What this is
Instead of one or two complete seed backups, the seed is mathematically split into several shares — for example, five shares where any three can rebuild the seed, but two or fewer reveal nothing at all. You distribute the shares across locations or trusted people.
What it’s good at
- A single found share is useless. Someone who discovers one share (below the threshold) learns nothing about your seed.
- Redundancy without full copies. In a 3-of-5 split you can lose two shares entirely and still recover.
- Looks like a normal wallet on-chain. Unlike multisig, blockchain observers can’t see that it’s a split arrangement — a small privacy edge.
What it costs you
- More parts to track. Several shares, each of which must stay secure for years or decades.
- Best for savings, not spending. It’s a backup scheme for a seed you rarely touch, not a convenient day-to-day wallet.
- Uneven device support. Trezor supports SLIP-39 natively; other devices vary.
The recovery moment is a single point of failure To recover, the shares must be combined on one device to rebuild the whole seed. At that instant, that device holds everything. If it’s compromised, or the process is watched, the entire point of splitting is undone. This is exactly why Casa and Lopp often prefer multisig — where the keys never have to meet — over Shamir for actively-used funds.
Who should use it
Holders who want their backups geographically distributed but don’t want the operational complexity of multisig, and whose main use is long-term cold storage rather than frequent spending. Shamir-split backup paired with an on-device passphrase is a reasonable middle tier between plain single-sig and full multisig.
Planning for inheritance
Shamir can help inheritance — hand shares to trusted parties with instructions — but it’s fragile if your heirs aren’t coordinated: a share treated as junk, a family fall-out, or a share that ends up in a phone photo can break it. For most people a documented plan (or a collaborative partner, rung 5) is more robust than heirs holding shares.
When to climb
If you find yourself wanting the keys to never have to come together in one place — the weakness above — that’s the case for multisig (rung 4), which solves the same distribution problem without a risky reassembly step.