Your Coldcard showed you 24 words.
Prove it wasn't lying.

Rolling a die 99+ times and entering the rolls on a Coldcard is the gold standard for seed generation: the entropy comes from your hand, not the device's RNG. But it leaves one question open — did the device actually use your rolls? Malicious firmware could ignore them and show you 24 words an attacker already knows.

The standard advice is to cross-check on Ian Coleman's BIP39 website. That works for a test run — but you must never type the rolls behind real money into a website. A browser tab is the opposite of cold storage: extensions, JavaScript from a CDN, a cache, a network stack.

ColdDice closes that gap. It is a native app with no network code at all, meant to run on a machine you have unplugged. Type the same rolls, compare the words on two screens, wipe, done. Nothing was written to disk; nothing could have been sent anywhere.

Coldcard's dice-roll method is a published, deterministic algorithm — which is exactly what makes it checkable by anyone:

The rolls are concatenated as a plain string of digits 1–6, hashed once with SHA-256, and the 32-byte digest is encoded as a standard BIP39 mnemonic (checksum appended, split into twenty-four 11-bit indexes into the English wordlist). ColdDice reimplements this from the public spec — sharing no code with Coldcard firmware — and must land on identical words.

Why at least 99 rolls: each fair d6 roll contributes log₂6 ≈ 2.585 bits, so 256 ÷ 2.585 ≈ 99.03 — at 99 rolls the seed space finally fills all 256 bits. Fewer rolls means a smaller space: 50 rolls is ~129 bits, 30 rolls ~77 bits and plausibly searchable. Extra rolls past 99 never hurt.

Beyond the words, ColdDice derives three more values you can hold up against the device (empty passphrase, mainnet):

A verifier you can't verify is just another thing to trust. ColdDice is built to be read in one sitting:

• ✓~1,000 auditable lines, zero npm dependencies. Three plain frontend files and one Rust file. No framework, no bundler, no lockfile-of-a-thousand-packages. Every crate is pinned to an exact version.
• ✓No network code at all. CSP is default-src 'self', no plugins, no updater, no telemetry — grep -rn "https://" ui/ src-tauri/src/ comes back empty. Watch it with a firewall if you like, or better: unplug the machine.
• ✓A second implementation checks the first. tools/verify.py is a ~40-line pure-Python-stdlib reference that must always agree with the app. The core step is also checkable with shasum — your OS's own SHA-256. For all of them to agree and be wrong, SHA-256 itself would have to be broken.
• ✓Pinned to non-Rust truth. cargo test runs official Trezor BIP39 vectors, the BIP84 reference vector, and dice vectors hard-coded from shasum + verify.py output.
• ✓Build it from source instead of trusting a binary: cargo tauri build. The bundled wordlist hashes to the canonical BIP39 list from the bitcoin/bips repo.
• ✓Nothing persists. No disk writes, no clipboard auto-copy; results are wiped the moment you edit an input. And it takes dice rolls only — never enter seed words into this or any app.

ColdDice is free, MIT-licensed, and will never have a paid tier, telemetry, or ads. If it earned a place in your setup, a Lightning tip keeps it maintained.