102 · Wallet configuration · lesson 3 of 4
Beyond the ladder — two refinements that aren’t rungs
The ladder is about how many keys sign. These two are about something else entirely: how your backups are shaped. Neither adds a signer, so neither is a rung — you can bolt either onto any rung, or skip both and lose nothing important.
Nothing here is required to hold Bitcoin safely, and most holders never use either. It’s here because you will hear both names, and it’s better to know what they are — and why you probably don’t need them — than to wonder.
BIP-85 — one master seed, many child seeds
The problem it solves: backups multiply. A wallet here, a passphrase wallet there, a multisig key somewhere else — and each one is another set of words to write down, store, and keep track of for decades.
BIP-85 sits beside the ladder rather than on it: it derives many child seeds from one master, cutting how many backups you keep. Useful at any rung — but it concentrates failure on that one master, which must then be protected at the level of everything derived from it.
In practice: you keep one master seed backed up properly, and derive every other wallet you need from it, on demand, by index — child number 1, child number 2, and so on. The children are ordinary seed phrases; nothing about them looks unusual, and they work in any wallet.
You have concentrated everything onto one seed. That master now deserves the care you would otherwise have spread across all of them — because it is no longer a backup, it is every backup. And you must remember which child index was which, which is a new note to keep, though not a secret one.
See it work: watch one master spawn child seeds → — verified against the BIP-85 spec test vectors, on throwaway keys.
Shamir backup (SLIP-39) — one backup, split into shares
The problem it solves: a single seed backup has to be in one place, and that place can burn down, flood, or be found.
This isn’t a signing configuration like the rungs — it’s a backup method, which is why it sits beside the ladder rather than on it. Instead of one or two complete seed backups, a single seed is mathematically split into several shares — for example, five shares where any three can rebuild the seed, but two or fewer reveal nothing at all. You distribute the shares across locations or trusted people.
What it’s good at
- A single found share is useless. Someone who discovers one share (below the threshold) learns nothing about your seed.
- Redundancy without full copies. In a 3-of-5 split you can lose two shares entirely and still recover.
- Looks like a normal wallet on-chain. Unlike multisig, blockchain observers can’t see that it’s a split arrangement — a small privacy edge.
What it costs you
- More parts to track. Several shares, each of which must stay secure for years or decades.
- Best for savings, not spending. It’s a backup scheme for a seed you rarely touch, not a convenient day-to-day wallet.
- Uneven device support. Trezor supports SLIP-39 natively; other devices vary.
To recover, the shares must be combined on one device to rebuild the whole seed. At that instant, that device holds everything. If it’s compromised, or the process is watched, the entire point of splitting is undone. This is exactly why Casa and Lopp often prefer multisig — where the keys never have to meet — over Shamir for actively-used funds.
Who should use it
Holders who want their backups geographically distributed but don’t want the operational complexity of multisig, and whose main use is long-term cold storage rather than frequent spending. Shamir-split backup paired with an on-device passphrase is a reasonable option between plain single-sig and full multisig.
Try it here — the same demo that lives on its own page
The secret below is randomly generated in your browser and thrown away when you leave. Never split or enter your real seed on any website. Real SLIP-39 backups are created offline on your signing device.
Generate a throwaway secret and split it into a 3-of-5 backup.
Runs entirely in your browser · nothing is sent, saved, or logged.
It's split into 5 shares. Tap the ones you hold — you need any 3 to rebuild it:
No single share is a target — steal one, or two, and you get nothing (not "most of it" — nothing). Yet you can lose two shares entirely and still recover. Spread them across locations or trusted people and no one place is a single point of failure, for loss or theft.
They pull in opposite directions. BIP-85 gives you fewer things to protect and concentrates the risk; Shamir gives you more things to protect and spreads it. If keeping track of several backups is what worries you, BIP-85 is the one to look at. If one backup sitting in one place is what worries you, Shamir is — though a later lesson’s advice applies first (Backing up a seed phrase, in 103 · Private key creation): two ordinary copies in two separate places solves that same problem with no new machinery at all, and for most holders that is the better answer.
✓ Last verified: August 5, 2026