Skip to content
Marvin's Toolbox.

Shamir Secret Splitter

Split a password, recovery phrase or key into shares with Shamir's Secret Sharing, so that any chosen number of them restores it and fewer reveal nothing. Print or copy the shares, and put them back together later.

Runs entirely in your browser. Nothing you put in here gets uploaded.

Shamir secret

Any 3 of the 5 shares restore the secret. 2 or fewer shares reveal nothing about it, not even a single character.

Printed in plain text on every share, so anyone holding one can read it.

Shares

No shares yet

Enter a secret and split it. Each share gets its own card with copy, QR code and download.

Next steps

Send this tool's output straight into another tool.

QR Code Generator

Create a QR code for text, a link, an email, a phone number, an SMS, Wi-Fi access or a contact card. Set the error correction level, size, margin and colors, then download it as PNG or SVG or copy it straight to the clipboard.

mediaimage

Text Case Converter

Convert text into every case at once: title case in the APA, AP, Chicago, MLA, Bluebook, AMA and NYT styles, sentence case, upper, lower, camelCase, snake_case, kebab-case and more.

textconverterdev

Word & Character Counter

Count words, characters, sentences, paragraphs, lines and more as you type, with estimated reading and speaking time.

text

Dedupe Lines

Remove duplicate lines from a list or text, keeping the first occurrence. Optionally ignore case and whitespace, or drop blank lines too.

textdev

Find and Replace

Replace text in two modes: plain find and replace all, or regular expressions with flag controls and capture group references like $1.

textdev

Text Diff

Compare two texts and see every added, removed and changed line highlighted, side by side or inline, with the changed words marked within each line. Ignore case, whitespace or blank lines, read a summary of how much changed, and export the result as a unified diff.

textdev

UUID Decoder

Paste a UUID to see what it carries: version, variant, and for time-based versions the exact timestamp, clock sequence and node. Also shows the raw bytes, the 128-bit integer and the URN form.

devuuid

Base64 Encoder & Decoder

Decode Base64 to text or encode text to Base64. Paste into the top box, read the result below, and flip the direction with one click. Handles Unicode correctly, reads URL-safe Base64, and shows binary payloads as a hex dump you can download.

devconvertertext

Number Base Converter

Convert numbers between binary, octal, decimal, hexadecimal and any base up to 36. Type into any field and the others update as you go. Handles huge integers without losing precision and accepts 0x, 0b and 0o prefixes.

devconvertercalculator

About the Shamir Secret Splitter Tool

This tool splits a secret into shares with Shamir's Secret Sharing and puts it back together later. Pick how many shares to make and how many are needed, say any 3 of 5, and hand them to different people or places. Any 3 restore the secret, while 2 reveal nothing about it, not even a single character. That makes it a good fit for a password manager's master password, a wallet recovery phrase or a private key you can't afford to lose and can't afford to leave in one place.

Plain Shamir has a nasty flaw: wrong or too few shares silently produce garbage. Here every share says which set it belongs to and how many are needed, and the secret travels with a checksum. Combine tells you "2 of 3 shares", spots shares from different sets, duplicates and typos, and only ever shows a secret that passes the checksum.

What you can do

  • Split a password, recovery phrase or private key into 2 to 255 shares
  • Choose how many shares are needed to restore the secret
  • Split binary secrets entered as hex or Base64
  • Copy a share, show it as a QR code or download it as a text file
  • Download all shares as a zip
  • Print shares with recovery instructions, one per page
  • Combine shares by pasting, typing them in or dropping text files
  • Find out how many shares are still missing
  • Detect typos, duplicates and shares from a different set
  • Detect tampered shares with a checksum

How to use the Shamir Secret Splitter

  1. 1On Split, enter the secret. Switch to Hex or Base64 if it is binary.
  2. 2Set how many shares to make and how many are needed. The line below the fields says what that means in plain words.
  3. 3Optionally note what the secret is for. The note is printed in plain text on every share, so keep it vague.
  4. 4Press Split secret, then copy, download or print the shares and give each one to a different person or place.
  5. 5To restore it, open Combine and paste the shares, type them in one by one, or drop their text files. Press Restore secret once enough are in.

How the threshold works

Shamir's scheme draws a random curve through the secret, and each share is one point on that curve. A curve of a given degree is fixed by a known number of points and not one fewer, so the threshold is exact. One share short, every possible secret is equally likely, and no amount of computing power changes that. It is the same reason two points fix a line while one point tells you nothing about where the line goes.

Pick the threshold for both failures you are guarding against. A high threshold protects against shares being stolen, a low one against shares being lost. Some spare shares help: with 3 of 5, two can go missing and the secret survives. Setting the threshold equal to the number of shares means that losing a single one loses the secret for good.

What a share looks like

A share is one line such as SHAMIR1-K3F9QW2M-T3-I2-7Q4V…, which reads format version, set id, threshold, share number and data. The data is Crockford Base32, which has no I, L, O or U, and ends in a short check. Case and spaces don't matter when typing a share back in, and a typo is caught on the line it happens, before anything is combined.

The secret is sealed before it is split. It sits in a small envelope with its format, its length and a truncated SHA-256 checksum, padded to a multiple of 32 bytes. Since the envelope itself is what gets split, too few shares reveal neither the checksum nor the exact length of the secret. Each new split gets a fresh random set id, and shares of different sets never combine.

Keeping shares for years

A backup only helps if someone can use it long after you made it. Every printed share and text file carries the threshold, the set id and step by step instructions, along with enough detail about the format to recover the secret with the open source library alone, should this site ever be gone. Before you rely on a set, test it once on Combine with the minimum number of shares.

Secrets are limited to 8 KB, which covers passwords, recovery phrases and private keys. For anything larger, encrypt it with the File Encryptor & Decryptor and split the password instead. A password of good quality comes from the Password Generator, and the QR Code Generator turns a share into a code with custom settings.

Credits

Open source does the heavy lifting in this tool. Thank you to:

Everything this site builds on is listed on the credits page.

Related tools

Tools that share a tag with this one.

ASN.1 and PKCS#12 Inspector

Decode any DER or PEM data into a browsable ASN.1 tree with named object identifiers and a linked hex view. Open PKCS#12 .p12 and .pfx bundles with their password to list the certificates and keys inside, and export them as PEM.

securitydev

Bcrypt & Argon2 Generator

Hash a password with bcrypt or Argon2 and verify a password against an existing hash. Tune the cost factor, memory, iterations and parallelism, see how long the hash takes, and read the parsed parts of any hash you paste.

securitydev

Checksum Validator

Verify a file against its checksum. Drop the file and paste the expected hash or a sha256sum line, and the hash type is detected for you, from MD5 to BLAKE3.

devsecurity

CSP Builder

Build a Content-Security-Policy header directive by directive, or paste an existing policy to check it. Weak spots like unsafe-inline, wildcards and missing directives are flagged with what to do instead.

securitydev

CSR Generator

Create a certificate signing request with a fresh RSA or ECDSA key or your own. Fill in the subject and subject alternative names, then download the CSR and private key as PEM, with the matching openssl command alongside.

securitydev

Email Header Analyzer

Paste raw email headers to trace the Received chain hop by hop with per-hop delays, read the SPF, DKIM and DMARC results, and see every header explained. Helps you spot spoofing and find where a slow email got stuck.

devsecurity