How a good key is actually made.

01Randomness is the whole game

A 12-word BIP-39 phrase encodes 128 bits of entropy. Guessing one at random is not feasible with any conceivable amount of computing. But that number is only as large as the randomness that produced it. If the generator quietly had 40 bits of real entropy instead of 128, the phrase still looks perfectly normal — twelve ordinary words — and an attacker can enumerate the entire space.

This is the failure mode that matters, because it is invisible. A weak key and a strong key look identical to the person holding them.

02Where our randomness comes from

Two independent sources, cryptographically blended with a domain-separated hash:

• The platform CSPRNG. We draw the bytes ourselves and assert at runtime that the source is what we believe it is. We do not delegate that choice to a derivation library. The library does the maths; it does not pick the randomness.
• Yours. Dice, or keyboard timing. Optional but strongly encouraged, and it is the reason a whole class of failure cannot reach you.

03What we check, and what we honestly cannot

At runtime the stick asserts that the entropy source is present, that it is the source we expect, and that its output passes basic behavioural checks. If any of that fails, the stick refuses to generate and tells you why. It never falls back to something weaker.

What we cannot do is prove the silicon is honest. If a CPU’s hardware random instruction is backdoored below the level any software can observe, no amount of checking from inside that machine will reveal it. Nobody who tells you otherwise is being straight with you. This is precisely why your own entropy is mixed in — it is the one input the hardware cannot influence.

04Standards, not lock-in

Your seed restores in Phantom, Solflare, the Solana CLI, and any other conformant wallet. We have deliberately invented nothing here.