Is Shamir secret sharing safer than just hiding my 24-word seed phrase?

It addresses a different risk. A single hidden seed has one point of failure: find it and you own the wallet; lose it and the funds are gone. Shamir secret sharing splits recovery across multiple shares so no single location is fatal or sufficient on its own, which both reduces theft risk and adds redundancy when configured with N greater than M.

Can I just split my BIP-39 seed phrase into parts myself instead of using SLIP-39?

No, manual splitting is insecure. Each chunk of a BIP-39 phrase is plaintext, so finding one card leaks real entropy and shrinks the brute-force space for the rest. It also gives zero redundancy because every chunk is required. SLIP-39 uses true threshold cryptography where sub-threshold shares reveal nothing and you can lose spare shares safely.

What threshold should I choose, 2-of-3 or 3-of-5?

It depends on your tolerance for loss versus theft. 2-of-3 lets you lose one share and requires an attacker to grab two locations, which suits most individuals. 3-of-5 tolerates two lost shares and forces an attacker to compromise three sites, better for larger holdings or wider geographic distribution. Always keep the share count higher than the threshold so you have redundancy.

Does Shamir backup work with my existing hardware wallet?

It depends on the device. Trezor Model T and Safe series implement SLIP-39 natively as Shamir Backup, but you must create a new wallet rather than convert an existing single-seed one in place. Not every hardware wallet supports SLIP-39, so check your model's documentation before relying on it, and move funds to the new Shamir-backed wallet after setup.

Shamir Secret Sharing for Seed Phrases: Split Your Backup Into Shares (SLIP-39)

June 27, 2026 — By Tony Rabbit in Tutorials

Learn how a Shamir secret sharing seed phrase backup splits your wallet recovery into N shares where any M reconstruct it, removing single points of failure with SLIP-39.

A Shamir secret sharing seed phrase backup splits your wallet recovery secret into several separate shares, where any chosen subset (for example, any 3 of 5) rebuilds the original, but fewer than that reveals nothing at all. Shamir Secret Sharing (SSS) is a math-backed threshold scheme published by cryptographer Adi Shamir in 1979, and SLIP-39 is the standard that applies it to crypto wallets. Instead of one fragile backup that can be lost, stolen, or destroyed, you get redundancy and resistance to theft at the same time. This guide explains why naive chopping is dangerous, how the threshold math works, how to choose a layout, and how to do it on a Trezor.

Key Takeaways

SSS is a threshold scheme: any M of N shares recover the wallet, fewer than M reveal nothing.
Manually splitting a 24-word phrase into thirds is insecure because each chunk leaks real entropy.
SLIP-39 is the open standard that implements SSS for hardware wallets like Trezor.
Threshold choice (2-of-3 vs 3-of-5) trades convenience against theft resistance.
SSS is independent of your storage medium, you still choose paper or metal for each share.

Why naively splitting a 24-word phrase into thirds is insecure

The intuitive idea is to write your 24-word seed phrase on three cards, eight words each, and hide them apart. This is one of the most dangerous mistakes in self-custody, and it fails on both ends of the security tradeoff.

First, it leaks entropy. A 24-word BIP-39 seed encodes 256 bits of randomness. If an attacker finds just one of your three cards, they have not learned a third of nothing, they have learned a concrete eight words in known positions. That collapses the remaining search space dramatically. With two cards out of three, brute-forcing the missing third is well within reach of motivated attackers. The chunks are not opaque pieces; they are plaintext fragments of your key.

Second, it has no real redundancy. Lose any single card and the seed is gone forever, because you need all three chunks to reconstruct the phrase. So you have simultaneously increased theft risk and kept the same single-point-of-failure fragility you were trying to escape. If you want a refresher on why the recovery phrase matters this much, see our guide on how to recover a crypto wallet from a seed phrase.

How SLIP-39 and Shamir secret sharing split a seed into M-of-N shares

Shamir Secret Sharing solves both problems with mathematics rather than scissors. The secret is encoded as a point on a polynomial curve over a finite field. To define a curve that requires M points to solve, the scheme draws N points from it and hands one to each shareholder. Any M points uniquely determine the curve and therefore the secret. With M-1 points, the curve is completely undetermined, so every possible secret remains equally likely. The leftover shares reveal exactly zero information.

This is the crucial difference from chopping. A SLIP-39 share is not a slice of your words. Each share is its own 20-word or 33-word mnemonic that, on its own, is cryptographic noise. Holding two shares of a 3-of-5 setup tells an attacker nothing useful about the wallet. That is what makes the scheme a genuine single-point-of-failure remover rather than a liability multiplier. SLIP-39 (SatoshiLabs Improvement Proposal 39) is the open standard that packages this for wallets, complete with checksums, passphrase support, and a dedicated wordlist.

Approach	Leaks entropy?	Tolerates a lost piece?	Standardized?
Chop phrase into thirds	Yes, each chunk is plaintext	No, all chunks required	No
SLIP-39 / Shamir (M-of-N)	No, sub-threshold reveals nothing	Yes, up to N minus M shares	Yes, SLIP-39

Choosing a threshold: 2-of-3 vs 3-of-5 and storage geography

Picking M and N is a risk-management decision, not a technical one. Two numbers define everything: M is how many shares you need to recover, and N minus M is how many shares you can afford to lose. The gap between M and N is your redundancy budget.

A 2-of-3 layout is the popular starting point. You can lose one share and still recover, and an attacker needs two of your three locations to steal funds. A 3-of-5 layout is more robust: you tolerate two lost shares and an attacker must compromise three of five sites. Higher thresholds increase theft resistance but also increase the chance you cannot gather enough shares when you actually need them.

Storage geography matters as much as the numbers. Shares stored in the same drawer offer redundancy against a single damaged copy but none against a house fire or burglary. Spread shares across distinct trust domains: a home safe, a bank deposit box, a trusted relative, a second property. Pair this with our advice on storing a seed phrase safely on paper versus metal, because SSS decides how the secret is divided, not what material each share is etched on. For estate planning, distributing shares to heirs is also covered in our guide on what happens to your crypto when you die.

Trezor SLIP-39 walkthrough

Trezor hardware wallets implement SLIP-39 natively under the name Shamir Backup, available on Trezor Model T and Safe series devices. SatoshiLabs authored the standard, so the on-device flow is first-class. Here is the typical path using the Trezor Suite app:

Start a fresh wallet setup on the device and choose Shamir Backup instead of a single recovery phrase. Existing single-seed wallets cannot be converted in place; you create a new wallet and move funds over.
Set the total number of shares (N) and the threshold (M) on the device screen. The hardware enforces the rules so you cannot pick an impossible combination.
The device displays each 20-word share one at a time. Write each share on its own backup card or metal plate and label it clearly, for example "Share 1 of 5".
The device prompts you to confirm a few words from each share so it knows the transcription is correct before you finish.
Distribute the shares to your chosen locations. To recover later, you re-enter any M shares into a Trezor device, which reconstructs the master secret on-device only.

Because the reconstruction happens inside the secure element, the full secret never exists on an internet-connected computer. If you are still choosing hardware, compare options in our best cold wallets comparison.

Failure modes: lost shares, thresholds set too high, and human error

SSS removes single points of failure, but it introduces new ways to lock yourself out if you are careless. The most common failure is setting the threshold too high relative to how reliably you can store shares. A 4-of-4 scheme has no redundancy at all; it is strictly worse than a single backup because now any one of four losses is fatal. Always keep N greater than M.

The mirror-image failure is losing more than N minus M shares. In a 3-of-5 setup, losing three shares is unrecoverable. Audit your shares periodically and replace any that are damaged, illegible, or whose holder you no longer trust. Mixing shares from two different wallets, or from two different SSS sessions of the same wallet, will also fail, because shares only combine within the set they were generated together.

Finally, treat each individual share with the same care as a full seed in transit. While a sub-threshold number of shares reveals nothing, a SLIP-39 passphrase (if you set one) is the one piece that must be remembered or stored entirely separately, never with the shares. For broader operational security habits, see our guide on how to protect crypto from hackers.

This article is for educational purposes only and is not financial advice.