This tool implements Shamir's threshold secret sharing over GF(256): a secret is split into n shares, and any k of them (the threshold) can reconstruct it, while k-1 or fewer reveal nothing about the secret — information-theoretic secrecy.
Two modes:
- Split: paste a secret (any UTF-8 text — a password, API key, seed phrase, recovery phrase), set the threshold
k and total n (2 ≤ k ≤ n ≤ 255), and you get n shares. Distribute each share to a separate holder.
- Combine: paste
k or more shares (one per line) to reconstruct the original secret via Lagrange interpolation at x=0.
How it works. Each byte of the secret is the constant term of a random polynomial of degree k-1 over GF(256). Share i is the polynomial evaluated at x=i. Recovering requires k points to uniquely determine a degree k-1 polynomial. Polynomial coefficients are drawn from crypto.randomBytes() — the OS CSPRNG — never Math.random().
Limitations — please read:
- Confidentiality only, no integrity. Anyone holding a share can submit a forged value during recovery; the math will produce a plausible-but-wrong secret and you won't know. If you need to detect tampering, sign the secret (or its hash) before splitting and verify after combining.
- GF(256) bounds.
n is capped at 255 (the field size), and k must be ≥ 2.
- Share format. Each share is
sss: + base64url of [x-coordinate, y-byte₁, y-byte₂, …]. Keep the whole string intact; truncating breaks recovery.
Use cases. Key escrow / recovery (split a master key across executives), social recovery for self-custodied wallets, distributing a passphrase so no single person holds it, "dead man's switch" secret retrieval.