Where the randomness comes from.
Every catastrophic key-generation failure in this industry happened in the seam where one component assumed another was supplying good randomness, and nothing ever checked. This page is about that seam.
We own the entropy at our own boundary
We do not delegate the choice of randomness to a library. We draw bytes from the platform CSPRNG ourselves, assert the source is genuinely what we believe it is, mix in your entropy if you supplied any, and only then hand finished bytes to the derivation code.
The library does maths. It does not choose randomness. That division is the whole design.
It refuses rather than degrades
If the CSPRNG is missing, overridden, or returning constant output, the tool stops and tells you. It does not fall back. There is no weaker source to fall back to, because none is compiled in.
A generator that produces no key is an inconvenience. A generator that produces a bad key is a catastrophe, because you walk away believing you are safe. We would rather waste your evening.
What the runtime check does and does not prove
Stated plainly, because overstating this would be exactly the kind of reassurance that has no cost to an attacker:
What it catches: accidents, misconfiguration, a missing or stubbed CSPRNG, a lazily overridden global. That is most of what actually goes wrong in the wild.
What it does not catch: a sufficiently determined attacker who controls the environment can fake any self-check. On a booted stick that attacker would need to have compromised the image itself, which is what the published hash is for. On the Mac edition the surface is larger.
What actually holds: your own entropy. We will never display the words "entropy verified" with a tick next to them. That is a claim we cannot make honestly.
Standards, so the seed outlives us
| Layer | Standard | Why |
|---|---|---|
| Seed phrase | BIP-39 | Restores in any conformant wallet |
| Derivation | BIP-32 / BIP-44 / BIP-84 / BIP-86 | Standard account paths, no custom scheme |
| Curve | secp256k1 | Bitcoin's curve. This edition derives nothing else |
A key you can only recover with our software is a trap, not a product. Every phrase this tool generates restores in Sparrow, Electrum, Trezor Suite, Ledger Live, BlueWallet, or anything else that implements the standards. We test that this is true before release rather than assuming it. Until those tests have run and passed, we do not claim it as done.
No network, structurally
"We do not make network calls" is a statement about code we wrote. It is worth very little.
The kernel on this stick is compiled without a network stack. Not firewalled, not disabled at boot, not switched off in a config file — absent. There is no interface to bring up and no socket API to call. The same is true of storage: no block device drivers, no filesystem writers.
This is enforced at build time and proven by a static check that the generation path cannot reach any network-capable symbol. It is the one property we can demonstrate rather than assert.