What is Shamir backup?

A method of splitting a wallet recovery secret into several shares, of which a chosen number are required to rebuild it.

A three-of-five split lets you store shares in five places and recover with any three, so losing two does not lose the wallet and stealing one gains the thief nothing. Some hardware wallets implement this directly for seed backup. The complexity is the risk: a scheme you cannot execute under stress, or shares whose locations only you remember, fails exactly when it is needed. Document the scheme separately from the shares. See seed phrase and hardware wallet.

Most holders meet it as a menu option during hardware wallet setup, offered as an alternative to writing down a single recovery phrase. It answers a real problem, which is that one piece of paper is both the only way in and the only thing a burglar needs.

How it works

The underlying mathematics is Adi Shamir's 1979 secret sharing scheme. The secret is treated as a point on a polynomial of degree one less than the threshold, and each share is another point on that curve. Any group of shares reaching the threshold determines the curve and therefore the secret. Any group below it determines nothing at all, not a partial secret and not a narrowed search.

The wallet-facing standard is SLIP-0039, which encodes each share as its own list of words with a checksum and defines a two-level grouping scheme, so a scheme can require, for example, two of three groups where each group has its own internal threshold (source: SLIP-0039). Shares from SLIP-0039 are not BIP-39 words and are not interchangeable with them.

Two properties matter for a buyer. Shares are useless below the threshold, so a single found share is not a leak of funds. And the scheme is not compatible across standards, so recovery generally requires a wallet that implements the same standard the shares were produced by.

Example

Illustrative scheme. You choose three of five. You keep one share at home, one at a relative's house, one in a bank box, one at your workplace, and one with a lawyer. A house fire destroys one and a relative moves away and loses another. Three remain, which is the threshold, so the wallet recovers. A burglar who takes the home share alone gets nothing, because one share of a three-of-five split reveals no part of the secret.

Now change the threshold to four of five and repeat the same losses. Three remain, the threshold is four, and the wallet is gone. The threshold is the whole design decision.

Why it matters when you buy

This only becomes relevant once you hold coins yourself rather than on a venue, so it belongs to the decision about whether to withdraw at all. Withdrawal costs differ sharply by venue and are shown on the fee comparison, and the practical setup steps are covered in the hardware wallet setup guide and the seed phrase backup guide.

Related terms

• seed phrase — the secret being split
• hardware wallet — where the split is usually generated
• multisig — the on-chain alternative to splitting a secret
• cold storage — where shares are meant to live
• social recovery — the guardian-based alternative
• passphrase — an extra factor on top of any backup

Questions

Is this the same as multisig?

No. Shamir splitting reassembles one key from shares, so the whole key exists on one device at recovery. Multisig keeps several independent keys that each sign separately and never combine. See multisig.

Can I convert an existing recovery phrase into shares?

Only with a wallet that supports the conversion, and the shares will follow SLIP-0039 rather than BIP-39. Check what your device supports before assuming a future wallet can read them.

Where should shares be stored?

In locations that do not fail together. Two shares in the same building, or two with the same person, effectively count as one against fire, theft, and flood.