Free tool

Split a secret into parts

A seed phrase is a contradiction: one copy gets lost, many copies each add risk. This page cuts a secret into several parts so that any required K of them put it back together, while fewer say nothing about it. Three parts with three people you trust, any two restore it — and none of them alone can do anything.

Everything is computed in the browser: neither the secret nor the parts go anywhere.

Neither the secret nor the parts go anywhere: all the mathematics is computed in this tab.

How it works

Shamir’s scheme. Each byte of the secret is hidden in a polynomial: the constant term equals the byte itself, the other coefficients are random, and the degree is one less than the threshold. Part number x — is the value of the polynomial at the point x. Through any K points there passes exactly one polynomial of the required degree, so K parts give the original byte unambiguously. Through K−1 points there pass infinitely many such polynomials, and every constant term is equally likely — which is why fewer parts say nothing at all.

Everything is computed in the field GF(256) — the same one inside AES. Bytes stay bytes, the parts come out short, and writing them on paper is realistic.

How to use this sensibly

The most workable arrangement for keeping things at home is three parts with a threshold of two. One with you, one with a relative, one in a safe deposit box or with a second person you trust. Lose yours and you restore it from the remaining two. Have one stolen and the thief has nothing, not even a hint.

What not to do: keep two parts in one place (that is the same as keeping a single copy), and set the threshold equal to the number of parts (then losing any part is losing the secret).

Nearby: a seed phrase checker, encrypt a file with a password and encrypt text.

We store none of this

No secrets, no parts, no passwords — just as there are no visit logs in the VPN itself. There is nothing to hand over on request.

How it works →

FAQ

guest@404vpn:~$ cat secret-split-faq.md
[01] $ Why is this better than simply cutting the phrase into three pieces?
> Because a piece of an ordinary phrase is already part of the answer: with eight words out of twelve, the rest get brute-forced. Here each part on its own says nothing about the secret: until the required number of parts is gathered, you cannot even know the length of the original text with any certainty. That is a mathematical property of the scheme, not a promise.
[02] $ How many parts should I make and how many should I require?
> For keeping things at home people usually take three parts with a threshold of two: one gets lost and you can still restore it, one gets stolen and the thief gets nothing. A threshold equal to the number of parts (three of three) is dangerous: losing any one part means losing the secret for ever.
[03] $ Where should the parts be kept?
> Separately and in different places — that is the whole point. Two parts in one safe are no better than a single copy. Parts can be written on paper: they are short and made of ordinary letters and digits.
[04] $ What if a part is damaged or belongs to a different secret?
> We notice. Before splitting, two bytes of the secret’s hash are appended, and on assembly they are checked. If the parts are not from one secret, or one of them is spoiled, the page says so instead of handing back plausible rubbish.
[05] $ Can you see my secret?
> No. The page makes not a single network request while splitting or assembling — all the mathematics happens in your tab. You can see that in the Network tab of the developer tools.