The procedure

1. Check the set. Lay all 32 pills out and confirm each character appears exactly once. A missing or duplicated pill silently changes the odds, and no later check will catch it.
2. Mix. Put every pill in the opaque bag and mix thoroughly. The bag needs enough room that the pills actually move against each other.
3. Draw without looking. Take one pill out of the bag and write its character down. Read the character with the orientation bar at the bottom.
4. Put the pill back, then mix again. This is the step the whole method depends on. Drawing without replacement gives a different distribution and fewer bits per draw.
5. Repeat. Keep going until you have the number of characters you need. Repeated characters are expected — keep every draw, including runs that look patterned. Discarding a draw because it looks wrong is how you introduce bias.
6. Complete the string. Choose the header, calculate the 13-character checksum offline, then read the whole string back against your worksheet and verify it.

How much entropy you get

Each independent, uniform draw from 32 equally likely pieces contributes log₂ 32 = 5 bits, exactly. A seed is a whole number of bytes, so the last character's low bits are padding and get discarded when the payload is decoded.

Keep all 26 or 52 characters when calculating the checksum. The 2 or 4 padding bits are dropped only at the last step, when the payload is decoded into seed bytes. BIP-93 permits any value in those trailing bits.

Writing it down

The worksheet is the same codex32 string, broken into numbered groups of four so you can keep your place and read it back in fours. Nineteen groups, which is what a 256-bit secret needs.

1. Fill the header before you draw. The prefix MS1 is printed into group 1, because it is fixed. Put the threshold beside it — 0 for an unshared secret, 2–9 for a share set — then the four-character identifier in group 2, and the share index in the first box of group 3.
2. Your first draw goes in the box marked START. That is the second box of group 3, not the first box on the card: the header comes first. Write one character per box and carry on down the column.
3. Your last box is marked. 26 for a 128-bit secret, 52 for a 256-bit one — write in that box and stop. Both fall in the middle of a group, which is why they are marked at all; the box after yours is no longer something you draw.
4. Then the checksum, thirteen characters. Calculate it offline and write it into the boxes that follow. A 128-bit string ends at group 12; the shaded groups 13–19 belong to 256-bit secrets only, and the last two boxes of group 19 are never used.
5. Write the index in the heading box too. It is the only thing you can read with a stack of worksheets in your hand.

Write capitals throughout. The charset along the foot of the card is the full alphabet in the order the pills use, so you can check a character you are unsure of — 0 is a zero, and B, I and O never appear.

Drawing shares

Draw32 also supplies the payloads for codex32 Shamir shares. A fresh scheme with threshold k starts with k independently drawn shares. They share an identifier, a threshold and a payload length, and each gets a different index character. Calculate a checksum for each, then derive any further shares using the BIP-93 procedure.

For a 2-of-3 scheme at 128 bits, that means drawing two separate 26-character payloads. The third share is computed from those two, not drawn. Any two of the three then reconstruct the secret.

Before you rely on it

• Calculate checksums on an offline device, or on paper with the codex32 booklet. Nothing from a draw should be typed into a web page, including this one.
• Restore the wallet from the string and confirm it produces the addresses you expect, before you send anything to it.
• Store the worksheet the way you would store a seed phrase. The pills tell an attacker nothing; the worksheet tells them everything.

Where the format comes from

Draw32 is a kit for an established method, not a new scheme.

BIP-93 — the codex32 format and its secret-sharing procedure.

The codex32 illustrated guide — paper tools for calculating checksums and splitting secrets by hand.

SeedPills — printable BIP-39 lottery pieces, the inspiration for the physical format.