<p>Rolling a single die has 6 possible results. A private key is a 256-bit number. But its address involves a 160-bit hash, so that's the most you need to use.  To know how many dice rolls you need to get this much entropy, you need to know when 6^n > 2^160 (because the probability of a certain sequence of n die rolls is 1/6^n). This is equal to ceil(log(2)*160/log(6)) or 62.</p>

<p>So if you roll a die 62 times (or a pair of dice 31 times, etc. - but be sure to count the die separately, and in a consistent way - e.g. do not always write the smaller of the two first, because you'd remove some entropy), and write down the numbers in order (e.g. "132415614..."), you can use that to seed a crypto random number generator that can give you a private key as secure as is possibly useful.</p>

<p><a href="https://electrum.org/seed.html" rel="nofollow">Electrum's seed</a> is 128 bits, and is considered (by those who created and use it, at least) to be secure enough for not just one private key, but <strong>all</strong> of your private keys. To match that entropy, you need 50 die rolls.</p>

CC BY-SA 3.0
2014-02-14T20:24:40.277Z
2014-02-14T20:29:43.627Z
2014-02-14T20:29:43.627Z
Tim S.
<p>Every five dice add 12.9 bits of entropy. Minimum: 30 dice for 64 bits. Better: 60 dice for 128 bits.</p>

<p><a href="https://en.wikipedia.org/wiki/Diceware" rel="nofollow">https://en.wikipedia.org/wiki/Diceware</a></p>

CC BY-SA 3.0
2014-02-14T09:58:55.900Z
2014-02-14T09:58:55.900Z
Ansis Māliņš
<p>You can already use bitaddress to directly convert 6-sided die rolls into a private key.  Go to "Wallet Details" and enter your die rolls in Base6 format (enter 0 for 6, 1 for 1, 2 for 2, 3 for 3, 4 for 4, 5 for 5).  This requires 99 die rolls and assures 256 bits of entropy.</p>

<p>If you choose to hash a lower number of die rolls, then 50 rolls should assure 128 bits of entropy and be quite secure.  You should not be satisfied with anything less than 80 bits of entropy, so 31 die rolls would be your bare minimum.</p>

CC BY-SA 4.0
2019-02-17T23:58:15.173Z
2019-02-17T23:58:15.173Z
John C.
<p>At bitaddress.org I have decided to use "Brain Wallet" and create my own physical randomness using dice. (I understand that dice are more effective than entering dozens of random keys on the keyboard.)</p>

<p>How many throws are necessary to create a passphrase which would defeat a brute force attack on my keys?</p>

CC BY-SA 3.0
2014-02-14T11:27:11.497Z
I hope you mean a paper wallet, not a brain wallet. Brain wallets don't use any randomness.
David Schwartz
<random>
How many throws of a dice are necessary to defeat a brute force attack?
Peter
# How many throws of a dice are necessary to defeat a brute force attack?

(Asked by: username_0 on 2014-02-14)

At bitaddress.org I have decided to use "Brain Wallet" and create my own physical randomness using dice. (I understand that dice are more effective than entering dozens of random keys on the keyboard.)

How many throws are necessary to create a passphrase which would defeat a brute force attack on my keys?

**Tags:** random

> **Comments:**
> **username_1**: I hope you mean a paper wallet, not a brain wallet. Brain wallets don't use any randomness.  

---

## 3 answers

### Answer by username_2 on 2014-02-14. Score: 2

Rolling a single die has 6 possible results. A private key is a 256-bit number. But its address involves a 160-bit hash, so that's the most you need to use. To know how many dice rolls you need to get this much entropy, you need to know when 6^n > 2^160 (because the probability of a certain sequence of n die rolls is 1/6^n). This is equal to ceil(log(2)\*160/log(6)) or 62.

So if you roll a die 62 times (or a pair of dice 31 times, etc. - but be sure to count the die separately, and in a consistent way - e.g. do not always write the smaller of the two first, because you'd remove some entropy), and write down the numbers in order (e.g. "132415614..."), you can use that to seed a crypto random number generator that can give you a private key as secure as is possibly useful.

[Electrum's seed](https://electrum.org/seed.html) is 128 bits, and is considered (by those who created and use it, at least) to be secure enough for not just one private key, but **all** of your private keys. To match that entropy, you need 50 die rolls.


---

### Answer by username_3 on 2014-02-14. Score: 0

Every five dice add 12.9 bits of entropy. Minimum: 30 dice for 64 bits. Better: 60 dice for 128 bits.

<https://en.wikipedia.org/wiki/Diceware>


---

### Answer by username_4 on 2019-02-17. Score: 0

You can already use bitaddress to directly convert 6-sided die rolls into a private key. Go to "Wallet Details" and enter your die rolls in Base6 format (enter 0 for 6, 1 for 1, 2 for 2, 3 for 3, 4 for 4, 5 for 5). This requires 99 die rolls and assures 256 bits of entropy.

If you choose to hash a lower number of die rolls, then 50 rolls should assure 128 bits of entropy and be quite secure. You should not be satisfied with anything less than 80 bits of entropy, so 31 die rolls would be your bare minimum.


---

