A seed phrase is only as unpredictable as the randomness it was made from. Everything else about a hardware wallet can be read, built and checked by anyone — but randomness leaves no trace to inspect. So we are building PHYLAX to let you make your own, with a coin.
Every hardware wallet on the market generates your seed for you, from a random number generator you are invited to trust. That step is the foundation everything else rests on, and it is the one step you are normally given no way to check.
What the twenty-four words actually are
The words are not the secret. They are a way of writing down a number so a human can copy it without mistakes. A 24-word BIP-39 phrase carries 256 bits of randomness plus an 8-bit checksum: 264 bits in total, encoded 11 bits per word, because the wordlist holds exactly 2,048 words. A 12-word phrase is the same idea with 128 bits and a 4-bit checksum. Get those bits from somewhere genuinely unpredictable and the phrase is sound. Get them from somewhere predictable and every other protection on the device is decoration.
Why we would rather you didn't trust our randomness
Open source solves most of this problem. You can read our firmware, build it yourself, and compare the hash against what is on your device. But you cannot read randomness. A generator that has quietly become weak produces output that still looks fine — correct length, correct checksum, valid phrase — and there is no way to tell by looking. It is the one part of the device you cannot verify by inspection, which makes it the one part where our word should not be good enough. Hardware-grade security, software-grade transparency: the transparency has to reach the randomness too.
One flip, one bit
A coin is the simplest honest source of randomness most people own. One toss of a fair coin is exactly one bit — heads is 1, tails is 0 — so 256 tosses give you the full 256 bits of a 24-word phrase, and 128 tosses give you a 12-word one. You enter them on the device as you go. No hardware to trust, no vendor to believe, no theory to follow: it is the same arithmetic the wallet would have done anyway, done where you can watch it.
A real coin is not perfectly fair
Nor is your flipping. Real coins land slightly more often one way, and the difference is small but it is not nothing. There is a classic trick for removing it — flip in pairs, keep heads-then-tails as 1 and tails-then-heads as 0, throw away the matching pairs — but for a fair-ish coin that costs about four flips per usable bit, roughly a thousand tosses for 24 words. That is more patience than the problem deserves. Instead we run the whole sequence through SHA-256, which spreads any lean across all the output bits and hands back 256 of them. You keep every flip and lose the bias.
We mix it with the device's own randomness
Your coin does not replace the hardware generator — it is combined with it. The device generates its own random value, we combine the two, and the seed comes out of the mixture. The property that matters is this: the result is at least as unpredictable as the better of the two sources. If our generator were weak, your coin saves the seed. If you flipped carelessly, or the coin was bent, the hardware saves it. Neither of us has to be trusted alone, which is the whole point.
You can check our work
Because the arithmetic is public and repeatable, you do not have to take the device's word for the result either. Record your flips, run the same published steps on a machine of your choosing, and confirm you land on the same words. Then destroy the record — a written list of your flips is your seed in a different costume, and it deserves the same treatment.
Why this belongs in an open hardware wallet
Open source answers most questions about a device but not this one. You can read the firmware, build it and match the hash, and still have no way to confirm the number it picked was unpredictable — the output of a weak generator looks exactly like the output of a good one. Letting the owner supply the randomness closes the last gap in the chain that transparency alone cannot reach, and it costs the PHYLAX hardware wallet nothing but a menu option and some patience from anyone who chooses it.
It takes about fifteen minutes and it will stay optional; anyone who wants to press a button and move on can. But it will be there, it will be documented, and the arithmetic will be yours to repeat. Open source isn't a feature. It's the foundation — and that has to include the first number the device ever picks.