zecpaperwallet is a Zcash Sapling paper wallet generator that can run completely offline. You can run it on an air-gapped computer to generate your shielded z-addresses, which will allow you to keep your keys completely offline.
If you are running a newish version of Linux, you can be doubly sure that the process is not contacting the network by running zecpaperwallet without the network namespace.
```
sudo unshare -n ./target/release/zecpaperwallet
```
`unshare -n` runs the process without a network interface which means you can be sure that your data is not being sent across the network.