What if you could divide your backup, so that no single piece was useful, and some pieces could be lost? That is the idea behind Shamir backups. This advanced guide is part of our guide to advanced setups.
The idea
Shamir's Secret Sharing, invented by cryptographer Adi Shamir in 1979, splits a secret into shares. You choose:
- N: the number of shares created.
- T: the threshold, or the number needed to recover.
With 2-of-3, any two shares recover the wallet, and one share alone tells an attacker nothing.
SLIP39
SLIP39 is the standard most commonly used for this in crypto. Introduced by SatoshiLabs, it writes each share as a list of 20 or 33 words, from its own list of 1,024 words. It also supports groups, which allow more complex setups, and an optional passphrase.
How it differs from other options
| Feature | Plain BIP39 phrase | Split words | SLIP39 Shamir |
|---|---|---|---|
| One sheet found | Funds lost | Partly exposed | Nothing revealed |
| One sheet lost | Lost, if it is your only copy | Lost | Fine |
| Wallet support | Very wide | Not a standard | Limited |
Never try to split a phrase yourself. That is a different and much weaker thing.
Setting it up
- Use a hardware wallet that supports it.
- Choose your threshold. 2-of-3 is common.
- Write each share down, as carefully as you would a normal phrase.
- Store each share in a separate place.
- Test recovery.
Its limits
- Compatibility. Shares do not work with BIP39 wallets. See compatibility.
- One moment of exposure. Your secret comes together on one device when you restore, and when you sign. Multisig avoids this.
- Still one key. Day to day, a single device holds the whole wallet, unlike multisig.
- Family. Heirs need to understand what shares are.
Who it suits
Shamir suits people who want to spread a backup across locations or family members, without the complexity of multisig. Read Shamir vs multisig.