cannot continue until you tick that you wrote them down. The words are the wallet. The paper, not this device, recovers the money.

The passphrase

Protects the copy of the seed stored on this device. It is asked for twice, because a wallet sealed under a typo cannot be opened. You may skip it; the screen says that a wallet held only in memory is gone at the next reboot.

Ten wrong attempts in a row erase the wallet from the device. That stops someone guessing at a device they picked up, not someone who copied the card first. Against them, the passphrase is the real protection.