It's relatively easy to create a random, 'raw' BIP39 passphrase, without using any computer, using a coin or a dice (e.g. 132 flips or throws with an unbiased item).

But can you compute the correct last word (it includes the checksum) on paper?

Can you derive a bitcoin address from the passphrase on paper? Or do you need to trust some chip, some CPU, with whatever inside?

I'm working on a solution...