Shamir Secret Sharing

To split:

1. Type or paste the secret.
2. Set Shares to create (how many pieces) and Needed to recover (how many must come together). 3 of 5 is a good start.
3. Copy or save each share separately and hand them out. Click Test recovery first to confirm they work.

To recover:

1. Switch to Recover and paste the shares, one per line, in any order.
2. Once enough are in, the secret appears, marked Checked. With too few, the tool tells you how many more it needs.

Each share looks like 3-1-b720-a4a9f742…: the number needed, the share's number, a code shared by every share from the same split, then the share itself. The data includes a hidden check, so a typo or a share from a different split is caught instead of producing a wrong secret.

You want a backup of your password manager's master password that survives losing a copy, without any one person or place holding the whole thing. Click Example to follow along.

Two numbers pull against each other. The gap between them is how many shares you can lose. The number needed is how many shares a thief, or a group of people, would have to collect.

Make needed larger than the number of shares any one person or place holds, and leave a gap of at least one or two for lost shares. People move, safes get cleared out, and envelopes get thrown away.

The idea, published by Adi Shamir in 1979, rests on a simple fact: two points fix a straight line, three points fix a curve like a parabola, and so on.

1. The secret becomes the point where a line crosses the vertical axis. For 2-of-N, draw a random straight line through it.
2. Each share is a different point on that line.
3. With two points you can redraw the line and read off the secret. With only one point, every possible secret has a line through it, so a single share says nothing.

Needing 3 shares uses a curve (a degree-2 polynomial), needing 4 uses a degree-3 one, and so on. The maths is done one byte at a time in a finite field of 256 values, the same one AES encryption uses, so each share holds as many bytes as the secret, plus four for the check. The random curves come from your browser's secure random generator.

The tool checks the shares before showing anything. Here is what each message means:

Shares only work with the tool, or the same scheme, that made them. Shamir tools each write shares in their own format, so a share from another app will not combine here even though the idea is the same. Shares made by the earlier version of this page are still read, but they have no built-in check, so if the result looks scrambled, add more shares.

• Keep shares apart. Splitting is pointless if enough shares sit in the same drawer, inbox or cloud folder.
• Write down how many are needed and who holds the others, so the people involved know what to do. Each share starts with the number needed, and a saved share file says it in words.
• Test before you rely on it. Recover the secret from a few shares before handing them out.
• Paper lasts. A printed or handwritten share does not depend on a working device or account. Copy it exactly; the check will catch a mistake, but cannot fix it.
• Share length gives away secret length. Shares hide what the secret is, not roughly how long it is.

For something very valuable, open this page, disconnect from the internet, then split the secret. Nothing is sent anywhere either way, but working offline removes any doubt. For a cryptocurrency wallet, use the wallet's own Shamir backup (the SLIP-39 standard) if it has one, since the wallet can restore from those shares directly.