Shamir Secret Sharing

How to split a secret

1. Type or paste the text to protect into Secret (text): a recovery phrase, a master password, an encryption key…
2. Set the Number of shares (N) and the Shares needed to rebuild (M). For example, N = 5 and M = 3 means any 3 of the 5 shares rebuild the secret, and 2 shares reveal nothing.
3. Click Split secret. Each share appears on its own line with a Copy button; you can also Copy all shares or Download shares (.txt).
4. Click Test: combine the first M shares to check that the shares work before you hand them out.
5. Give each share to a different person or store it in a different place. Do not keep them all together, or the split is pointless.

How to rebuild the secret

1. Paste at least M shares into Shares, one per line, in any order. Blank lines are ignored.
2. Click Combine shares. The text appears under Recovered secret, and the status says which share numbers were used.
3. If a share has a typo, comes from another split or appears twice with different content, the tool says which one and why, instead of returning garbage.

How Shamir’s secret sharing works

Adi Shamir published the scheme in 1979. To share one byte s with threshold M, pick a random polynomial of degree M − 1 whose constant term is s: f(x) = s + a₁x + … + a₍M−1₎x^(M−1). Share number x is the value f(x). Any M points determine the polynomial, so Lagrange interpolation at x = 0 gives back s; with fewer than M points, every value of s is equally likely, so the shares leak nothing about the secret.

This tool works in the finite field GF(256) (the one used by AES, with the reduction polynomial x⁸ + x⁴ + x³ + x + 1), so each byte of the UTF-8 secret gets its own polynomial and shares are exactly as long as the secret. The random coefficients come from crypto.getRandomValues, the browser’s cryptographic random generator. Everything runs locally: the secret and the shares never leave your device.

Share format

A share looks like 3-2-5f1c…: the threshold M, the share number X (1 to 255), then hexadecimal data. The data holds the polynomial values for the secret followed by a 4-byte CRC-32 of the secret, and ends with a 4-byte CRC-32 checksum of the share itself. The checksum catches copying mistakes; the inner CRC shows when shares from different secrets were mixed. Shares made by other Shamir tools use other formats and cannot be combined here.