How to split a secret into shares
- Type the secret: a master password, a crypto wallet seed phrase, a safe combination or recovery codes.
- Choose how many shares to create and how many are needed to recover it, for example 5 shares with any 3 required.
- Press Split and give each share to a different trusted person or store them in different places.
- To recover, choose Recover a secret and paste the required number of shares, in any order.
How Shamir's Secret Sharing works
This tool uses Shamir's Secret Sharing, published by Adi Shamir (the S in RSA) in 1979. For each byte of the secret, it builds a random polynomial whose constant term is that byte, with degree one less than the number of shares needed. Each share is a point on the polynomial. With enough points the polynomial, and so the secret, can be rebuilt exactly; with one point fewer, every possible secret is equally likely, so a partial set of shares reveals nothing at all. The maths runs over the finite field GF(256), the same field used in AES.
It is ideal for inheritance and emergency planning, such as leaving a password manager's master password with family members so that no single person can open it alone, or for company recovery keys held by several directors. A checksum inside the shares detects mistyped or mismatched shares. Shares are as sensitive as they are powerful: label them, keep them apart, and never store enough of them in one place. Everything runs locally, with randomness from the Web Crypto API.
Does one share reveal part of the secret?
No. Fewer shares than the threshold give no information at all, not even partial characters.
Does the order of shares matter?
No. Paste any combination of the required number of shares, in any order.
Is this compatible with other Shamir tools?
The share format is specific to this tool, so recover shares here. The page works offline once loaded.