Shamir secret sharing

Split a secret

Secret (text)

Shares (n)

Needed (k)

 Split it

Copy the first k shares into the box below

Combine shares

Paste shares, one per line

Nothing you type here leaves your browser. Even so, think before you paste a real secret into any web page.

This Shamir secret sharing tool splits a secret into n shares so that any k of them bring it back, and fewer than k reveal nothing at all. Splitting and combining both happen in your browser. It suits a backup of something you can't afford to lose or leak, like a recovery key or a seed phrase.

Using it

To split a secret, type it in, choose how many shares to make (n) and how many are needed to get it back (k), and press Split it. Each share is a line of text such as 3-2-9af0…, made of the threshold, the share's number, the share's bytes in hex and four check characters that catch a typing mistake. Give different shares to different people or keep them in different places. To get the secret back, paste any k shares, one per line, into the second box. With fewer than k, or shares from different secrets, the tool says so and shows nothing.

A good use is a backup of something you can't afford to lose or to leak, such as a password manager's recovery key, a wallet seed phrase or the passphrase to an encrypted archive. With 3 of 5 shares, any two people can lose theirs and the secret survives, and an attacker who steals any two learns nothing at all.

How it works

Adi Shamir published the idea in 1979 in a two-page paper, How to Share a Secret, and George Blakley found a different scheme the same year. It rests on a fact about polynomials. k points determine a polynomial of degree k − 1 exactly, and fewer points don't. Two points fix a line, while one point lies on infinitely many. To split a secret, choose a random polynomial of degree k − 1 whose value at 0 is the secret, and give each person its value at a different x. Any k people can reconstruct the polynomial and read off its value at 0. Fewer can't.

To work on bytes without rounding errors, the arithmetic is done in GF(256), the finite field of 256 elements that AES also uses. Addition there is XOR, and multiplication is carry-less with a reduction by the polynomial x⁸ + x⁴ + x³ + x + 1 (11b). Every byte of the secret is shared separately, each with its own random polynomial.

One byte, by hand

These numbers come from scripts/examples/shamir-worked.mjs. Take the secret byte 42 and a 2-of-3 split, so the polynomial is a line, f(x) = 42 + a₁·x. Pick the random coefficient a₁ = a7. The shares are f(1) = 42 ⊕ a7 = e5, f(2) = 42 ⊕ (a7·2 = 55) = 17, and f(3) = 42 ⊕ (a7·3 = f2) = b0. To recover from shares 1 and 3, Lagrange interpolation at 0 weights them by 8c and 8d, and e5·8c ⊕ b0·8d = 42. From shares 1 and 2 the weights are f7 and f6, and the answer is 42 again. Share 1 alone, e5, fits every possible secret. For any guess g, the coefficient a₁ = e5 ⊕ g would have produced it. So one share tells you nothing, and that's a mathematical fact, not a computational assumption, so no amount of computing power helps. This site's tests check it directly: for a degree-2 polynomial, two shares are consistent with all 256 possible secret bytes.

What the checks are, and aren't

Plain Shamir sharing has a flaw in practice. Combine the wrong shares, or too few, and you still get an answer. It looks like noise but nothing marks it as noise. This tool adds two safeguards. Before splitting, it appends a 4-byte CRC-32 of the secret, so the combiner can tell a correct recovery from garbage and refuses to show garbage. And each share ends with a CRC-16 over its contents, so a mistyped character is caught as soon as the share is read. Both are error checks, not security features (checksums catch accidents, not attackers), and neither lets anyone learn anything about the secret from fewer than k shares.

Limits worth knowing

• Shares aren't authenticated. A person holding a share can hand over a changed one. The check bytes will notice that the result is wrong, but not who caused it. Schemes that let each holder verify their share exist (Feldman's and Pedersen's verifiable secret sharing), and this tool isn't one of them.
• The shares reveal the length. Each share is as long as the secret plus four bytes.
• Losing more than n − k shares loses the secret for good. Choose k and n by weighing how likely a share is to be lost against how likely it is to be stolen.
• Splitting isn't encrypting. For a large file, encrypt it with a key (AES-GCM) and split the key.
• The random coefficients matter. They come from the browser's secure generator (random numbers in the browser), and a predictable generator would make the shares guessable.
• Mind where you paste. Nothing leaves this page, but any secret you paste into a web page is exposed to that page's code and to your browser's extensions. For a very valuable secret, run the algorithm on an offline machine.

Where it's used

Shamir sharing underlies the unseal keys of HashiCorp Vault, several hardware-wallet backup schemes (SLIP-39, a standard from Trezor's maintainers that adds a word encoding to the same math), and many corporate key ceremonies, in which a master key is split among officers so no one person can use it. A close relative, in which the shares are combined to compute something without ever reassembling the secret, is the basis of threshold cryptography.

Common questions