HOW TO CREATE YOUR BITFI SALT & PHRASE — THE OFFICIAL GUIDE First, why we are publishing this now: attackers evolve, and guidance must evolve with them. Modern cracking tools no longer guess blindly - they run AI models trained on billions of leaked human passwords and have become remarkably good at predicting phrases that people invent. The answer is a method with no human pattern to predict. To be clear about where we stand: to date, we are not aware of a single Bitfi user ever losing funds to a hack or exploit. This is not a response to any incident. It is what responsible security looks like, raising the bar before anyone needs it raised. Your salt and phrase are not a password. They ARE your wallet. A Bitfi stores nothing - your keys are calculated from your salt and phrase the moment you transact, then wiped. Your entire security rests on how well they were created. Done right, no computing power on Earth can touch your funds. It takes a few minutes and a pair of dice. WHY YOU CANNOT JUST THINK OF A GOOD PHRASE The human brain cannot produce randomness. Even a strange, whimsical phrase you are certain no one would guess follows grammar, favors common words, and forms sentence-shaped patterns. And cracking software guesses the way humans think: whole words, song lyrics, grammatical structures. The solution: take yourself out of the process entirely. Let physical dice choose your words. This method, Diceware, has been the gold standard in cryptography for decades. A phrase created this way is provably strong. The math is public. STEP 1 — CREATE YOUR PHRASE WITH DICE Get ordinary six-sided dice and the Diceware word list (search "EFF Diceware word list" — a public, numbered list of 7,776 words). Roll a die five times. Write the digits in order — say 2-4-4-6-3. Look up that number in the list to get your first word. Repeat until you have at least SEVEN words. Eight if you are securing significant value. Write them on paper, in order. This paper is temporary; you will decide its fate in Step 4. Your result will look like: brig alert rope welsh foss rang orb. Not a sentence. No meaning. That is the point. Two rules: use real physical dice, not an app or a website. And do not re-roll words you dislike, if you throw back words until they feel pleasing, your brain has re-entered the process. Take what the dice give you. You may add capitalization, symbols, or spaces between words for extra strength. The seven dice-rolled words are your security. STEP 2 — CREATE YOUR SALT The salt makes your wallet unique to you: even if someone else rolled your exact words, their wallet would differ. And if anyone ever found your phrase alone, they could not use or even test it. But it only works if it is not guessable. Never use 12345678, your phone number, birthday, zip code, or anything from your life, attackers try those first, automatically. Use random digits or two dice-chosen words. You will type it every session, so it memorizes itself. STEP 3 — THE ONE-MINUTE CHECK Every word chosen by dice. No grammar, no story, no meaning. No connection to your life or anything you have posted. A salt derived from no fact about you. And one absolute rule: NEVER type your salt or phrase, or anything resembling it, into any website, password checker, notes app, email, or message. Ever. The only places it should ever be entered are your Bitfi device and, if you choose, paper you control (and if necessary, into the Bitfi recovery tool). STEP 4 — MEMORIZE IT (FASTER THAN YOU EXPECT) Because there is no stored password, you type your salt and phrase every session and that repetition is an effective memorization technique. Keep the paper with you, try from memory first, check when needed. Nearly everyone is paper-free within two or three days. Then comes a personal choice, based on your own needs: destroy the paper and carry your wallet purely in memory, or keep a physical backup. Neither is wrong, self-custody means deciding your own arrangement. If you choose backup, do it correctly. If you choose memory alone, destroy the paper completely. STEP 5 (OPTIONAL) — PHYSICAL BACKUP, DONE CORRECTLY Memorization means your Bitcoin crosses any border and survives any disaster with you. If you also want paper backup against injury or forgetting, never write everything in one place. Split it: half the salt and half the words on one paper, the rest on a second, stored in separate locations. No single discovery gives an attacker anything usable. Never label it. No "Bitfi," no "wallet." Unlike a 24-word seed, which announces exactly what it is to anyone who finds it, a fragment of random words is meaningless. Keep that advantage. ENTER IT PRECISELY Same spelling, same capitalization, same spacing, every time. Practice several times on day one while the paper is in hand. WHAT THIS ACHIEVES Your keys exist nowhere in the world. Not on your device, which stores nothing. Not on any server. Bitfi requires no account, no email, no name. Not on paper, except fragments that are individually useless and unrecognizable. Your wallet is seven dice-chosen words and a salt, provably beyond any guessing attack ever demonstrated, living in your memory. ALREADY HAVE A BITFI WALLET? If your phrase was built with dice or is genuinely random, unconnected to language patterns, your life, or anything you've posted, you are exactly where you should be, and nothing in this guide requires any action from you. But if your phrase is a a quote, lyrics, or a sentence with meaning we recommend upgrading. The process is simple, because a Bitfi wallet is just a salt and phrase: create a new wallet following this guide, then send your funds from the old wallet to the new one, exactly as you would send to anyone. Do it very calmly, not hurriedly. Create the new wallet first and practice entering the new salt and phrase several times over a day or two, until it is memorized. Migration itself carries risk (typos in the new phrase, sending to a mistyped address, rushing), and a stampede of unnecessary moves would generate more losses than it prevents. 𝐵𝑖𝑡𝑓𝑖'𝑠 𝑟𝑒𝑐𝑜𝑚𝑚𝑒𝑛𝑑𝑎𝑡𝑖𝑜𝑛 𝑖𝑠 𝑏𝑎𝑠𝑒𝑑 𝑜𝑛 𝑡ℎ𝑒 𝐷𝑖𝑐𝑒𝑤𝑎𝑟𝑒 𝑚𝑒𝑡ℎ𝑜𝑑 𝑑𝑒𝑣𝑒𝑙𝑜𝑝𝑒𝑑 𝑏𝑦 𝐴𝑟𝑛𝑜𝑙𝑑 𝑅𝑒𝑖𝑛ℎ𝑜𝑙𝑑, 𝑤ℎ𝑜𝑠𝑒 𝑤𝑜𝑟𝑑 𝑙𝑖𝑠𝑡 𝑖𝑠 𝑓𝑟𝑒𝑒𝑙𝑦 𝑎𝑣𝑎𝑖𝑙𝑎𝑏𝑙𝑒, 𝑎𝑛𝑑 𝑝𝑜𝑝𝑢𝑙𝑎𝑟𝑖𝑧𝑒𝑑 𝑓𝑜𝑟 𝑔𝑒𝑛𝑒𝑟𝑎𝑙 𝑎𝑢𝑑𝑖𝑒𝑛𝑐𝑒𝑠 𝑏𝑦 𝑇ℎ𝑒 𝐼𝑛𝑡𝑒𝑟𝑐𝑒𝑝𝑡'𝑠 𝑔𝑢𝑖𝑑𝑒 𝑡𝑜 𝑚𝑒𝑚𝑜𝑟𝑖𝑧𝑎𝑏𝑙𝑒 𝑝𝑎𝑠𝑠𝑝ℎ𝑟𝑎𝑠𝑒𝑠. 𝑇ℎ𝑒 𝑢𝑛𝑑𝑒𝑟𝑙𝑦𝑖𝑛𝑔 𝑚𝑎𝑡ℎ𝑒𝑚𝑎𝑡𝑖𝑐𝑠 𝑖𝑠 𝑝𝑢𝑏𝑙𝑖𝑐 𝑎𝑛𝑑 𝑖𝑛𝑑𝑒𝑝𝑒𝑛𝑑𝑒𝑛𝑡𝑙𝑦 𝑣𝑒𝑟𝑖𝑓𝑖𝑎𝑏𝑙𝑒.

One of the most troubling questions in this story: was the device genuine, or swapped for a fake before it ever arrived? With most hardware wallets, that question can never be answered. A factory can build thousands of perfect copies that look and work exactly like the real thing and the owner will never know. This is impossible with a Bitfi. Every device is created with its own unforgeable identity - a unique device ID that works like a birth certificate built into the hardware. A fake Bitfi will not connect or function at all. If your device works, it is genuine. The device proves itself. A genuine Bitfi cannot be tampered with, either. The charging port carries power only. The data lines are physically cut from the board. The electronics are sealed in solid resin. Any attempt to open the device destroys it. And the firmware cannot be changed behind your back. It has not been updated in years: attacked by the world's best hackers, hardened, then deliberately left untouched. We intend to keep it that way unless a change to Bitcoin itself makes it an absolute necessity. But even then: no update installs on a Bitfi without the owner's explicit consent. Because Bitcoin exists so you never have to trust anyone - including the company that made your wallet. Your device does not change unless you allow it. It cannot be faked. It cannot be opened. It cannot be changed. And it stores no keys or data to steal in the first place.

People still don’t fully grasp how insane conventional hardware wallet design really is. You buy a “secure” device…then spend years carrying around a tiny object that literally contains access to your entire financial life. Lose it in a hotel room. Leave it in an Uber. Forget it in airport security. Or it gets seized. Or stolen. And now someone with physical access and the right hardware lab can extract everything from it - without your PIN, without your seed, and without your cooperation. That’s not theory. An entire industry exists to physically extract private keys from conventional hardware wallets. Think about the psychological reality of that for a moment. Imagine realizing your device is missing while sitting on a plane. Your stomach drops. Your mind starts racing. Who has it? Can they break it? How long until my funds disappear? Should I move everything? Am I already too late? That anxiety exists for one reason: Because conventional hardware wallets store all your private keys. Bitfi was built on the exact opposite technology. A Bitfi device stores NOTHING. No seed. No private key. No secret sitting inside memory waiting to be extracted by some future exploit. The device is passwordless because there is nothing on the device to protect with a password in the first place. Your Salt + Phrase IS the seed. You type it in each time, private keys are mathematically derived in memory, transactions are signed, and everything is wiped. Lose the device? Destroyed? Seized? Thrown into the ocean? Who cares. Take another Bitfi device anywhere on earth, enter your Salt + Phrase, and continue as if nothing happened. That is what real freedom feels like and this is the difference between real security and security theater.