Splitting your seed with Shamir (SLIP-39): how it works

You have a 24-word recovery phrase and an idea: I’ll cut the sheet into three parts, hide each one somewhere else, and nobody can rebuild anything alone. It sounds sensible. The problem is that this turns one point of failure into three, and it adds less protection than it seems to. There’s a standard that splits a phrase properly. It’s called SLIP-39 and it’s built on Shamir’s scheme.

This guide explains why cutting by hand doesn’t work, how splitting into shares works, which devices support it and what you need to tell your family. If you’re choosing hardware, start with the pillar on the hardware wallet.

Why cutting 24 words by hand is a bad idea

Take a recovery phrase in the BIP-39 standard, 24 words. You split it into three parts of eight words. What follows?

1. Every part is essential. Lose one and you can’t rebuild the wallet, even though the other two are safe. Instead of one card to look after you have three, so the risk of loss goes up.
2. Every part gives away something about the whole. Eight words are a slice of information that someone can use if they get hold of a second one. A thief with 16 words still has eight to guess, which is about 88 bits out of the 256 bits of the whole phrase (a rough calculation). That’s still a big number, but the safety margin is clearly smaller than with an intact phrase.
3. No standard. Only you know your own scheme. Your family, a notary and anyone who opens the drawer in ten years have to guess the order and the convention used to write the parts down.
4. No check. No device will tell you the parts are complete and written correctly. The error shows up when it’s too late.

If you want to survive losing one piece, you need a threshold scheme, where any K of N shares are enough. Cutting has no such property.

How SLIP-39 works

SLIP-39 is a standard published by SatoshiLabs. According to the specification, it splits the wallet’s master secret into shares so that a set number of shares is needed to rebuild it, and fewer shares “reveal nothing about the secret”. Shares are written as words from a separate list of 1,024 English words. For a 128-bit key a share has 20 words, for a 256-bit key 33 words, the last three of which are a checksum.

The specification allows two levels of thresholds: first you split the secret into groups (up to 16), then each group into members (up to 16 per group). In practice most devices offer a simpler variant: one group, several shares, one threshold.

Trezor describes it like this: you choose the total number of shares and the threshold, for example 2 of 3, and any two shares are enough to restore the wallet. Losing one share in a 2-of-3 setup breaks nothing. Losing more than the threshold allows means permanent loss of funds.

A 2-of-3 scheme: a worked example

Kasia keeps her bitcoin on a Trezor. She picks a multi-share backup, 2 of 3, and gets three cards with shares. She places them like this:

• share A in a safe at home,
• share B with her brother in another city,
• share C in a notarial deposit or at a bank.

A house fire destroys share A, but B and C are enough. A burglar who finds A has nothing useful, because one share isn’t enough. If Kasia were gone, her family would need to know that there are three shares, that two are enough and where they are. Without that, the setup is only a puzzle.

With 2 of 3, remember that two shares in one pair of hands are enough. Don’t give two shares to one person or keep them in one place, because then you turn the setup back into a plain phrase.

What splitting into shares looks like in practice

We describe the order of actions, not the screens of a particular device, because those change with firmware.

1. Decide on the scheme before you write anything down. The number of shares and the threshold are fixed: Trezor notes that you can’t change a backup’s configuration, you have to create a new one. For most people 2 of 3 is enough. More shares means more places to look after.
2. Create a multi-share backup in the manufacturer’s app. According to Trezor, you can do this after setting up the wallet too, and extending from a single-share backup is done in Trezor Suite.
3. Write each share on a separate card, in pen, legibly, and label it at once without using words: the share number and the wallet name. Check every word twice.
4. Distribute the shares before you go back to your day. Cards left “for now” on a desk stay there for years.
5. Run a recovery test from two shares (with a threshold of 2) after depositing a token amount. Only then move the rest of your funds.
6. Destroy the old single-share backup, or keep it on purpose. Left in a drawer, it still gives full access.

Which devices support Shamir

From what’s on Trezor’s sites (checked on 19 October 2026): multi-share backups are supported by Trezor Safe 7, Safe 5, Safe 3 and Model T. Firmware 2.7.2 or newer is required, and older firmware can’t restore a multi-share backup. For Safe 3, Safe 5 and Safe 7 the default format is single-share SLIP-39 (for Safe 3 from June 2024), and you add the multi-share backup as an optional extension. For Safe 3 units from before June 2024, Trezor’s FAQ states that their older SLIP-39 backups can’t be extended to multi-share.

The manufacturer’s site also carries a few warnings we repeat, because they bear directly on inheritance:

• A single-share SLIP-39 backup gives full control of the funds, so the risk is similar to a plain phrase.
• After you extend to a multi-share backup, the original single-share backup stays valid until you destroy it. If you forget, a card with 20 words still opens the wallet.
• You can’t change a backup’s configuration, you have to create a new one.
• Trezor doesn’t recommend converting a BIP-39 wallet to SLIP-39. You also can’t convert SLIP-39 back to BIP-39.

Other manufacturers: we haven’t checked whether their devices support SLIP-39. Trezor’s site lists several programs that can import shares: Electrum, Rabby, Sparrow, BlueWallet and Wasabi, plus the Keystone hardware wallet. That matters if a device is no longer available years from now. The standard is open, but it isn’t as widespread as BIP-39.

Shamir versus multisig

Both solutions protect against losing one element and both use a “2 of 3” threshold, so they’re easy to confuse. They’re different constructions, though. Trezor puts the difference briefly: SLIP-39 is one key split into shares, while multisig is several keys, each of which signs the transaction.

Feature	Shamir (SLIP-39)	2-of-3 multisig
What gets split	One master key into shares	There are three separate keys
What you need to recover	A threshold of shares (e.g. 2 of 3)	Two of the three keys
Where the key exists	The shares come together in one device, which rebuilds the key	The key is never assembled anywhere, each signature is made separately
What shows on the network	A normal address, as with a single key	A multisig address; when funds are spent, several keys are visible
Extra software needed	A device that supports SLIP-39 is enough	A coordinating app, e.g. Sparrow or Nunchuk
Additional backup	The shares alone	The phrases of three wallets and a wallet description file (xpub)
Complexity for your family	Medium: they need to know where the shares are	Higher: they need to know how the wallet was built

Two conclusions. Shamir is simpler, but at the moment of recovery the shares come together in one place. Multisig takes more work to set up, but no single key or single device is enough to spend the funds. For bitcoin of high value, that protection is often worth the trouble. When that’s the case and how to build it, we explain in the guide 2-of-3 multisig wallet: who is it for. The glossary entry on multisig covers the basics, and the entry on SLIP-39 and Shamir the short rules.

Traps when it comes to inheritance

Shamir protects against loss and theft. With inheritance it creates new problems, and it’s worth thinking about them before your family stands in front of the drawer.

1. Nobody knows the threshold. Your family finds two cards and doesn’t know whether they need two or three. Write the scheme in words: “three shares, two are enough to recover”.
2. Shares sit in places only the owner knows about. Your brother doesn’t know he’s keeping an envelope for you. The deposit has no named person to collect it.
3. The old single-share backup is still around. After moving to a multi-share backup, the old card with 20 words still opens the wallet. Destroy it or know where it is.
4. Shares get mixed up. Cards from different wallets don’t have obvious numbers. Label them (without words in the label): “wallet 1, share A”.
5. Mixing with a passphrase. If the wallet also has an extra password, the shares alone aren’t enough. Trezor warns outright that funds protected by a passphrase can’t be recovered without it, and recommends keeping it apart from the backup and the device.
6. No device or program. In a few years a specific model may no longer be available. Write down which standard (SLIP-39) was used, so someone can pick a matching tool.
7. Nobody tested it. Recovery from shares gets tested before the first deposit and then every year, not for the first time in mourning.

In the instructions for your family, write the scheme, the locations of the shares, the name of the standard and the person who has the notary’s contact. Don’t write the words themselves in the instructions. How to build such instructions, we explain in the guide access instructions for your family: what they contain. For storage places that survive fire, water and forgetting, see seed phrase: how to store it.

Is Shamir for you

Shamir makes sense when you keep the phrase in several places and worry that one will vanish or be exposed, but you don’t want to build a multisig wallet. It makes no sense if you have nobody to trust with the shares, or if the setup would be too complicated for your family. In that case, a good, tested backup of a single phrase in two safe places is better.

If you’d like us to choose a scheme for your situation, go through it with you and run a recovery test, we describe it on the setup page. We don’t see your seed or any shares, you enter them yourself.

Accurate as of 19 October 2026. The device information comes from the manufacturer’s sites and may change with new firmware versions.