Shamir Backup Explained
Shamir Secret Sharing is an advanced backup method that splits your wallet recovery data into multiple shares. You need a minimum number of shares to recover — for example, any 3 of 5 shares. This eliminates the single point of failure inherent in standard seed phrase backups.
Table of Contents
What Is Shamir Backup?
Shamir Secret Sharing, invented by cryptographer Adi Shamir in 1979, is a mathematical algorithm that divides a secret into multiple parts called shares. The key property is that you need a minimum number of shares (the threshold) to reconstruct the secret, but any fewer shares reveal absolutely nothing about it. Applied to crypto wallets through the SLIP39 standard, Shamir backup replaces the traditional single seed phrase with multiple recovery shares — each a sequence of 20 or 33 words. You distribute these shares to different locations, and recovery requires combining the threshold number of shares. This means losing one or two shares does not prevent recovery, and stealing one or two shares does not compromise your wallet.
How It Works
When you create a Shamir backup, you choose the total number of shares and the recovery threshold. For a 3-of-5 setup, the wallet generates 5 unique share word sequences, each approximately 20 words long. These shares are mathematically derived using polynomial interpolation over a finite field. Any 3 of these 5 shares, when combined, reconstruct the master secret that derives all your private keys. Having only 1 or 2 shares provides zero mathematical information about the master secret — this is not a limitation of the implementation but a fundamental property of the underlying mathematics. Each share looks like a random sequence of words and is useless on its own. The shares do not overlap or contain partial information — reconstruction is an all-or-nothing process at the threshold level.
Setting Up Shamir Backup
On a Trezor device, select Shamir backup during initial setup. Choose your share count and threshold — 3-of-5 is recommended for most users. The device generates each share sequentially, displaying 20 words at a time for you to write down. Write each share on a separate piece of paper or metal plate, labeling them clearly (Share 1 of 5, etc.). Verify each share when prompted by the device. Then distribute shares to different secure locations: your home safe, a bank safety deposit box, a trusted family member, a secondary property, and a sealed envelope with your attorney. The key principle is geographic distribution — no single disaster should be able to destroy enough shares to prevent recovery.
Advantages and Disadvantages
The primary advantage of Shamir backup is eliminating the single point of failure. A traditional seed phrase stored in one location can be destroyed by fire, stolen by a burglar, or lost in a move. With Shamir, losing any number of shares below the threshold does not affect recoverability. The second advantage is that compromise of fewer shares than the threshold reveals nothing to an attacker. Disadvantages include increased complexity — managing 5 separate physical shares requires more planning than one seed phrase. Fewer wallets support SLIP39 compared to BIP39. Recovery requires gathering threshold shares in one place, which may be logistically difficult in emergencies. The shares are also longer than standard seed phrases, increasing transcription error risk. For most individual users, a standard seed phrase with metal backup in two secure locations provides sufficient protection. Shamir is best for high-value holdings, institutional storage, and estate planning scenarios.
Frequently Asked Questions
Which wallets support Shamir backup?
Trezor Model T and Trezor Safe 3 support Shamir backup through the SLIP39 standard. Keystone also supports Shamir backup. Standard BIP39 wallets like Ledger, MetaMask, and Phantom do not support Shamir — they use traditional single seed phrase backups.
How many shares should I create?
A common configuration is 3-of-5: create 5 shares and require any 3 to recover. This tolerates losing 2 shares while preventing recovery with just 1 or 2 compromised shares. More critical setups might use 3-of-7 or 4-of-7 for additional redundancy.
Can someone reconstruct my wallet with fewer shares than the threshold?
No. This is mathematically impossible with Shamir Secret Sharing. If your threshold is 3, having 2 shares provides zero information about the secret. This is a fundamental property of the algorithm, not just a software limitation.