A recovery phrase creates an uncomfortable trade-off. If you keep one copy, a single fire, flood or burglary can end your access, or hand your funds to a thief. If you keep several copies, every extra copy is another place where someone could find it.
A natural idea is to split the phrase into pieces and store each piece separately. Done properly, this is a real technique with a solid mathematical basis. Done casually, it can leave you worse off than before. This guide explains the difference.
Why cutting the phrase in half is a bad idea
Suppose you have a 12 word phrase and write words 1 to 6 on one paper and words 7 to 12 on another. It feels safer, but it is not much of an improvement.
- Each half leaks a lot. A recovery phrase is drawn from a list of 2,048 words. Someone holding six of twelve words only has to guess the rest, which is a far smaller search than guessing the whole phrase. The exact effort depends on the situation, but you have handed an attacker a big head start.
- You need both halves. Lose either paper and the wallet is gone. Splitting in two increases the chance of losing access, because now two things must survive instead of one.
What Shamir's Secret Sharing does differently
Shamir's Secret Sharing is a scheme from cryptography, published by Adi Shamir in 1979. Instead of cutting a secret into slices, it turns the secret into a set of shares with a special property: you choose a threshold, and any number of shares at or above the threshold can rebuild the secret, while any number below it reveals nothing about it.
The idea is often explained with geometry: hide the secret in a curve, hand out points on it, and you need enough points to pin the curve down. With one point fewer, every possibility remains open, so an attacker holding fewer shares than the threshold learns nothing.
This is usually written as "k of n". In a 2 of 3 setup you create three shares and any two recover the wallet. In a 3 of 5 setup you create five and need any three.
The practical effect is that you get both protections at once:
- Resilience against loss. You can lose a share to fire or misplacement and still recover.
- Resilience against theft. Someone who finds one share, or fewer than the threshold, gets nothing useful.
SLIP-39: Shamir backup for wallets
Shamir's math is general. Wallets needed a standard way to apply it to recovery phrases, and that standard is SLIP-39, an improvement proposal published in 2017 by SatoshiLabs, the company behind Trezor.
A few points about how it works in practice:
- It uses its own word lists. SLIP-39 shares are made of words, like a normal phrase, but they are a different format from the 12 or 24 word BIP-39 phrase most wallets use. Shares are typically 20 or 33 words long.
- You can generate many shares. The standard supports up to 16 shares for a wallet.
Compatibility is the catch
The most important limitation is support. BIP-39 recovery phrases work in almost every wallet. SLIP-39 does not. It is supported by some hardware wallets, including Trezor's Model T, Safe 3 and Safe 5 models, and Keystone, but many popular wallets and apps do not recover from SLIP-39 shares at all.
Two consequences follow:
- You generally cannot convert an existing phrase. If your wallet was created with a normal BIP-39 phrase, moving to Shamir backup usually means creating a new wallet with new addresses and moving your funds to it. It is not a matter of splitting the old phrase into shares.
- You depend on compatible software later. If you ever need to restore, you will need a device or tool that understands SLIP-39. If you can recover on a compatible device first, you can then move funds elsewhere if needed. Check current support for your device before relying on it, since support changes over time.
The danger of generating shares on the wrong device
Some websites and open source tools can split an existing BIP-39 phrase into shares on your computer. This is where many people take a serious risk. To do the split, the full phrase has to be typed or loaded into that software, and to recover it later, the shares are combined on a device again. At that moment, the entire secret exists in one place.
If that computer has malware, or the tool is a fake or has been tampered with, the phrase is exposed. Even the developers of well known tools of this kind warn users never to enter a real phrase into a browser based version and to use an offline, verified copy at most.
The safer approach is to let a hardware wallet generate the shares itself, so the full secret is created and handled inside the device and is never shown on a computer screen. Our guide to choosing and setting up a hardware wallet covers what to look for.
Practical rules if you use Shamir backup
- Pick a threshold you can actually meet. A 3 of 5 scheme is only useful if you can reliably keep three shares safe and reachable. Do not create more shares than you can track.
- Store shares in genuinely separate places. Two shares in the same drawer is effectively one location.
- Test recovery. As with any backup, restore on a spare device before you rely on it, using the approach in our guide on testing your wallet recovery.
- Never photograph shares or store them in cloud notes. Every share you store digitally weakens the protection.
Shamir backup versus a multisig wallet
These sound similar but work at different levels. Shamir splits the backup of one key, but that key still exists in full when you restore and sign. A multisig wallet, covered in our multisig explainer, uses several separate keys that must each approve a transaction, so no single device ever holds enough power on its own. Shamir is about safer storage. Multisig is about safer spending. They can be combined, but multisig adds complexity that many everyday users do not need.
Is it right for you?
For a small everyday wallet, a carefully stored single recovery phrase, ideally tested, is often enough, and it works everywhere. Shamir backup makes more sense when the amount is large, when you worry about both loss and theft, and when you are comfortable using a compatible hardware wallet and keeping careful records.
Whatever you choose, the principle stays the same. A backup is only good if you can recover from it and if nobody else can. Splitting a phrase can improve both, but only when it is done with a proper standard, on a trusted device, and with a plan you have actually tested.