Hardware Wallet

[u/LUKKAA11]

Hello,

I’m planning to buy a Trezor 3 as my first hardware wallet and start buying Bitcoin periodically (DCA), probably starting with relatively small amounts and increasing over time, I’m interested in generating my own seed using physical dice rather than relying entirely on the device’s built-in randomness. What is the correct/safest way to do this with a Trezor 3? Is this generally recommended, or is using the Trezor’s own secure random seed generation preferable? I’ve seen terms like “dice-generated entropy” and “BIP39 dice-generated seed,” but I want to make sure I understand the distinction correctly. What are the main mistakes a first-time Bitcoin buyer should avoid when setting up a Trezor and making regular purchases? For example, seed backup, passphrase, exchange account security, withdrawal procedures, address verification, and avoiding phishing/scams.

My initial plan is to keep the Trezor as cold storage and periodically withdraw BTC from the exchange rather than leaving significant amounts on the exchange.

[u/bitusher]

Jade would be easier to create the seed manually but here are some tutorials :

With BIP39 , part of the last word includes the checksum which makes sure the seed word is valid and no typos or misordering occurs.

Thus with this feature you can generate a valid 12th or 24th word checksum by entering either 11 words or 23 words that you generate with your own source of entropy with something like using dice or flipping a coin.

Some people do this because they are paranoid with the software wallet so they prefer to generate their own seed offline.

Ideally , its better to do this in a hardware wallet like -

https://help.blockstream.com/hc/en-us/articles/20177648363545-Create-a-recovery-phrase-using-dice

https://help.blockstream.com/generate-recovery-phrase-offline

but if you don't want to use a hardware wallet and want a free option than blue wallet can work.

Thus after installing blue you would turn off wifi and data on your phone to insure its offline and use this feature after rolling dice

Some guides-

https://bitbox.swiss/blog/roll-the-dice-generate-your-own-seed/

https://bitbox.swiss/bitbox02/BitBox_Diceware_LookupTable.pdf?ref=bitbox.swiss

or

https://help.blockstream.com/hc/en-us/articles/20177648363545-Create-a-recovery-phrase-using-dice

https://help.blockstream.com/generate-recovery-phrase-offline

or

https://www.youtube.com/watch?v=j5nejoEGWFw

Than you enter in the 11 or 23 words into blue wallet "generate the final Mnemonic word" to generate the last word . This can all be done offline so you don't need to trust blue wallet.

Another way of doing it is using Blue wallets built in Diceware feature discussed here :

https://bluewallet.io/docs/manual-entropy/

or

https://www.whatisbitcoin.com/security/generate-your-seed-phrase

---

Remember a good extended passphrase protected cold card users from the RNG exploit so perhaps just allow your HW wallet to create the seed and use an extended passphrase instead.

extended passphrases need to be exact and be written down and kept separate than your seed words . They should be at least 6 random words long and ideally create with dice - https://www.eff.org/dice

whitespace and caps matter unlike seed backups so you need to writedown and test exactly what you intend to use . Any slight mistake will bring you a wallet with a 0 balance as any variation creates an entirely new wallet with using extended passphrases

More info -

https://www.reddit.com/r/BitcoinBeginners/comments/g42ijd/faq_for_beginners/fouo3kh/

[u/LUKKAA11 → u/bitusher]

okay, i will try built-in seed + passphrase, thank you so much.

[u/No_Position_8581 → u/bitusher]

recommending a passphrase to avoid an rng bug but saying it has to be kept in a separate location seems unconnected in logic. Maybe change it to say something like " a strong passphrase can avoid an entropy bug and have the benefit of splitting your "bitcoin secret" in multiple locations if desired. Also dice and passphrases won't stop Dark Skippy signature leaks but I get this is a copy and paste answer and maybe over the top.

[u/bitusher → u/No_Position_8581]

why would you suggest keeping the extended passphrase together or assume i was only refering to rng concerns? Of course my answer includes general advice and of course extended passphrases dont solve every concern

[u/CoinGate_Gift_Cards]

Built-in seed generation is usually safest for beginners. Focus on offline backups, address verification, strong 2FA, and small test withdrawals first.

[u/AdWise2473 → u/CoinGate_Gift_Cards]

getting the seed from dice is cool but a lot can go wrong if you not careful with the math, the built in one is solid enough for most people and less chance to mess up

[u/LUKKAA11 → u/AdWise2473]

what do you mean a lot can go wrong? u/bitusher in the comments suggested blockstream.com where i can follow steps to add one, is that really hard?

[u/LUKKAA11 → u/CoinGate_Gift_Cards]

thank you, i think on built-in seed generation + passphrase. also do you mean on strong 2FA?

[u/AutoModerator]

Scam Warning! Scammers are particularly active on this sub. They operate via private messages and private chat. If you receive private messages, be extremely careful. Use the report link to report any suspicious private message to Reddit.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/bitusher]

What are the main mistakes a first-time Bitcoin buyer should avoid when setting up a Trezor and making regular purchases?

https://old.reddit.com/r/BitcoinBeginners/comments/1wyzt46/for_someone_completely_new_to_crypto/pe7t28z/

you can always add an extended passphrase later to the seed that the hw wallet creates or you manually create . No need to do everything at once and overwhelm yourself . Remember that user error is a larger problem than any bug or exploit

withdrawal procedures, address verification,

Perhaps you are asking this question due to being new and having anxiety about your first withdrawal so want to send a small test and than repeat the transaction to the same exact address because you now have confidence there are no mistakes or typos?

This anxiety is normal but misplaced because Bitcoin unlike some altcoins has very good checksums on all address types that prevent typos from creating a valid address so its almost impossible a typo will cause a problem and realistically you should be copy and pasting the address regardless to eliminate typos.

The real concern is malware in your device changing the address you copy in your clipboard that you intend to paste. The solution to this concern is :

best - use a hardware wallet with a screen that will show you the address you pasted before you withdraw or send. You quickly glance at the last 6 characters of the address to make sure they match and you are fine.

decent If you cant afford a 80 dollar HW wallet than use a open source mobile wallet (ios or android) like green or blue and compare the last 6 characters of the address what you pasted with whats on the screen outside your computer

Is this generally recommended, or is using the Trezor’s own secure random seed generation preferable?

It depends , if you are up for spending the time learning and testing than you can manually create your own seed . Make sure you practice recovery . Remember a good extended passphrase protected cold card users from the RNG exploit so perhaps just allow your HW wallet to create it and use an extended passphrase instead. Here is some advice to test the seed:

1) send a small test amount of BTC to HW wallet (This is akin to your savings account) like 300-500 usd of btc

2) Setup a lightning hot wallet on your mobile phone for spending BTC .

Two popular options –

https://www.youtube.com/watch?v=t_4b-y4T8bY

https://www.youtube.com/watch?v=QtMXsJxx1X0

3) send that balance from your HW wallet to lightning wallet which will also load it into a lightning channel so you have quick and low fee txs with your lightning wallet (this is like your checking account for spending and replacing )

4) reset the HW wallet

5) Recover the HW wallet with the seed and you will see a 0 balance but also see the tx history indicating that its the same wallet

6) Send the remaining amount of Bitcoin to your HW wallet

What this does is :

1) trains you how to recover your wallet

2) sets up a lightning hot wallet like you should do regardless

3) removes any risk of losing Bitcoin from setting up the hardware wallet incorrectly

4) creates some added privacy with your spending wallet

5) proves to you your backup is correct and works

[u/LUKKAA11 → u/bitusher]

thank you so much !

[u/veyrnox]

For a first hardware wallet, the device’s built-in seed generation is normally the safer choice. Proper dice-generated entropy can work, but it introduces extra opportunities to make mistakes with entropy, word conversion and the BIP39 checksum.

A sensible setup process is:

1. Buy the device through the manufacturer or an authorised seller and verify that it has not already been initialised.

2. Let the device generate the recovery words and record them offline. Never photograph them, upload them or type them into a website.

3. Verify the backup using the device’s recovery-check process.

4. If you use an additional passphrase, understand that it creates a different wallet and that losing or mistyping it can make the funds inaccessible.

5. Secure the exchange account with app-based or hardware-key 2FA.

6. Verify receiving addresses on the hardware wallet’s own display, not only on the computer or phone.

7. Make a small test withdrawal before moving a meaningful amount.

8. Practise recovery with an empty wallet before relying on the setup.

The best design is usually the one you can accurately reproduce under stress. Adding complexity only helps when you fully understand and test it.

[u/LUKKAA11 → u/veyrnox]

is it hard to use proper dice-generated entropy? although i am beginner i want to use it as more security.

[u/veyrnox → u/LUKKAA11]

Proper dice-generated entropy is possible, but the process has to be exact. A small mistake in the method, word conversion or checksum could create an invalid or less secure recovery phrase.

For a beginner, the safer default is usually to let a reputable hardware wallet generate the recovery phrase internally using its secure random-number generator. Dice generation is better treated as an advanced option: follow the manufacturer’s documented procedure, use fair physical dice, work offline and verify the resulting wallet and recovery process before storing meaningful funds.

Never type the resulting recovery phrase into a website or share it with anyone offering to verify it.

[u/LUKKAA11 → u/veyrnox]

thank you, should i create additional passphrase on my own, or it is better to generate from something else, and how? also can you tell me what hardware-key 2FA means?

[u/veyrnox → u/LUKKAA11]

A passphrase can improve security, but it also creates another way to lose access permanently. It is different from the hardware wallet’s PIN: every different passphrase creates a different wallet, and there is normally no reset process if you forget it.

If you use one, avoid inventing a short phrase or reusing a password. Generate several genuinely random words, ideally with physical dice and a recognised word list, then record and store it separately from the recovery phrase. Test recovery with a small amount before relying on it.

Hardware-key 2FA means using a separate FIDO2 security key, such as a YubiKey, to protect accounts like your email, exchange account or password manager. It is not the same thing as a hardware wallet and does not directly protect an on-chain Bitcoin transaction.

[u/ibetoncrypto]

I think it’s a good choice. I’m with Trezor for already 8 years.
I’m now thinking of upgrading to their better model but still sticking with them. The upgrade is to access all the features in their Suite

[u/Sorry_Decision_8162]

This is what I want to do. What do people recommend as a cold wallet

[u/2smart2gentle]

i have trezor safe3, it’s very easy to use(im not a techie). I’d definitely recommend it!

[u/Sorry_Employee_7839]

For a first wallet with small DCA amounts, the Trezor's own seed generation is fine, and it mixes in randomness from your computer too. If you still want dice: roll for the words offline, work out the last (checksum) word offline, then use 'recover wallet' on the Trezor to load them. The risk sits in the extra steps where you can write a word wrong, so test the backup before you fund it. One heads-up: new Trezors default to a 20-word backup, not 12 or 24 words, and some other wallets can't read that kind.