Shamir's Secret Sharing (k-of-n) & BIP-39 Vault Splitter (2026)

Published by Adi Shamir in 1979, the scheme relies on the theorem that it takes k points to uniquely define a polynomial of degree k−1. The secret byte S is placed as the y-intercept a_0 = f(0), and k−1 random coefficients are drawn from a CSPRNG. With only k−1 points, every possible byte value in GF(256) corresponds to an equally valid degree-(k−1) polynomial—meaning an attacker with unlimited computing power learns 0 bits about the secret.

If you split a 24-word seed into three 16-word overlapping cards (Words 1–16, Words 9–24, Words 1–8 + 17–24), anyone who steals a single card immediately knows 16 of your 24 words (176 bits of entropy), reducing the remaining 8 words to only 88 bits—and if it were a 12-word seed, knowing 8 words leaves only 44 bits, which GPU clusters can brute-force in hours. Shamir's Secret Sharing reveals 0 bits until the exact threshold k is met.

In standard integer arithmetic, polynomial values grow larger as x increases, leaking statistical bounds on the coefficients and expanding share byte lengths. In the finite field GF(2^8) (modulo the irreducible polynomial x^8 + x^4 + x^3 + x + 1, hex 0x11B), addition is bitwise XOR and every share has the exact same byte length as the original secret with uniform distribution.

Shamir's Secret Sharing (and Trezor's SLIP-0039 standard) splits a single master secret at rest; during signing, k shares must be brought together to reconstruct the key. On-chain Multisig (or MPC/Frost) uses independent private keys that sign transactions separately without ever combining into a single private key in memory.

All GF(2^8) log/exp table generation, CSPRNG polynomial sampling, and Lagrange interpolation run 100% locally in your browser. You can switch your device to Airplane Mode before entering any real secret.