How keys are made

Where the randomness behind your keys comes from, how AirWallet mixes it, and how to check dice-made words yourself.

If someone can guess the random number behind your keys, they can rebuild your keys without hacking anything. So AirWallet never takes keys from a list or a server. It makes every key on your device, from more than one source of randomness mixed together.

#Where the randomness comes from

Every new key goes through the same mixer: a recovery phrase, a single key, a Monero Polyseed, and the secret half you keep when someone else does a vanity search for you. It draws on:

• the web engine's secure generator (crypto.getRandomValues), which AirWallet tests before it trusts it
• a second, independent generator where the platform has one: the operating system's through Python's os.urandom on the desktop apps, and Java's SecureRandom on Android
• anything you add: dice rolls, coin flips, or keys mashed at random

The Chrome extension has only the browser's generator, so there it mixes the first and third.

Real wallets have lost money to one weak generator. In July 2026, a weak generator in Coldcard hardware wallets let thieves take about 1,400 to 1,800 BTC. "Ill Bloom" (2026) and Profanity (2022) were key losses of the same kind. With mixing, an attacker would have to predict every source at once. Whatever you type can only add randomness, never take it away: even "aaaa" leaves the keys as strong as they were without it.

#How the mixer works

Each time a key needs random bytes, AirWallet computes:

SHA-256( "AirWallet new-key randomness v1"
         ‖ counter (4 bytes)
         ‖ 32 fresh bytes from the web engine
         ‖ length of the device bytes (4 bytes) ‖ 32 bytes from the device's generator
         ‖ length of your text (4 bytes) ‖ your text )

It keeps the first bytes of the result it needs, at most 32. The counter changes on every call, and the web engine's 32 bytes are drawn fresh every time. The device's 32 bytes are drawn once per new wallet. Your text is cut at 4,000 characters and never kept.

The web engine's generator must pass 2 tests once per start: 2 draws of 32 bytes must differ, and the first must not be all zeros. After that, any draw of 16 bytes or more that comes back all zeros stops it. If a test fails, AirWallet refuses to make keys at all rather than make weak ones.

If the device's generator does not answer, the mixer goes on without it. The web engine's generator is still there, so the keys are still strong, but they rest on one source instead of 2.

A new recovery phrase is 24 words (256 bits). A 12-word phrase is 128 bits.

#Add your own randomness

1. Select + → Create a wallet.
2. Select Your own randomness….
3. Roll a die and type the numbers, or type anything random.
4. Select Create recovery phrase.

#Words from dice alone

If you would rather not trust any device's generator, your dice can make the recovery phrase on their own. AirWallet does it the way SeedSigner does, so you can check the result with SeedSigner or any tool that uses the same method.

1. On the Your own randomness sheet, type exactly 50 rolls for 12 words, or exactly 99 for 24 words, as digits 1 to 6. Spaces, commas and dashes between them are fine.
2. Tick Use only my dice.
3. Select Create recovery phrase.

AirWallet hashes your rolls, as a string of digits, with SHA-256. For 12 words it uses the first 16 bytes, and for 24 words all 32. 50 rolls carry a little over 128 bits of randomness, and 99 rolls about 256.

It refuses rolls that no real die makes:

• fewer than 4 different faces
• one face in more than 40% of the rolls
• a short pattern, up to 12 rolls long, repeated over and over

For real rolls, each of these is far less likely than one in a trillion. Roll again, and type each roll as it lands.

#Check dice-made words yourself

You can confirm the words came from your dice and nothing else. Do this on a computer that stays offline, because it will see your rolls, and your rolls are your wallet.

1. Write your rolls as one string of digits. AirWallet removes spaces, commas, semicolons, periods and dashes before hashing, so leave those out.
2. Hash the string with SHA-256, as below.
3. For 12 words, take the first 32 hexadecimal characters of the result. For 24 words, take all 64.
4. Turn that into words with any BIP39 tool that accepts entropy in hexadecimal, run offline. Or enter the same rolls in SeedSigner's dice option.

To hash the rolls on macOS or Linux, in Terminal:

1. Type read -r ROLLS and press Return.
2. Type or paste the rolls, and press Return.
3. Run the line below. It prints the SHA-256 as 64 hexadecimal characters.

printf '%s' "$ROLLS" | shasum -a 256

Using read keeps the rolls out of your shell history. On Linux, sha256sum works in place of shasum -a 256.

The words must match the ones AirWallet showed you, in the same order.

#Vanity addresses

A vanity search tries a huge number of keys, looking for an address with your word in it. Each search starts from fresh random keys made by the search engine.

Since October 13, 2026, each find comes from its own random start, so a find you give away says nothing about your other finds. Finds from one search made before that date are related. See Vanity addresses if you gave one of them away.

When someone else searches for you, you keep a secret and they search with only its public half, so they never learn your key. This works for Bitcoin and Ethereum.

#What AirWallet does not do

AirWallet never downloads keys or seeds, and never keeps what you type for randomness. It does not use your microphone, camera or motion sensors as a source either. Some wallets do, but it adds little and alarms people.