I'm thinking of issues like the randomization not being truly random. I appreciate that some users could examine the code themselves, but what assurances do less technically skilled users have?

2 Answers 2


There's really no way for a nontechnical user to know. In fact, most technical users do not have the specific technical knowledge required to evaluate cryptographic code (including the random number generator). Therefore, it comes down to a matter of trust. If the user does not directly trust the software author, they may sufficiently trust somebody else who has evaluated the technical aspects of the software.

  • Thanks! Is there any formal or quasi-formal system of 'peer review' for code of this sort? Or places where people put their testimonials about having reviewed code? Mar 3, 2014 at 7:54
  • 1
    I don't know of any formal scheme for publishing peer reviews, particularly for, shall we say, the wild west of cryptocurrency software. Mar 3, 2014 at 8:01
  • 1
    Yes, there are formal ways for review and validation of cryptographic code. However, like just about everything involving formal, legal, multi-party assurance, there are such vast costs, delays, etc. involved that sometimes one wonders if the result, despite best intentions all around, is living with solutions that perpetuate old problems. For an extreme, see OpenSSL's FIPS validation notes. There is a FIPS validated module (what the US gov wants to address your worries for gov use), which prevents it from cheaply being improved.
    – user6049
    Mar 3, 2014 at 8:57

This is a time when very rapidly, people like you and me (Luddites in a highly Technical, complex virtual environment) are either going to swim or ... do something else less uplifting...

Having played 3+million hands of internet poker in my career, I do however know 1 or 0 things about RNG's; trust spread over a large, human net, cast upon the backdrop of the Internet - - - Trust no one, trust nothing, kill first and kill last. It is just that kind of world in the real, it's only natural these aggressive attempts to deceive and defraud other humans pervades the virtual realm as well.

Yes, there is a well-known repository of Peer Reviewed code. It can be found at www.github.org. It's free, it's open, and it's everyone's for the pilfering, plagiarizing, pluralizing and profiteering. It's also just vastly interesting, even more incomprehensible.

The cut dry answer to your question is: One should NOT trust Paper Wallet Generator services because services like this are centralized, often closed systems that commonly operate contingent upon a for-profit business model. You have immediately given incentive to the bad actors that would hack your Bitcoin Protocol, realized in it's truest form - A Trust-less Digital Currency, store of value, and pioneer of transparency in a proprietary world.

Bitcoin's most essential virtue is precisely this notion of requiring, unlike all previous systems introduced to the human race, a purely open-source technology. Meaning even an idiot like I could tinker with the deepest layers of coding in the protocol, if I so desired, if I so deemed it pertinent to my wallets security, or to satisfy my curiosity. It is, in it's highest form, a purely P2P, distributed network of individuals, self-governing their every transaction. It is very unfortunate indeed that we continue to see the growing trend where would be cryptographers counterfeit the gift of Satoshi by relinquishing trust to centralized, closed third parties that have every mal/ability to coffer their coin.

You have no assurance other than your best knowledge. To the best of your knowledge, you would never willingly hand your money, your trust, over to a faceless, inhuman, fallible Paper Wallet Generator Service - one that is susceptible to various forms of attack from within, and without. You would much rather understand your world, your finances and your future, and place all of your trust in yourself. THAT is what bitcoin is all about.

It's a sad reality but it's an exquisite solution, so I recommend you rethink who and why you entrust your wallets security. The pinnacle of cryptography, of bitcoin, is a system that requires you to know your code. I mean honor, I mean integrity, not necessarily that of the intractable, deep math encoding the client, either. Especially prescient is that knowledge that, if you don't trust yourself with your own paper wallets randomization, you can only trust that given sufficient time, every hack will be realized. Without hands on security measures put in place by the capable individual, infinite time*computer integrity = 100% failure.

  • Great answer. I will do some more reading
    – oks
    Mar 16, 2014 at 9:13
  • I'm very glad it was of use to you. Best of luck Mar 20, 2014 at 17:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.