VOIDFORGE

Copying words by hand is where real backups go wrong. This gives you a random practice phrase to write on paper, hides it, then checks the copy you type back in. Do it once before the real thing. The practice phrase is made on the spot and is only for practice: never put money on it.

1. Copy this single file to a USB stick and open it on an air-gapped computer.
2. Press SELF-TEST and confirm it says all tests passed.
3. Choose Dice or Coin, enter your physical rolls or flips, and press FORGE SEED. For coins, decide which side is 1 and which is 0 (heads = 1, tails = 0 is the usual choice), use it for every flip, and record the exact 1/0 string with your backup. You can type, paste, or tap the buttons above the box.
4. Compare the words and the master fingerprint with a second independent offline tool before trusting real funds.
5. To check a backup later, type the words into VERIFY, add the passphrase if you used one, and paste the fingerprint or first address you wrote down into the last box. VERIFY tells you whether it matches without a passphrase, with it, or neither.

Plain-word meanings of Bitcoin terms, not only the ones VOIDFORGE uses: keys and seeds, wallets, transactions, mining, Lightning, privacy and more. Search it or pick a topic. It is built into the page, works offline and stores nothing. It is updated with every release, and where a word appears in VOIDFORGE the entry says where.

VOIDFORGE is free and open source, and it works without any account. If it helped you and you would like to support its development, you can send a few sats over Lightning. It is entirely optional and changes nothing about how the tool works.

This page never goes online, so nothing is sent from here: scan the code with a Lightning wallet on your phone, or copy the address into one. The same address and code are in the project README on GitHub. Be wary of any other “VOIDFORGE donation” address, and never send seed words or a passphrase to anyone, for any reason.

Lightning address: dev@breez.tips COPY

Same thing as a payment code (LNURL): LNURL1DP68GURN8GHJ7CNJV4JH5TN5D9C8XTMVDE6HYMRS9AJX2ASZ5RD0C COPY

This page works offline, but the browser and computer around it can still keep copies of what you see. None of these steps is hard, and each one closes a real gap.

1. Go offline first. Turn off Wi-Fi and unplug the network cable before you open the page. The “appears to be online” banner is only a hint, so do not rely on it.
2. For real funds, open the file from a USB stick or a local folder on an offline computer, never from a website. Check the file’s SHA256 first (see the README). The online copy on the project page is for practice only. Its address is random21m.github.io/VOIDFORGE, the only link on this page; it opens in a new tab, and your browser contacts that site only if you click it.
3. Use a fresh browser window with extensions turned off. A private window is not enough: extensions can still read every page.
4. Turn off page translation, read-aloud and screen sharing. Translation tools may send the page text, including your words, to a server.
5. Mind the clipboard. Copying seed words or a SeedQR can leave them in clipboard history, and some systems sync that history. Clear it afterwards, or write by hand instead of copying.
6. Printing and “save as PDF” make files. Delete them and check the printer queue afterwards. A printer that is not on a network is best.
7. Check the Downloads folder and any auto-saved files when you are done, and delete anything you made.
8. Finish by closing the page, then restart the browser or, better, the computer. That clears what the page left in memory.

A browser is not a hardware wallet. This checklist lowers the risk; it does not remove it, which is why we also ask you to test with a small amount first.

• Nothing is sent anywhere. The page has no code that talks to the internet, and a rule built into the file (a Content-Security-Policy) tells the browser to block all network access as a second line of defense. You can read the file to check; there is no server, no account and no tracking.
• Only two things are remembered between visits: your light or dark choice and your text size, in your browser’s local storage. Your rolls, flips, words, passphrase and fingerprint are never stored. Close the page and they are gone from the page.
• Your secrets live only in the page’s memory while it is open. The WIPE button and closing the tab clear them from the page, but not from anything your computer copied in the meantime (see the safety checklist above).
• Things leave the page only when you press a button for them: COPY (to your clipboard), PRINT, and DOWNLOAD. Each one makes a copy outside the page, so each is your call.
• Secret and public are labelled. Words, the passphrase and SeedQR are secret. The fingerprint, addresses, watch-only export and multisig descriptor are public data, safe to show a second computer, though they let others see your balance.
• The practice phrase is not a real seed. It is made fresh each time just to practise writing words down and is forgotten as soon as you clear it.

A multisig wallet is built from N separate seeds and spends only when M of them agree. With 2-of-3 you can lose one seed, or have one stolen, and still be safe. It is the standard way to remove the “one piece of paper” risk.

• Back up the descriptor too. The seeds alone are not enough: to find the money you also need the list of all the public keys (the descriptor, or the printed recovery sheet). It contains no secrets, so keep copies in several places.
• Keep every seed in a different place, and make each one on a different day or device if you can.
• Never reuse a seed as two of the keys, or the same seed in two different multisig wallets of the same account.
• Test with a small amount first, and practice recovering with M of the seeds before you trust it with real savings.
• Spending needs a wallet app (Sparrow, Nunchuk, Bitcoin Core) plus signers. VOIDFORGE only sets the wallet up; it never signs.

SHA256(input string) → first 16 bytes (12 words) or 32 bytes (24 words) → BIP39 mnemonic + checksum

The roll or flip string is hashed as plain text. Dice are digits 1–6; coin flips are the characters 1 and 0 (choose which side counts as 1 and keep the exact string). This is the same method SeedSigner uses for its 12/24-word dice and coin-flip modes, and VOIDFORGE reproduces SeedSigner’s published dice examples. Coldcard uses the same dice method (SHA-256 of the roll digits as plain text; 24 words, or the first half of the hash for 12), and VOIDFORGE reproduces the worked example in Coldcard’s documentation: the rolls 123456 give mirror reject rookie … garment (24 words). That example is too short to be safe; it only proves the method matches. Only 12- and 24-word seeds are generated, so every seed can be reproduced by SeedSigner-style tools. The VERIFY box still accepts 12, 15, 18, 21 and 24-word phrases from other tools.

PBKDF2-HMAC-SHA512(mnemonic, "mnemonic"+passphrase, 2048) → seed
HMAC-SHA512("Bitcoin seed", seed) → master private key
secp256k1 pubkey → RIPEMD160(SHA256(pubkey)) → first 4 bytes

Fingerprint picture. Next to the master fingerprint is a small coloured picture (a LifeHash, version 2, made from SHA-256 of the fingerprint). Sparrow Wallet shows the same picture for the same fingerprint, so a matching picture is a quick visual sign that you are looking at the same wallet. It is only a convenience: the 8-character fingerprint and the first address are the real checks, and the picture does not depend on your keys beyond the fingerprint.

Watch-only export. After FORGE, the box “Watch-only wallet” shows the public key of the account m/84’/0’/0’ as a zpub (Electrum, Blue Wallet, Sparrow) and as output descriptors wpkh([fingerprint/84h/0h/0h]xpub…/0/*) for receiving and /1/* for change, with the descriptor checksum (Sparrow, Nunchuk, Bitcoin Core). The Network menu switches to testnet (test coins only; keys start with tpub, upub or vpub). The two Multisig cosigner choices give the BIP48 key (Zpub or Ypub) plus its origin, to add as one cosigner in a multisig wallet. The Address type menu switches it to Taproot (tr, BIP86), Nested SegWit (sh(wpkh), BIP49, ypub) or Legacy (pkh, BIP44), and the Account box changes the account number (almost always 0). It holds no private keys and cannot spend, but whoever has it can see every address and balance of that wallet, so give it only to your own wallet app. It is specific to the passphrase you entered. The SHOW QR buttons draw the same data as a QR code on screen so another device can scan it (many apps accept a scanned zpub or descriptor; if yours does not, use COPY). After importing, check that the app’s first receive address equals the First receive address shown here.

First receive address. Also shown is the first Bitcoin mainnet receive address of a standard native SegWit (BIP84) wallet: BIP32 child keys along m/84’/0’/0’/0/0, then RIPEMD160(SHA256(pubkey)) encoded as a bc1q… bech32 address. Use it to cross-check against a wallet that imports the same words (a watch-only wallet is enough): the fingerprint alone is a weak check, a matching first address is a strong one. It is only correct for wallets that use the BIP84 path; other wallet types (legacy, nested SegWit, Taproot) show different addresses. It includes the passphrase if you entered one; VERIFY shows it without a passphrase and, if you type one into its own passphrase box, with it too.

RIPEMD-160 and secp256k1 are implemented in this file (no libraries). The curve code is not constant-time, which is fine offline but another reason never to run this on a networked or shared computer. The fingerprint includes the optional BIP39 passphrase; VERIFY shows it without a passphrase and, if you type one into its own passphrase box, with it too.

It runs automatically every time the page loads; if any test fails, seed generation is disabled and a red banner appears. Press SELF-TEST to see the full list. It checks: the BIP39 wordlist hash; official BIP39 entropy vectors (12 to 24 words); SeedSigner’s published 50- and 99-roll dice examples and 50-roll fingerprint; coin-flip vectors from an independent reference implementation of SeedSigner’s method; the abandon…about fingerprints (with and without the TREZOR passphrase); BIP32 test vector 1; the first receive address (the published BIP84 vector, a second vector from two independent libraries, and the BIP173 bech32 example); the watch-only zpub (published BIP84 vector and an independent-library vector), the descriptor checksum, a QR code matrix checked against an independent QR library, and the fingerprint picture checked against independent LifeHash code and Sparrow Wallet; passphrase normalization; RIPEMD-160 vectors; and the phrase checker. If any test fails, do not use that copy for real funds.

What the self-test cannot catch: it only runs known answers through this same file, so it can miss a bug on inputs it does not cover, and a tampered file could simply fake a pass. It does not replace checking the file’s SHA256 against the release, and it does not replace comparing your words and fingerprint in a second independent tool. The network tag at the top reads the browser’s online flag only; it cannot prove the machine is air-gapped.

• Only use this offline, on a computer. Never type a real seed into a phone, website or online tool; phones and file previews often will not run this page at all.
• The randomness meter checks face counts, long runs, repeating or stepping patterns and periodic repeats. It is advisory only: it catches lazy input, not subtle bias, and cannot prove your dice or coin are good. If it flags a pattern, FORGE SEED asks before continuing.
• A Content-Security-Policy built into this file tells the browser to block all network access, as a second line of defense. It does not replace using an offline computer.
• This page contains no links, and switching between dice and coin clears the entered rolls (after asking).
• The red "appears to be online" banner is a hint from the browser, not proof. A machine can be connected without the browser knowing, so physically disconnect it.
• Text boxes turn off spellcheck, autofill and autocorrect so the browser doesn’t keep what you type. The passphrase is masked, and is never shown with, copied with, printed with or saved with the words.
• There is deliberately no "copy seed" button. SEND TO VERIFY moves the words to the VERIFY box without the clipboard, but that only re-runs the same code. For a real check, write the words down by hand and type them into a second tool. The clipboard is where seeds most often leak. PRINT SEED and DOWNLOAD ask for confirmation because the print spooler and your disk can retain the seed.
• DOWNLOAD FOR USB saves a clean copy of this page and never includes a generated seed. It is re-serialized by the browser, so its file hash will not match the original; to verify a hash, copy the original file instead. DOWNLOAD (seed) writes your seed and rolls to a plain-text file, so only use it on a trusted offline machine.
• No independent security audit has been done. This software is provided “as is”, without warranty of any kind (MIT license), and the author is not liable for any loss. You alone are responsible for your funds, your backups and how you use it. If you lose the words or the passphrase, nobody can recover the funds. Before trusting it, check the release hash, use an offline computer, restore the wallet from your written backup in a second tool, and move a small amount first. It is not financial, legal or security advice.

• 1.29.0 — More from BIP85: keys, passwords and dice. The Child seed (BIP85) card in EXTRA TOOLS has a new “What to make” choice. Besides seed words it now makes every other BIP85 output a wallet or password manager can use: a Bitcoin Core HD seed (WIF), a master xprv (shown with its master fingerprint), hex bytes (16 to 64), a password in Base64 (20 to 86 characters) or Base85 (10 to 80), and dice rolls for any die from 2 to 2,147,483,647 sides (up to 1,000 rolls, numbered from 0 as BIP85 says). All are recreated from the parent words, passphrase, type, settings and index, and all are secret like the parent. Dice need SHAKE256, which the page now has; it is checked in the self-test against the published BIP85 vector and in the tests against Node’s own SHAKE256. Every new output matches the published BIP85 test vectors and an independent implementation. Seed words, fingerprints, addresses, keys and descriptors are unchanged from v1.28.0. The project owner’s logo (a bloodhound in a worn cap) now shows in the top-right corner as a small picture built into the file (not a link, nothing loaded from the network); it is left off printouts. The page now tells browsers not to translate it, because a translated seed word is a wrong seed word; if your browser offers to translate anyway, say no. The passphrase help also notes that some hardware wallets limit passphrase length or characters, so test a small amount first.
• 1.28.0 — Reforge: recover a seed or find a passphrase. A new Reforge tool in EXTRA TOOLS replaces Find the last word. In Missing or wrong words you type your words with ? for any you lack; it fills in one or two unknown words, finds one wrong word or two swapped words, or puts back a word missing from an unknown place, and checks every candidate against your wallet’s master fingerprint, an address (receive addresses 0 to 9 of account 0) or its account xpub/ypub/zpub, with your passphrase if you use one. In Passphrase it tries your guesses alone and joined in twos and threes, in four letter cases, and optionally with one typo. It reports only what matched, says how likely a fingerprint match is to be a coincidence, says plainly when nothing matched and what it searched, refuses an address with a typo before starting, and STOP ends a long search. Typing 11 words and ? lists the possible last words, as Find the last word did, and 4-letter word forms are read. Every search plan is checked in the test suite against independent libraries (@scure/bip39, @scure/bip32, @scure/btc-signer). Also: a typed word that happens to be a JavaScript property name (such as “constructor”) is now reported as an unknown word in CHECK A BACKUP instead of as a failed checksum. The dice logo now shows as the page icon in a tab or bookmark (built into the file, no network), and the About page now says the online copy on the project page is for practice only and links to it. Closing the opening notice no longer pops up the on-screen keyboard on a phone or tablet. This is the only link on the page; it opens in a new tab and does nothing unless you click it. Words, fingerprints, addresses, keys and descriptors are unchanged from v1.27.3.
• 1.27.3 — Check your download, Support this project, Bitcoin dictionary, and uniform colors. A new Check your download tool in EXTRA TOOLS lets you pick the voidforge.html file you downloaded and compares its SHA-256 and CID against what you paste from the release page, entirely offline. A new, optional Support this project box in ABOUT & HELP has a Lightning address and QR code; nothing is sent and the box is closed by default. The Bitcoin dictionary in ABOUT & HELP grew from VOIDFORGE-specific terms to 259 general Bitcoin terms across 12 topics, searchable and offline. Every main action button (FORGE SEED, START DRILL, START PRACTICE, CHECK MY PAPER, CHECK ADDRESS, FIND LAST WORD, INSPECT, COMPARE, DERIVE CHILD SEED) is now the same cyan primary color, so the important action on each card stands out; small helper buttons (COPY, SHOW QR, HIDE, PRINT, UNDO) stay grey. DEMO ONLY and ADVANCED badges are now a pink accent instead of grey, and both “NEW” badges on the page use the same cyan style. Nothing that touches your seed changed, so words, fingerprints, addresses, keys and descriptors are identical to v1.27.2.
• 1.27.2 — 3D dice header and clearer labels. RECOMMENDED is now an amber badge (the same amber as the audit notice), and DEMO ONLY, ADVANCED and NEW are small grey badges instead of words in brackets. The three dice that fall onto the title are now small 3D cubes with six pipped faces, they land behind the status line instead of over it, and VOIDFORGE has a crisp neon glow. Nothing that touches your seed changed, so words, fingerprints, addresses, keys and descriptors are identical to v1.27.1. Pure CSS, no images, no network.
• 1.27.1 — Gold coin buttons. In coin mode the two tap buttons are now drawn as gold coins: a head for HEADS = 1 and a star for TAILS = 0. They add exactly the same 1 and 0 as before, so seeds, fingerprints, addresses, keys and descriptors are identical to v1.27.0. The picture is drawn by the page itself (no image files, no network).
• 1.27.0 — Restore drill. After FORGE SEED, a new Restore drill card (in the Check step) hides the words on screen and has you type them back from your paper. The page tells you which word positions are wrong, never what the right word is, so it tests the paper and not your memory of the screen. If the seed has a passphrase you type that too. When everything matches, the page shows the master fingerprint your paper rebuilds. Changing or clearing the seed ends the drill and wipes what you typed. Nothing is stored. Nothing else changed: for the same inputs, words, fingerprints, addresses, keys and descriptors are identical to v1.26.2.
• 1.26.2 — Clearer buttons. CLEAR is now red, because it wipes the page, and SELF-TEST is now green, because it shows the page is working. The footer spells the project name the way GitHub now does. Nothing else changed: for the same inputs, words, fingerprints, addresses, keys and descriptors are identical to v1.26.1.
• 1.26.1 — Stale results fixed, and a way out of GUIDE ME. Reported privately by a user: after FORGE, editing the rolls, the word count or the passphrase left the old words, fingerprint and address on screen, so they could be saved or copied as if they belonged to the new entries. Now any such edit clears the old result at once and asks you to press FORGE SEED again. The saved file also always records the rolls that made the words. Separately, the GUIDE ME card now has an EXIT GUIDE button on every step. For the same inputs, words, fingerprints, addresses, keys and descriptors are identical to v1.26.0.
• 1.26.0 — Five addresses. The Watch-only box now shows the first five receiving addresses for the address type, account and network you pick (native SegWit, Taproot, nested SegWit or legacy), with a COPY ALL button, so you can compare them in your wallet app. A short note explains that your words do not depend on the address type, so write the type down with your backup. Words, fingerprints, keys and descriptors are unchanged.
• 1.25.1 — Polish and fixes. (1) QR codes were sometimes partly hidden behind the “Your seed” panel; the panel now sits beside the content, every QR scrolls fully into view, and a tall panel scrolls inside itself so COPY and DOWNLOAD stay reachable. (2) The master fingerprint picture no longer disappears after VERIFY or SEND TO CHECK. (3) Solid, readable tabs in both light and dark mode, with short tab names on phones so all four fit. (4) New fairness test under the roll chart: a Pearson chi-square number and p-value, explained in plain words (it cannot prove fairness). (5) New Word finder in the Word draw box: type a word number, or a D8 roll and two hex dice, to look up the BIP39 word. (6) Sections no longer hide under the sticky tab bar when the page jumps to them, a few green texts in light mode are darker for contrast, and an automated accessibility scan is clean on every tab. (7) Phones: the start notice’s button is now always on screen (it could sit below the visible area), and the notice only appears once the page’s script is running, so a phone that blocks scripts (a file preview, say) shows the red warning instead of a button that does nothing. Words, fingerprints, addresses, keys and descriptors are identical to v1.25.0.
• 1.25.0 — Compact layout. The page is now four tabs (Make a seed, Check a backup, Extra tools, About & help) instead of one long scroll, with a sticky “Your seed” panel that shows the roll counter, numbered word slots and a five-step bar. The counter is red until you have enough rolls or flips, then green with a tick. The rolling dice now wait until you click “I understand, let’s go” (or press Escape). Every feature, the theme and the dice are unchanged; printing works from any tab.
• 1.24.0 — Signature checks. The read-only transaction checker and the compare box now look at the signatures inside a transaction. They warn if two different signatures share a nonce (a repeated secret number that would let anyone work out a private key; the compare box also looks across both transactions) and if any signature, or a signing request, uses a sighash type other than ALL, which would let others change parts of the transaction after it is signed. ECDSA and Schnorr (taproot) signatures are both read. Public data only; no seed, key or address math changed.
• 1.23.0 — Easier to trust and easier to learn. (1) A short notice now greets first-time visitors: this is an educational tool, not independently audited, so practise first and start real money small. It closes with one click or Escape. (2) Practice mode in CHECK A BACKUP gives you a throwaway 12-word phrase to write down, hides it, and checks that your paper copy matches, naming any word that is wrong, so you can rehearse before it matters. The phrase is random, is not a real seed, and is forgotten when cleared. (3) A Privacy section in About explains what the page keeps (only your light/dark choice and text size), what it never sends, and the only ways anything leaves. (4) REVIEW.md now invites outside reviewers. No seed, key or address math changed.
• 1.22.0 — Check a transaction more carefully, and an easier multisig control. (1) The transaction checker now also reads a raw transaction, says whether it can be replaced with a higher-fee version (RBF), shows any locktime, decodes data notes (OP_RETURN), and ends with a list of checks and a verdict. If it cannot fully check something, it says NO CLEAN VERDICT instead of looking reassuring. (2) A new Compare two transactions box shows whether a signer changed anything between what you sent and what came back, and whether a fee bump is a plain fee bump. (3) The multisig setup is now one slider with two handles, from 2 to 15 keys, with a big live “2-of-3” label and one-click popular setups. Everything here only reads and displays. Words, fingerprints, addresses, keys and descriptors are identical to v1.21.0.
• 1.21.0 — Easier to use, plus three additions. (1) The multisig card now moves up directly above the seed maker while you set up, so progress, instructions and the seed maker are together, and the page scrolls to the finished wallet when the last key is saved. (2) A loud red TESTNET banner on the Watch-only box whenever Testnet is chosen. (3) Import into Bitcoin Core (advanced), in the Watch-only box: two ready-to-copy commands that make an empty watch-only wallet and load the descriptors, with a choice of scanning from now or from the beginning. (4) A Silent Payment address (BIP-352) box in the Watch-only box, with a limited-wallet-support warning; it is tested against all of the official test vectors and an independent library. Also: a softer grey-blue light theme, and the About text now says Coldcard’s documented dice example gives the same words as VOIDFORGE. Seeds, fingerprints, addresses, keys and descriptors are identical to v1.20.1.
• 1.20.1 — Two comfort fixes. (1) Opens at the top. The page used to open already scrolled down the screen, because it put the text cursor in the rolls box and the browser scrolled to show it (worse with TEXT A+). The cursor still starts in the rolls box, but the page now stays at the top. (2) Size on computer screens. The default is a little smaller than in v1.20.0 (still larger than before v1.20.0), so you scroll less, and TEXT A+ is a smaller step up. Phones are unchanged. Seeds, fingerprints, addresses, keys and descriptors are identical to v1.20.0.
• 1.20.0 — Multisig wallet setup. A new MULTISIG WALLET card walks you through an M-of-N wallet (such as 2-of-3) one key at a time: a “Key 1 of 3” banner sits above the normal seed maker, and after you have written down and backed up each seed, ADD THIS KEY keeps only its public part and wipes the seed from the page. You can also paste public keys from other devices or people (private keys and seed words are refused, and so are the same key twice, the wrong network, and keys from the wrong place in the key tree). At the end you get the wallet descriptor (text, QR code and a printable recovery sheet with no seeds on it) and the first addresses to check in your wallet app. Making every key on one device is allowed but clearly warned about. QR codes now go up to version 30 so long descriptors fit. Seeds, fingerprints, addresses and watch-only keys are identical to v1.19.5.
• 1.19.5 — Word draw, for people who pick their words from physical word tiles (such as SeedSigner’s SeedPills): type the 11 (or 23) words you drew and the 7 (or 3) coin flips, and VOIDFORGE works out the last word with the standard BIP39 checksum. Nothing is hashed, repeated words are accepted (every tile goes back in the bag), the flips are never filled in for you, and a seed made this way works in any BIP39 wallet. It shows every step of how the last word was made, then uses the same fingerprint, address, SeedQR, print and watch-only tools as the dice method. Seeds made by dice or coin are identical to v1.19.4.
• 1.19.4 — Two friendly additions. (1) The logo is now three rolling dice: they are thrown in with a 3D tumble, bounce and settle with a soft glow and a shadow, and roll again when you tap them. They keep the same look, and stay still if your device asks for reduced motion. (2) Watch the words change (demo only), an optional switch under the roll counter: as you add rolls it shows demo words that scramble completely with every roll, so you can see why one wrong roll gives a different wallet. The demo words are made with a demo tag, so they are never your real seed; they are labelled NOT YOUR SEED, wiped when you switch it off, clear or forge, and never printed or saved. Also fixed: the GUIDE ME and TEXT A+ buttons were hard to read in the light theme. Seeds, fingerprints, addresses, keys and descriptors are identical to v1.19.3.
• 1.19.3 — Easier for first-time users. GUIDE ME (top left) walks you through making a seed one screen at a time: choose the length and method, roll, optional passphrase, FORGE and write down, then check and back up. Each step explains why, and NEXT stays locked until the step is done. Underlined words (passphrase, fingerprint, zpub, descriptor, watch-only) show a plain-language explanation when you hover, tap or focus them. TEXT A+ makes everything larger. Seeds, fingerprints, addresses, keys and descriptors are identical to v1.19.2.
• 1.19.2 — Two additions after FORGE. (1) How your seed was made (marked SECRET, closed by default): shows every step from your typed rolls to the words, in five plain-language steps with the real numbers (the SHA-256 result, the raw entropy, the checksum bits, and each 11-bit piece with its word number), and checks itself against the words above. It never shows your passphrase. (2) A redesigned printed backup sheet: numbered boxes for the words, the fingerprint and first address, the passphrase-used line, and fields to fill in, laid out for a clean paper copy. Printing still asks you to confirm first. Self-test is now 66 checks. Seeds, fingerprints, addresses, keys and descriptors are identical to v1.19.1.
• 1.19.1 — A new Browser safety checklist in About & docs: eight short habits (go offline first, a clean browser window, translation, clipboard history, print and PDF copies, downloads, and restarting afterwards), each with the reason. Releases now also carry a CID.txt, a second way to check that your download is the right file. Seeds, fingerprints, addresses, keys, descriptors and every check are identical to v1.19.0.
• 1.19.0 — Paper backup as a SeedQR. After FORGE you can show your seed as a SeedQR or CompactSeedQR (the formats SeedSigner uses) directly on screen, copy it onto a printed grid with a pen or pencil one 7x7 block at a time (with row and column numbers and a small map, like SeedSigner's transcribe screen), or print the QR, the hand-copy guide or a blank grid. Printing asks you to confirm first because it sends your seed to a printer. Nothing is stored or sent anywhere.
• 1.18.0 — Visual polish only. A subtle forge-style background, a small identity badge in the header, numbered word cards, short animations when you tap a dice or coin button and when FORGE finishes, and a brief flash when something is copied. Every animation is switched off if your device is set to reduce motion. Seed words, fingerprints, addresses, keys, descriptors and every check are exactly the same as 1.17.0.
• 1.17.0 — Friendlier layout, no change to how seeds are made. A short “Start here” strip says what to do first; the page is now grouped as Make a seed, Check a backup and Extra tools, with small tags that say what each tool is for and whether it only reads. Spacing and tap targets are better on phones. Seed words, fingerprints, addresses, keys, descriptors and every check are exactly the same as 1.16.0.
• 1.16.0 — Two tools in the new section for extras. (1) Find the last word: type all but the last word of a seed (11, 14, 17, 20 or 23 words) and it lists every word that makes the checksum valid (128 for a 12-word seed). It cannot tell you which one you had. (2) Inspect a transaction (PSBT): paste or choose a partly signed Bitcoin transaction (BIP174 version 0, base64 or hex, mainnet or testnet) to see its inputs, outputs, addresses and fee before signing it on a hardware wallet; outputs that carry key information are marked as likely change. Read only: it cannot sign, never uses your seed words, and sends nothing. Self-test is now 60 checks.
• 1.15.0 — Testnet and multisig cosigner keys in the Watch-only box. A Network menu switches the export and the address finder to testnet (tpub/upub/vpub keys, tb1... / 2... / m... / n... addresses, coin type 1). Two new types, Multisig cosigner key (BIP48, native SegWit Zpub or nested SegWit Ypub, m/48’/coin’/account’/script’), give the single key and origin a multisig coordinator (Sparrow, Specter, Nunchuk, Electrum) asks for; a cosigner key has no address of its own, so those boxes are hidden. Seven new self-test vectors (56 checks). Display only.
• 1.14.0 — Watch-only export and address finder now cover more wallet types. In the Watch-only box you can pick Native SegWit (bc1q), Taproot (bc1p), Nested SegWit (3...) or Legacy (1...) and an account number; the box shows the matching key (zpub, ypub or xpub), the descriptors and the first address. “Is this address yours?” now also finds 3... and 1... addresses and takes an account number. Six new self-test vectors (49 checks). Display only; nothing new is saved or sent.
• 1.13.0 — Two additions in CHECK YOUR BACKUP. (1) SeedQR input: the words box also accepts a SeedSigner SeedQR digit string (each word as its 4-digit number 0000 to 2047; 48 digits for 12 words, 96 for 24) or CompactSeedQR hex (the raw entropy, 32 or 64 hex characters), turns it into words, checks the checksum, and shows the words so you can compare them with your backup. Type it in; there is no camera and no new way to display a seed. (2) Child seed (BIP85): a new seed phrase derived from the typed parent words and passphrase (English, 12, 18 or 24 words, any index 0 to 2147483647), shown on screen only with its fingerprint and first address; no copy, save or print. The parent, word count and index recreate it, and the parent recreates every child. Checked against the published BIP85 vectors in the self-test (now 43 checks) and against independent libraries. Seeds, words, fingerprints and addresses are exactly the same as 1.12.0.
• 1.12.0 — Two checking tools in CHECK YOUR BACKUP, display only. (1) The “Backup” box now also accepts a zpub or xpub (account key, m/84'/0'/0'), a wpkh descriptor (the xpub form, as VOIDFORGE and Sparrow show it; its checksum is verified) or one of the first five Taproot (bc1p) addresses, and says MATCH or NO MATCH against the words, with and without the typed passphrase. Public keys cannot reveal the words, and nothing new is shown. (2) Is this address yours? Paste a bc1q (SegWit) or bc1p (Taproot) address from a wallet app and CHECK ADDRESS searches the typed words, with and without the passphrase, on the receive and change chains, 50 indices per press (press again for the next 50), and tells you which address number it is. Checked against independent libraries and with 28 new mutation tests. Seeds, words, fingerprints and addresses are exactly the same as 1.11.0.
• 1.11.0 — Two additions, display only. (1) Taproot (BIP86) addresses: the first five bc1p… receiving addresses (m/86'/0'/0'/0/0 to 0/4) are listed under the SegWit ones, with their own COPY ALL, for checking in wallets that use Taproot. Checked in the self-test against the three published BIP86 vectors and the BIP350 bech32m example, and in the test suite against independent code (@scure and @noble). The zpub, descriptors and QR codes are unchanged and still describe the SegWit wallet only. (2) A fuller PRINT SEED backup sheet: two-column numbered words, fingerprint, first address, passphrase-used line, blank lines for notes, and a short warning. The passphrase is still never printed. Seeds, words, fingerprints and SegWit addresses are exactly the same as 1.10.1. The in-page self-test now has 38 checks.
• 1.10.1 — Fix: the SELF-TEST button now toggles. Pressing it a second time hides the results; before, they stayed until you pressed CLEAR. No change to any crypto or output.
• 1.10.0 — Three additions, all display only: (1) the first 5 receiving addresses (m/84'/0'/0'/0/0 to 0/4) are listed under the first address, with a COPY ALL button, so you can compare more than one address in another wallet; (2) a SHOW FIRST 4 LETTERS button for the word grid (every BIP39 word is unique by its first four letters), handy for stamping metal backups; (3) a short step-by-step guide to checking the wallet in a second tool. The self-test now has 35 checks. Seeds and wallets are unchanged.
• 1.9.0 — Roll chart: a small bar chart under the roll box shows how many times each dice face (or coin side) has come up, with a dashed line for an even share. It is a display only: it does not change the randomness check, the seed or any result.
• 1.8.1 — Wording fix: the roll count message says “1 more roll” instead of “1 more rolls” (same for flips). The release process was also hardened (tests run in a separate read-only job, files are re-checked against the git tag before signing); this does not change the app itself or any seed it makes.
• 1.8.0 — Fingerprint picture: a small LifeHash picture is drawn next to the master fingerprint in FORGE and next to the fingerprints in VERIFY. It is the same picture Sparrow Wallet shows beside the same fingerprint, so you can compare at a glance (the 8-character fingerprint stays the real check). LifeHash is an open visual-hash algorithm by Blockchain Commons, drawn by code inside this page. 1 more self-test (34 in all). Seed words, fingerprints, addresses, zpub, descriptors and QR codes are unchanged.
• 1.7.1 — Added a short disclaimer under the top warning (provided as is, you are responsible, lost words mean lost funds, test with a small amount) and a fuller one in Security notes. No change to seed words, fingerprints, addresses, zpub, descriptors or QR codes.
• 1.7.0 — QR codes for the watch-only export: SHOW QR buttons draw the zpub or descriptor as a QR code on screen (drawn by code inside this page, no library, no network) so a phone or other device can scan it into a watch-only wallet app. Public keys only. 1 more self-test (33 in all). Seed words, fingerprints, addresses, zpub and descriptors are unchanged.
• 1.6.0 — Watch-only export: after FORGE, a collapsed box shows the wallet’s public account key (zpub) and output descriptors (receive and change) with COPY buttons, so the wallet can be added to a watch-only app without the seed words. It never contains secret keys. 3 more self-tests (32 in all). Seed words, fingerprints and addresses are unchanged.
• 1.5.1 — Larger, clearer dice buttons: drawn dice faces (instead of small font symbols), bigger tap targets, and bigger coin 1/0 buttons; the recent-rolls symbols are larger too. Seed generation is unchanged.
• 1.5.0 — Cleaner layout: the seed words show as a numbered grid (and print numbered); passphrase and note moved into a collapsed “Advanced options” section that opens itself if the two passphrase boxes do not match and flags when a passphrase is set; one status line for self-test and network; plainer messages (“Enter 23 more rolls”); numbered steps; better keyboard focus and screen-reader announcements. Fixed: after a passphrase mismatch, SEND TO VERIFY, PRINT and DOWNLOAD could treat the error text as a seed. Seed generation is unchanged.
• 1.4.2 — VERIFY can now check a fingerprint or first address you wrote down: it says whether it matches the phrase WITHOUT a passphrase, WITH the passphrase you typed, or neither. The result, print and download now state plainly whether a passphrase was used (never the passphrase itself). Seed generation is unchanged.
• 1.4.1 — VERIFY now has an optional passphrase box and shows the fingerprint and first address both without and with the passphrase, so you can confirm a written-down passphrase reproduces what FORGE showed. The passphrase is never displayed or saved. Seed generation is unchanged.
• 1.4.0 — Added the first receive address (BIP84 native SegWit, bc1q…) next to the fingerprint, in FORGE and VERIFY, with a COPY ADDRESS button; a second passphrase box that must match (a mistyped passphrase gives a different wallet); tap buttons for dice 1–6 and coin 1/0; and 3 more self-tests (29 in all) covering address derivation. Seed words and fingerprints are unchanged.
• 1.3.1 — Header now says DICE / COIN. Added a clear red notice that shows whenever the page’s script is not running (file previews, old browsers, JavaScript off), a coin-mode hint explaining which side is 1 or 0 and to record the string, and a not-for-phones note. Seed generation is unchanged.
• 1.3.0 — Added an always-visible NETWORK: ONLINE/OFFLINE tag, an “≈ bits of entropy if rolls are fair” line, a passphrase-normalization test in the self-test (26 tests), and a note on what the self-test cannot catch. Seed generation is unchanged: the same rolls give the same words and fingerprint as 1.2.x.
• 1.2.2 — Added SEND TO VERIFY, which moves the generated words into the VERIFY box inside the page (no clipboard). Note this only re-checks the words you just made with the same code; for an independent check, write the words down and enter them in a second tool.
• 1.2.1 — Wording fixes: coin mode says “flips” in the length message; shorter passphrase hint. No change to seed generation.
• 1.2.0 — Only 12- and 24-word seeds are generated (removed the VOIDFORGE-only 15/18/21-word lengths) and the COPY SEED button is removed. Recovery notes: a 15/18/21-word seed from an earlier version is SHA256(rolls) truncated to 20/24/28 bytes, then converted to BIP39. An H/T coin seed from 1.0 is SHA256 of the exact H/T letter string, truncated to 16 or 32 bytes. If you funded a seed made by an earlier version in one of those modes, move the funds to a fresh 12- or 24-word seed.
• 1.1.1 — Layout fixes found in a real-browser test: top buttons no longer cover the warning banner, light-theme secondary buttons are readable, shorter input hints. No change to seed generation.
• 1.1.0 — Coin mode now takes 1/0 and hashes that string, matching SeedSigner’s method. Breaking: seeds made with the old H/T coin mode cannot be rebuilt in this version; to recover one, SHA256 the exact H/T string yourself, take the first 16 or 32 bytes, and convert to BIP39. Also added: real master fingerprint, automatic self-test that gates the tool, pattern-aware randomness checks, offline warning, masked passphrase, safer copy/print/download/clear, Content-Security-Policy, and labels for VOIDFORGE-only seed lengths.
• 1.0 — Initial release (dice and H/T coin modes).