Seriously: a box of dice, some graph paper, and a little patience goes a long way in terms of security. Your threat model almost certainly is one in which writ

Seriously: a box of dice, some graph paper, and a little patience goes a long way in terms of security. Your threat model almost certainly is one in which writing down a strongly-generated password is much more secure than anything else, if you take efforts to secure the written copy. I feel like passwords are some kind of magical Wild West of crypto, where everyone has rolled their own and the "best practice" recommendations are often nonsense that ignores threat modeling and I'm just taking crazy pills for thinking we should treat it like other kinds of crypto where users only apply standard methods with verified entropy generation.