Shamir Backup (SLIP-39) — Splitting Your Recovery Phrase

Shamir Backup (SLIP-39) is a method for splitting a single recovery phrase into multiple "shares" so that only a subset is needed to restore your private keys. This is useful when you want redundancy without creating copies of the same seed phrase. In my testing, SLIP-39 reduces single-point-of-failure risk — but it also adds operational complexity.

What is Shamir Backup (SLIP-39)?

Shamir Backup implements Shamir's Secret Sharing (a cryptographic scheme) as a mnemonic-based backup format called SLIP-39. Instead of one 12- or 24-word seed phrase that must be kept intact, SLIP-39 creates multiple mnemonic shares. You pick a threshold (for example, 3 of 5), and any 3 shares can reconstruct the original secret. Less than the threshold reveals nothing.

Think of your seed phrase like the master key to a safe deposit box. SLIP-39 lets you split that master key into pieces and hand them to trustees. Short sentence. Longer explanation follows to make the trade-offs clear.

How Shamir secret sharing works (plain language)

At a high level: a cryptographic secret (your master key) is combined with random math to produce N distinct shares. Each share looks like a recovery phrase, and you specify a threshold M so that any M of those N shares can be used to reconstruct the secret. You must meet that threshold; missing shares beyond that threshold don't help.

Why is this safer than duplicates? Because a single stolen share doesn't expose funds. But you have more moving parts. (That's the trade-off.)

Why use SLIP-39? Benefits and trade-offs

Pros:

No single copy of the full recovery phrase. More resilience against theft and accidental loss.
Flexible redundancy: design trade-offs between availability and secrecy (pick your M and N).
Shares are human-readable mnemonics, so recovery doesn't rely on specialized hardware alone.

Cons:

Operational complexity: planning who holds shares and how they’re retrieved matters.
Compatibility: not every wallet or recovery tool supports SLIP-39 shares.
Mistakes in distribution (storing multiple shares together) eliminate the security benefit.

Quick comparison: SLIP-39 vs standard single seed (BIP-39)

Feature	Standard seed (single 12/24 words)	Shamir Backup (SLIP-39)
Single-point risk	High	Lower if distributed correctly
Ease of use	Simple	More complex (setup & recovery)
Compatibility	Broad	Limited to supporting tools
Redundancy options	Copying (risky)	Threshold-based (flexible)

Step by step: Split your recovery phrase (Shamir backup how to)

This section gives a practical, device-agnostic workflow. Exact menu names differ by hardware wallet model; follow on-screen prompts.

Before you start

Update and verify firmware. Always do this before creating backups (see the firmware verification guide).
Install the companion app on a trusted computer if needed (see companion app install).
Gather durable recording supplies: a metal plate or high-quality paper and inks. (See metal backup plates for options.)

And yes, that extra time spent preparing pays off later.

Create the shares

On your hardware wallet, choose the backup option that mentions Shamir or SLIP-39.
Select how many shares (N) you want and the threshold (M) required to recover. Example: 3-of-5.
The device will generate N unique mnemonic shares. Write each share down immediately and verify as the device requests.
If the device offers a passphrase (an extra secret applied to the seed), decide whether to use it (see passphrase risks).

After creation: store and distribute shares

Record each share on a metal plate or multiple paper copies. Link to the metal backup guide.
Distribute shares across physically separated, trusted locations (e.g., safe deposit box, trusted family member, attorney).
Never store more than the threshold M together. Never photograph shares and upload to cloud storage.

But don't overcomplicate your plan. If a recovery requires months of paperwork or multiple calls, you may lock yourself out.

Recover from shares: Step-by-step recovery (recover from shares)

If you need to recover:

Start recovery on the device or compatible tool and select SLIP-39 restore.
Enter the required M shares in any order. The system will reconstruct the master secret and restore the associated accounts.
If you used a passphrase at creation, enter the exact same passphrase during recovery.
After successful recovery, verify account balances and receive addresses (small test transactions are useful).

If recovery fails, consult our restore troubleshooting guide and double-check passphrase spelling and share integrity.

Backup shares distribution: Best practices

How many shares and where to put them? That depends on the threat model.

Examples (not prescriptions):

Small-family model: 2-of-3 — spouse, personal safe, bank safe deposit.
Redundancy-focused: 3-of-5 — spread across three cities (reduces regional risk).
Institutional: 5-of-7 — escrowed pieces with legal agreements and clear retrieval procedures.

Table: Example distribution strategies

Scenario	Example distribution
Family backup	2-of-3: spouse + home safe + bank box
Geographic resilience	3-of-5 across three states or countries
Legal/inheritance	3-of-5 with an attorney + executor rules

Questions? Who gets custody matters as much as technical setup. How will heirs access shares? Think ahead.

Security considerations and common mistakes

Compatibility: SLIP-39 shares are not universally supported. Confirm third-party tool compatibility before relying on it (see third-party compatibility).
Supply chain and firmware: verify firmware before using the device for backup (see firmware verification).
Connectivity risks: use air-gapped signing where possible. Bluetooth or USB exposures are separate risks while transacting (see air-gapped signing).
Common mistakes: storing multiple shares together, giving shares to unreliable custodians, misplacing the passphrase.

But human error is the biggest risk. Simplicity wins when you and your trusted contacts can actually follow the recovery plan.

Who should use SLIP-39 — and who should look elsewhere

Who SLIP-39 is good for:

Users with significant balances who want redundancy without exact copies.
Families, corporate treasuries, and estates that can implement a distribution plan.

Who should look elsewhere:

Beginners who prefer a single, well-protected 24-word seed and a simple process.
People who can’t guarantee distributed custody or who need broad compatibility with third-party tools.

In my experience, SLIP-39 shines when planning for long-term custody and inheritance. But for day-to-day users, the added complexity may not be worth it.

FAQ

Q: Can I recover my crypto if the device breaks?

A: Yes. As long as you can supply the threshold number of SLIP-39 shares (and any passphrase used), you can recover on a new compatible device or tool. See restore guide.

Q: Is SLIP-39 compatible with all wallets?

A: No. Compatibility varies. Always verify before committing to SLIP-39 (see third-party compatibility).

Q: How should I store shares physically?

A: Durable, offline storage is best. Metal plates resist fire and water. See metal backup options.

Q: Can I use a passphrase with SLIP-39?

A: Yes, but that adds another secret you must manage. If you lose the passphrase, recovery will fail. Read about passphrase risks.

Conclusion & next steps

Shamir Backup (SLIP-39) is a powerful option when you need flexible redundancy and reduced single-point risk for long-term, non-custodial storage. The trade-off is operational overhead and compatibility limits. I believe it's worth considering for larger balances or estate planning, provided you document the plan and test recovery.

Next steps: verify your device firmware before creating shares (firmware guide), and review durable storage options (metal backup plates). Want to compare multisig alternatives? See multisig setup guide.