What is a Shamir backup, and how is it different from a seed phrase?
SLIP-39 splits a wallet's secret into shares so that no single paper reveals it and losing one is not fatal. How thresholds work, and the compatibility catch.
Published 3 min read
In short
A Shamir backup under SLIP-39 splits a wallet's master secret into several shares of 20 or 33 words. A set number of them, the threshold, rebuilds the secret; fewer reveal nothing useful. Shares can also be organised in groups, up to 16 groups of up to 16 members.
SLIP-39 is not compatible with BIP39: a Shamir share cannot be restored in a wallet that only understands ordinary seed phrases, and existing SLIP-39 shares cannot be converted back. Each share ends with checksum words that detect any error affecting up to three words.
An ordinary seed phrase has two weaknesses that pull in opposite directions. If you keep one copy, losing it loses the wallet. If you keep several copies, each one is a complete key that someone could find. Shamir’s secret sharing, standardised for wallets as SLIP-39, removes that trade-off.
How does it work?
The wallet’s master secret is split into shares, with a threshold chosen at setup. In a 2-of-3 scheme, any two shares rebuild the secret, and a single share on its own is useless. The share words come from their own list of exactly 1024 words, so each word carries 10 bits.
| BIP39 seed phrase | SLIP-39 Shamir share | |
|---|---|---|
| Words | 12, 15, 18, 21 or 24 | 20 (128-bit secret) or 33 (256-bit secret) per share |
| Word list | 2048 words | 1024 words |
| One copy reveals the wallet? | Yes | No, if the threshold is above 1 |
| Losing one copy loses the wallet? | Yes, if it is the only one | No, if enough other shares survive |
| Error detection | Short checksum in the last word | Three checksum words detect any error affecting up to three words |
| Passphrase | Optional | Optional, printable ASCII only |
What are groups?
SLIP-39 allows a two-level scheme. The secret is first split into group shares with a group threshold; each group share is then split among members with its own member threshold. A family could, for example, require any two of three groups, with “family” needing two of three relatives, “lawyer” needing one share, and “safe deposit” needing one share. The standard allows up to 16 groups and up to 16 members per group.
What is the compatibility catch?
The SLIP-39 specification says plainly that it is not compatible with BIP39. A wallet that only reads ordinary seed phrases cannot restore from Shamir shares. Converting an existing BIP39 phrase into SLIP-39 is possible only by producing 59-word shares, and turning SLIP-39 shares back into a BIP39 phrase is not possible. The choice has to be made when the wallet is created, and the recovery plan must name software that supports it.
What about the passphrase?
SLIP-39 encrypts the master secret with an optional passphrase before splitting it. As with BIP39, the specification notes there is no way to check that the right passphrase was used, so a wrong one silently produces a different secret. The passphrase has to be backed up and tested like any other part of the backup.
How do you test a Shamir backup?
Recover from exactly the threshold number of shares, and use a different combination on each test, so every share is proven to work at least once. The steps are the same as for a seed phrase; see how to test a seed phrase backup. The specification also warns against wallets that automatically “correct” errors in shares, because a corrected mistake could silently produce a different, valid secret.