Guide

Shamir secret sharing, explained.

Shamir secret sharing splits a secret into N shares so that any K of them rebuild it exactly, and any fewer than K reveal nothing at all. Adi Shamir (the S in RSA) published it in 1979. It's how you give a secret to a group without trusting any one member of it.

The idea in one picture

Two points define a straight line; one point doesn't. If your secret is where a line crosses the vertical axis, you can hand out points on that line. Anyone with two points draws the line and reads the secret. Anyone with one point knows nothing: infinitely many lines pass through it, crossing the axis at every possible value.

Generalise: K points define a polynomial of degree K−1. Pick a random polynomial whose constant term is your secret, give each person one point on it, and any K of them can rebuild it by interpolation.

Why fewer shares reveal nothing

This is the part that makes it special. It isn't "hard to break" the way encryption is; it's information-theoretically secure. With K−1 shares, every possible secret is exactly equally likely. No amount of computing power, quantum or otherwise, changes that. Real implementations do the arithmetic over a finite field (usually GF(2⁸), one byte at a time) so that this holds exactly.

Where it's used

Key ceremonies: root keys for certificate authorities and DNSSEC are split between keyholders.
Crypto wallets: SLIP-39 seed phrases and many custody products split the seed this way.
Break-glass access: production root credentials that need two of three directors.
Inheritance: letting family recover a secret together, but not individually. See crypto inheritance.

Pitfalls people hit

Rolling your own. Field arithmetic, randomness and side channels are easy to get subtly wrong. Use an audited library.
No integrity check. Plain Shamir can't tell a correct share from a typo or a forgery; it just rebuilds the wrong secret. You need checksums per share and a way to detect a bad one.
Splitting the secret directly. Each share is as long as the secret, so splitting a 100 MB file gives everyone 100 MB. The usual fix: encrypt the data with a random key and split only the key.
Rebuilding on an online machine. At the moment of recovery the whole secret exists in one place. Do it somewhere you trust, ideally offline.
Never testing recovery. A share that was mistyped on day one is only discovered on the worst day.

A free tool that handles the pitfalls

Zero-Trust Vault uses Shamir the recommended way: it encrypts your secret or file with AES-256-GCM, then splits only the key, using the shamir-secret-sharing library (audited by Cure53 and Zellic) unmodified. Each share has its own checksum, the key has a fingerprint, and if you supply more than K shares it finds a consistent set and names any forged ones. Everything runs in your browser, in an isolated worker; nothing is uploaded. Thresholds from 2 to 16 shares, printable recovery kits with QR codes, and a Verify tab to test recovery without decrypting.

Split a secret, free

The full file format, the threat model and what isn't audited yet are on the security page. Source: GitHub (AGPL-3.0).