Only the most recent release receives security fixes. Users are encouraged to always use the latest version, available from the releases page and the official website.

EntropyLab handles Bitcoin private keys, seed phrases, and other secret wallet material. Its security posture rests on the following model:

• The tool is self-contained and designed for offline, air-gapped use. It does not intentionally transmit sensitive data to any server.
• The on-screen result of any derivation can only be as trustworthy as the code that produced it. Review the source, build from src/, and test the tool with published vectors before relying on it.
• Wallet security depends on the quality and secrecy of the entropy, seed phrase, passphrase, or private key supplied by the user, and on the integrity of the machine it runs on.
• Low-entropy dice and card transcripts are accepted intentionally so the calculator can be used for deterministic tests, demonstrations, and recovery experiments. EntropyLab does not claim that hashing a short input makes it secure. When the entered transcript is below the recommended entropy target, the result displays a prominent warning with the estimated supplied entropy and says to use it only for testing. Users who intend to secure funds must meet the displayed roll/card recommendation and verify their procedure independently.
• Material involving loss of funds (incorrect derivations, exfiltration of secret data, injected script execution in the generated HTML, unexpected network egress) is treated as a security issue.

Please report suspected security issues privately through GitHub Security Advisories rather than opening a public issue. If private reporting is unavailable, reach the maintainers through the official website.

Include the version, the affected input type and derivation path if relevant, and a description of the impact. A maintainer will acknowledge the report and coordinate a fix; scope it as narrowly as needed to reproduce responsibly.

This software is provided without warranty of any kind — no express, no implied, no promise it work or fit any purpose — under The Ooga Booga License, which dedicates it to the public domain. The caveman words mean what The Unlicense means. Keep verified backups, and use it at your own risk.