<p>I would never use a online-computer to create a paper wallet. Also, I would never use a browser to generate a seed.</p>

<p>Have a look at: <a href="http://cryptographi.com" rel="nofollow">http://cryptographi.com</a></p>

<p>That looks like a neat project.</p>

CC BY-SA 3.0
2016-05-23T21:12:43.907Z
You should substantiate that a bit further. window.crypto.getRandomValues() is not Math.random, and is a cryptographically secure way of fetching randoms from /dev/urandom / CryptGenRandom(). I concur with your statement on using a computer that is online.
Riaan Swart
CC BY-SA 3.0
2016-05-24T13:41:59.487Z
I'm not saying that javascript can't return a proper seed, but browsers had been an entrance for all types of malware during the last years. Why would you use a browser to generate a seed?
Jonas Schnelli
CC BY-SA 3.0
2016-05-24T18:38:45.763Z
Are you being serious? I'm seriously shocked that a Bitcoin Core developer is incapable of understanding why this is a good idea, given the adversarial landscape we're in. Being able to check both the hash of the downloaded file, as well as visually look through the JavaScript for weirdness, puts it one step above even Gitian-signed binaries (which is effectively trusting a small group of hopefully-trustworthy-individuals).
Riaan Swart
CC BY-SA 3.0
2016-05-24T18:42:45.410Z
Which means we're left looking at the attack surface a browser represents. Yes, attacks like XSS exist, but they are trivial to defend against in this instance, and always require you to have the malicious tab / window open. If the machine is offline what other possible vectors are there? Bitaddress and similar don't require Flash or anything like that, and they pass the RNG work straight to the OS.
Riaan Swart
CC BY-SA 3.0
2016-05-24T18:59:30.627Z
No offense. But if you really think the browser is the right environment to create a seed that could be "responsible" for a couple of ten thousands of dollars, then go ahead.
Jonas Schnelli
CC BY-SA 3.0
2016-05-24T19:12:56.397Z
I absolutely do think it's fine for 99% of people's use-cases. The ultra paranoid, or those requiring greater security, would use diceware and not a computer program, regardless of the execution environment.
Riaan Swart
CC BY-SA 3.0
2016-05-24T19:29:22.557Z
Stuff like this: http://landing2.trusteer.com/sites/default/files/Temporary_User_Tracking_in_Major_Browsers.pdf and this: https://dl.packetstormsecurity.net/papers/general/Google_Chrome_3.0_Beta_Math.random_vulnerability.pdf make me think that you are wrong. I could imaging that there are serval attack vectors where a tab or browser window in the background could attack/read the PRNG. Maybe even a app (Chrome app) in the background.
Jonas Schnelli
CC BY-SA 3.0
2016-05-25T02:26:25.400Z
Why would you have another tab or browser window open in the background? That seems highly illogical; if someone has the presence of mind to generate their keys on an airgapped machine they will most definitely have the presence of mind to do so on a fresh boot with no other programs running. Thus the attack surface is EXACTLY THE SAME as not using a browser: the computer may already have been infected by malware, which is a possibility regardless of the presence of a web browser.
Riaan Swart
CC BY-SA 3.0
2016-06-13T15:24:27.930Z
@RiaanSwart: You're making a lot of assumptions about the reader's knowledge-level and security practices. I don't think it's valid to do so for the broad mass of this site's visitors.
Murch
CC BY-SA 3.0
2016-05-23T19:19:37.987Z
2016-06-13T15:25:44.417Z
2016-06-13T15:25:44.417Z
Jonas Schnelli
<p>If you use bitaddress.org, click on paper wallets, you can hide art and generate and print 7 per page on standard paper or 3 per page with art - up to the amount you need.  You would then need to xfer btc to these new accounts AFTER printing though.  For extra security, you could also use this bitaddress.org solution on a computer with no internet.  Just save the entire webpage to a thumbdrive and run it from the non-connected computer. Hope this helps.</p>

CC BY-SA 3.0
2016-05-23T18:53:57.440Z
2016-05-23T18:53:57.440Z
user54258
<p>I'd like to print many paper wallets which have bitcoins in them. Are there any tools for it?</p>

<p>There are many paper wallet tools which can create and print one paper wallet.</p>

<paper-wallet>
Is there any paper wallet printing tools which can print many QR codes?
Satoshi Nakanishi
# Is there any paper wallet printing tools which can print many QR codes?

(Asked by: username_0 on 2016-05-23)

I'd like to print many paper wallets which have bitcoins in them. Are there any tools for it?

There are many paper wallet tools which can create and print one paper wallet.

**Tags:** paper-wallet


---

## 2 answers

### Answer by username_4 on 2016-05-23. Score: 3 | Accepted answer

If you use bitaddress.org, click on paper wallets, you can hide art and generate and print 7 per page on standard paper or 3 per page with art - up to the amount you need. You would then need to xfer btc to these new accounts AFTER printing though. For extra security, you could also use this bitaddress.org solution on a computer with no internet. Just save the entire webpage to a thumbdrive and run it from the non-connected computer. Hope this helps.


---

### Answer by username_1 on 2016-05-23. Score: 0

I would never use a online-computer to create a paper wallet. Also, I would never use a browser to generate a seed.

Have a look at: <http://cryptographi.com>

That looks like a neat project.

> **Comments:**
> **username_2**: You should substantiate that a bit further. window.crypto.getRandomValues() is not Math.random, and is a cryptographically secure way of fetching randoms from /dev/urandom / CryptGenRandom(). I concur with your statement on using a computer that is online.  
> **username_1**: I'm not saying that javascript can't return a proper seed, but browsers had been an entrance for all types of malware during the last years. Why would you use a browser to generate a seed?  
> **username_2**: Are you being serious? I'm seriously shocked that a Bitcoin Core developer is incapable of understanding why this is a good idea, given the adversarial landscape we're in. Being able to check both the hash of the downloaded file, as well as visually look through the JavaScript for weirdness, puts it one step above even Gitian-signed binaries (which is effectively trusting a small group of hopefully-trustworthy-individuals).  
> **username_2**: Which means we're left looking at the attack surface a browser represents. Yes, attacks like XSS exist, but they are trivial to defend against in this instance, and always require you to have the malicious tab / window open. If the machine is offline what other possible vectors are there? Bitaddress and similar don't require Flash or anything like that, and they pass the RNG work straight to the OS.  
> **username_1**: No offense. But if you really think the browser is the right environment to create a seed that could be "responsible" for a couple of ten thousands of dollars, then go ahead.  
> **username_2**: I absolutely do think it's fine for 99% of people's use-cases. The ultra paranoid, or those requiring greater security, would use diceware and not a computer program, regardless of the execution environment.  
> **username_1**: Stuff like this: http://landing2.trusteer.com/sites/default/files/Temporary_User_Tracking_in_Major_Browsers.pdf and this: https://dl.packetstormsecurity.net/papers/general/Google_Chrome_3.0_Beta_Math.random_vulnerability.pdf make me think that you are wrong. I could imaging that there are serval attack vectors where a tab or browser window in the background could attack/read the PRNG. Maybe even a app (Chrome app) in the background.  
> **username_2**: Why would you have another tab or browser window open in the background? That seems highly illogical; if someone has the presence of mind to generate their keys on an airgapped machine they will most definitely have the presence of mind to do so on a fresh boot with no other programs running. Thus the attack surface is EXACTLY THE SAME as not using a browser: the computer may already have been infected by malware, which is a possibility regardless of the presence of a web browser.  
> **username_3**: @username_2: You're making a lot of assumptions about the reader's knowledge-level and security practices. I don't think it's valid to do so for the broad mass of this site's visitors.  

---

