Shamir's Secret Sharing (Split & Combine)
Splits a text secret (a passphrase, a note) into n shares so that any k of them can rebuild it, while k-1 or fewer reveal nothing about it. It uses Shamir's scheme over GF(256) and the browser's crypto.getRandomValues for randomness. Everything runs in your browser, and your secret and shares are never sent to a server. To protect a secret with a password instead, try the Text Encryptor & Decryptor.
🔒 Runs in your browser · Your data is never sent to a server
How to use
- Choose "Split" as the mode, then enter the secret text, the number of shares n, and the number needed to recover k.
- Click "Split into shares" to get n shares, one per line. Copy them and store each in a separate place or with a different person.
- To recover, choose "Combine" as the mode and paste the collected shares, one per line.
- Click "Recover secret" and, if you have at least k shares, the original text appears.
Notes
- With fewer than k shares the secret cannot be recovered. If you lose shares and fewer than k remain, the secret is gone for good. Keep track of where each share is stored.
- This tool is meant for learning and backups. It has not been audited, so for critical keys or assets use well-reviewed software.
- A share is a hex string whose first 3 bytes are the version, k, and the x coordinate. Shares are not encrypted, so anyone who gathers k of them can read the secret. Store them in different places.
- The secret is handled as UTF-8 text, and a CRC32 is appended before splitting to detect mixed-up shares, so each share is 4 bytes longer than the secret. The format is not compatible with other tools.
- The number of shares is 2 to 255, and k is between 2 and n. Splitting files is not supported.
Glossary
Shamir's Secret Sharing
A scheme that splits a secret into shares so that it can be recovered only when a threshold number of shares are combined. The secret is the constant term of a degree k-1 polynomial, and the shares are points on it.
Threshold (k)
The minimum number of shares needed to recover the secret. With "3-of-5" you make 5 shares and any 3 recover the secret, while 2 reveal nothing.
GF(256)
A finite field with 256 elements, one per byte value. Addition (XOR) and multiplication work on whole bytes, so the secret can be split byte by byte.
FAQ
Can I recover the secret if I lose shares and fewer than k remain?
No. With fewer than k shares nothing about the secret can be learned, so nobody can recover it, including the site. Before splitting, decide where each share will be kept and how many you can afford to lose.
How should I choose n and k, for example 3-of-5?
n is the number of places you can store shares, and k is how many must come together before the secret may be revealed. A larger k resists leaks better but tolerates fewer losses. The difference n - k is how many shares you can lose; with 3-of-5 you can lose 2.
Why do I get "not a valid share"?
The input contains something other than a share (a hex string) made by this tool, or characters were lost or added while copying. Paste one share per line and use the line number in the message to find the culprit. Shares from other tools are not compatible.
When do I see "Could not recover the secret"?
When even one character of a share has changed, or when shares from different secrets are mixed. A checksum stored with the secret is verified on recovery, so a wrong secret is never shown as if it were correct.
Does splitting the same secret give the same shares each time?
No. A new random polynomial is generated for every split, so the shares differ each time. Old and new shares cannot be combined, so discard the old ones after splitting again.
Share this page