# Shamir Secret Sharing

Split a secret into n shares where any k (the threshold) are required to reconstruct it — Shamir's k-of-n scheme over GF(256). Pure in-process cryptography (crypto.randomBytes for polynomial coefficients), no network. Split a password/key/passphrase into shares held by separate people, then combine any k of them to recover it. Confidentiality only — no authenticity.

> Canonical page: https://elysiatools.com/en/tools/shamir-secret-sharing

- **Category:** Security

- **Keywords:** shamir, secret sharing, threshold, k-of-n, split, combine, gf256, lagrange, key escrow, social recovery

## Overview

This tool implements **Shamir's threshold secret sharing** over GF(256): a secret is split into `n` shares, and any `k` of them (the threshold) can reconstruct it, while `k-1` or fewer reveal *nothing* about the secret — information-theoretic secrecy.

**Two modes:**
- **Split**: paste a secret (any UTF-8 text — a password, API key, seed phrase, recovery phrase), set the threshold `k` and total `n` (2 ≤ k ≤ n ≤ 255), and you get `n` shares. Distribute each share to a separate holder.
- **Combine**: paste `k` or more shares (one per line) to reconstruct the original secret via Lagrange interpolation at x=0.

**How it works.** Each byte of the secret is the constant term of a random polynomial of degree `k-1` over GF(256). Share `i` is the polynomial evaluated at `x=i`. Recovering requires `k` points to uniquely determine a degree `k-1` polynomial. Polynomial coefficients are drawn from `crypto.randomBytes()` — the OS CSPRNG — never `Math.random()`.

**Limitations — please read:**
- **Confidentiality only, no integrity.** Anyone holding a share can submit a *forged* value during recovery; the math will produce a plausible-but-wrong secret and you won't know. If you need to detect tampering, sign the secret (or its hash) *before* splitting and verify after combining.
- **GF(256) bounds.** `n` is capped at 255 (the field size), and `k` must be ≥ 2.
- **Share format.** Each share is `sss:` + base64url of `[x-coordinate, y-byte₁, y-byte₂, …]`. Keep the whole string intact; truncating breaks recovery.

**Use cases.** Key escrow / recovery (split a master key across executives), social recovery for self-custodied wallets, distributing a passphrase so no single person holds it, "dead man's switch" secret retrieval.

## Inputs

- **Mode** (select)
- **Secret to split** (textarea): The secret to split (any text: a password, API key, seed phrase). Used in Split mode.
- **Threshold (k)** (number): e.g. 3
- **Total Shares (n)** (number): e.g. 5
- **Shares to combine** (textarea): Paste shares to combine (one per line). At least k shares required. Used in Combine mode.

## When to use

- When you need to distribute a master password or recovery phrase among multiple trusted parties to prevent a single point of failure.
- When setting up a social recovery mechanism for self-custodied cryptocurrency wallets.
- When implementing a key escrow system where a threshold of administrators must cooperate to decrypt sensitive data.

## How it works

- In Split mode, the tool takes your secret and generates a random polynomial of degree k-1 over GF(256) using cryptographically secure random bytes from the OS for the coefficients.
- The secret is encoded as the constant term of the polynomial, and the tool evaluates this polynomial at different points to produce n distinct shares formatted as base64url strings prefixed with 'sss:'.
- In Combine mode, you input at least k of these shares, and the tool performs Lagrange interpolation at x=0 to reconstruct the original secret.

## Use cases

- Splitting a corporate master password among five board members, requiring any three to authorize recovery.
- Securing a cryptocurrency seed phrase by distributing shares across different physical locations or trusted friends.
- Creating a backup for a critical database decryption key that requires multi-administrator consensus to activate.

## Frequently asked questions

### Does this tool send my secret to a server?

No. All cryptographic operations are performed locally in your browser using in-process JavaScript and the OS cryptographically secure pseudorandom number generator.

### What happens if I lose some of the shares?

As long as you have at least the threshold number (k) of shares, you can fully recover the secret. If you have fewer than k shares, the secret cannot be recovered.

### Can I detect if a share has been tampered with?

No. Shamir's scheme provides confidentiality but not integrity. A modified share will result in an incorrect reconstructed secret without throwing an error.

### What is the maximum number of shares I can generate?

The tool operates over GF(256), which limits the maximum number of shares (n) to 255, and the threshold (k) must be at least 2.

### What format do the generated shares use?

Each share is output as a text string starting with the prefix 'sss:' followed by the base64url-encoded coordinates.

## Related tools

- [ML-KEM / Kyber Keypair & Encapsulation Tester](https://elysiatools.com/en/tools/ml-kem-kyber-keypair-and-encapsulation-tester): Generate ML-KEM-512/768/1024 (FIPS 203 / CRYSTALS-Kyber) keypairs, encapsulate a random shared secret against the public key, decapsulate it with the private key, and verify both sides match — with the exact wire sizes of all three parameter sets checked live against the standard.
- [Security Headers Checker](https://elysiatools.com/en/tools/security-headers-checker): Audit HTTP response headers for security compliance — parses the raw headers you paste (no network) and grades them against the OWASP secure-header set with value-level checks: HSTS max-age, CSP unsafe-inline/eval, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP and more. Outputs a letter grade (A+ to F) plus per-header findings with copy-ready fix recommendations.
- [Env File Secret Rotation Planner](https://elysiatools.com/en/tools/env-file-secret-rotation-planner): Paste a .env file and get a staged secret-rotation plan. Detects database URLs, API keys, auth tokens, private keys, cloud credentials, payment keys and encryption secrets, scores each by exposure and age, and schedules them across a 4-week rotation timeline with a dual-key checklist and a generated .env.example. Optional last-rotated dates and a configurable cadence (30/90/180/365 days) drive compliance scoring.
- [RSA Key Pair Generator](https://elysiatools.com/en/tools/rsa-key-generator): Generate an RSA key pair (2048/3072/4096-bit) as PEM-encoded public and private keys. Optionally encrypt the private key with a passphrase. PKCS#8 (recommended) or PKCS#1 private key format. Everything runs locally.
- [URL Safety Checker](https://elysiatools.com/en/tools/url-safety-checker): Detect phishing and fraud signals in a URL by deep structural analysis — punycode/IDN homograph attacks (mixed Latin/Cyrillic), embedded credentials (user:pass@host trick), high-risk TLDs, double-encoding and control-character smuggling, subdomain brand deception, and numeric/IP host obfuscation. Static analysis only, no network. Complements the URL Validator (which does basic protocol/IP checks).
- [AGEX Passphrase Strength Checker](https://elysiatools.com/en/tools/agex-passphrase-strength-checker): Evaluate a passphrase for AGEX file bundles and recommend the most suitable protection profile
- [AGEX Secure Share Note](https://elysiatools.com/en/tools/agex-secure-share-note): Generate a plain-language share note for an AGEX bundle so recipients know how to decrypt and verify it safely
- [Digital Signature Generator](https://elysiatools.com/en/tools/digital-signature-generator): Sign a message with a private key or verify a signature with a public key — supports RSA-PSS (SHA-256), ECDSA (P-256), and Ed25519. Pure client-side crypto (Node crypto.createSign/createVerify), no network. Paste a PEM key to sign or to verify a base64 signature. This tool signs/verifies; it does not generate key pairs.

## Samples

- [Web Image Processing Python Samples](https://elysiatools.com/en/samples/web-image-processing-python): Web Python image processing examples using PIL/Pillow including reading, saving, resizing, and format conversion
- [Android Image Processing Java Samples](https://elysiatools.com/en/samples/android-image-processing-java): Android Java image processing examples including reading/saving images, scaling, and format conversion
- [Android Image Processing Kotlin Samples](https://elysiatools.com/en/samples/android-image-processing-kotlin): Android Kotlin image processing examples including reading/saving images, scaling, and format conversion
- [Web Image Processing Rust Samples](https://elysiatools.com/en/samples/web-image-processing-rust): Web Rust image processing examples including image read/save, scaling, and format conversion