// shamir secret sharing ·

No single piece is the key.

// live demo

Split it. Shatter it. Put it back.

Real Shamir secret sharing over GF(256), implemented in pure JavaScript, with randomness from crypto.getRandomValues. Nothing leaves this tab.

Demo secrets only

Never paste a real wallet seed phrase, private key or keypair file here. This is an unaudited teaching page: its shards sit in your browser tab in plain text and the page itself could be tampered with. The splitter refuses inputs that look like seed phrases or keys, but it cannot catch everything. Use only made-up values.

Choose a demo secret

Type a short made-up value, or generate a random one. Max 64 bytes.

Demo secret (text)

Pick N shards and threshold K

N: total shards 5

K: needed to rebuild 3

The shards

Press "Split into shards" above. Then click shards below to select them for reconstruction.

Reconstruct from your selection

Select any K shards: the exact secret returns. Select fewer than K: you get unrelated garbage, and the grid below shows every possible secret byte is still equally consistent with what you hold.

Or paste shards (one per line, optional)

// how it works

A polynomial hides the secret in plain sight.

For each secret byte, Shardsafe picks a random polynomial of degree K−1 whose constant term is that byte. Shard i is the polynomial evaluated at x = i. K points pin the polynomial down uniquely, so interpolating at x = 0 recovers the secret. With only K−1 points, every possible secret is equally consistent.

f(x) = s + a₁x + a₂x² + … + a_K-1x^K-1 (arithmetic in GF(2⁸), reduction poly 0x11B)
shard_i = ( i , f(i) ) secret = f(0) = Σ y_i · Π_j≠i x_j / (x_i ⊕ x_j)

Hidden

The secret, from anyone holding fewer than K shards (information-theoretic, not just hard to crack)
Which byte values are likelier than others

Not hidden

The secret's length (one shard byte per secret byte)
Each shard's position x and the threshold K (in this demo's share format)
Everything, once any K shards meet in one place

Split custody

Hold shards on different devices, with different people, in different places. Losing up to N−K of them does not lose the secret.

No trusted dealer after

The splitting step briefly holds the whole secret. A real design splits on an offline, trusted device (or uses distributed key generation so no one ever holds it whole).

About Solana

This sharing math works on any bytes. A Solana build would split an ed25519 seed this way, ideally without it ever touching a networked browser. Web Crypto here is only used for randomness.

Known limitations — please read

Demo values only. Never split a real wallet seed phrase or private key on this page. Doing so exposes it in this tab's memory and on screen.
Reduces single points of failure, not risk to zero. Shamir sharing lowers linkability of the secret to any one holder. It does not make you anonymous and does not protect against K colluding or compromised holders.
No integrity checks. Shards carry no signature or checksum. A wrong or corrupted shard silently yields the wrong secret. Production schemes add verifiable sharing and per-shard authentication.
The dealer sees everything. Whoever runs the split (this page, here) sees the full secret and all shards.
Not audited. Unreviewed code, no deployed program, no token. The $SHARD ticker is a placeholder.
Demo, not mainnet. Nothing here touches Solana mainnet or real funds.
"Matches original" in step 4 exists only because this demo remembers the secret. A real recovery tool would not, and the shards alone cannot tell you whether a reconstruction is right.