Crypto Newbie / Simulators / Multi-Sig Recovery
Multi-Sig / Shamir Secret Sharing Recovery Simulator
A single paper seed backup is one fire / theft / lost note away from disaster. Shamir Secret Sharing solves this: split your seed into N shares, where any M can reconstruct. Lose 1 share → still recoverable. Adversary needs M shares to attack. This simulator computes the actual recovery + attack probabilities for various 2-of-3 / 3-of-5 / custom configurations so you can pick the right tradeoff for your holdings.
Config
Lower M = easier recovery + easier attack. Higher M = harder both.
Share locations
| Description | Reliability (survives lifetime) | Attack probability |
|---|---|---|
Results
Recovery probability
99.07%
Attack success probability
0.33%
Net security score
99
✓ Excellent recovery odds
The math of M-of-N sharing
Shamir mathematically encodes your secret into N points on a polynomial of degree M-1. To reconstruct the polynomial (and thus the secret), you need any M points. Fewer than M shares = ZERO information about the secret (not 'mostly information' — literally zero). This isn't 'XOR-and-pray'; it's a proven mathematical primitive with cryptographic security guarantees.
Why 2-of-3 is the sweet spot for most users
Three shares give you geographic redundancy without operational complexity. Standard setup: 1 home safe, 1 bank deposit box, 1 trusted family member's possession. To lose: fire destroys home + bank + family all simultaneously (extremely unlikely). To be attacked: thief must reach 2 of 3 locations (also unlikely if they're geographically separated). Recovery probability: ~99.5% over lifetime; attack probability: ~0.5%. For holdings under $1M, this is plenty.
When to go higher (3-of-5 and beyond)
For $1M+ holdings, 3-of-5 adds redundancy and forces attackers to compromise more locations. The cost: 5 places to manage instead of 3, slightly higher chance of YOU misplacing shares. For $10M+ holdings, combine Shamir WITH a multi-sig wallet (Safe.global) — your funds are in a multi-sig contract, and each multi-sig key is itself protected by Shamir backup. Defense in depth: attackers must compromise multiple key shares AND social-engineer multi-sig co-signers.
Hardware that supports Shamir
Trezor T (native SLIP-39 support — Trezor's BIP39-compatible Shamir variant). Coldcard with seed splits. Standalone tools: TrustVault, custom scripts using Bitcoin Core. As of 2025: native support is still limited. Most users implement Shamir manually using paper + dice rolls or open-source SSS tools (slip39.dev, etc.). The complexity is real — but for holdings > $100k, the lift is justified.
Frequently asked questions
+Is Shamir more or less secure than a multi-sig wallet?
Different threat models. Shamir protects against SEED LOSS / SEED THEFT (the secret is split across shares). Multi-sig protects against SIGNING KEY COMPROMISE (transactions require multiple signatures). For ultimate security, combine both: each signing key in the multi-sig is itself a Shamir-split seed. The complexity multiplies but so does the security.
+What if a Shamir share gets compromised?
If attacker has < M shares, they have ZERO information about your secret. Throw away the compromised share, regenerate from remaining shares, redistribute new shares. Funds remain safe. Compare to single seed: if your one paper backup is photographed, attacker has 100% of your secret. Shamir's failure mode is much more graceful.
+Can I add or remove shares after generation?
Yes, with the right tooling. You can: (1) Generate additional shares using your original M-of-N split. (2) Re-derive a new split (different N or M) from your existing seed. The second is more complex and requires actually reconstructing the seed temporarily. Better to plan the right N + M from day 1.
+Do online services for Shamir compromise security?
Yes, somewhat. Online tools that generate shares are technically trustworthy if open-source + audited (slip39.dev, ian Coleman's tools), but they require trusting JavaScript running in your browser. For best security: use an offline computer (no internet), open-source tool, generate shares, immediately wipe the offline computer. Most users compromise by using a trusted online tool with a brand-new browser session — pragmatic but not perfect.
+How do I document a Shamir setup for my heirs?
Write clear instructions sealed with the share locations. Include: (1) Which tool to use to reconstruct the secret. (2) How many shares are needed. (3) Physical locations of each share. (4) Contact info for trusted persons holding shares. Many crypto holders use a 'crypto inheritance letter' that gets activated only on death — combined with a Shamir 4-of-5 where 1 share is held by lawyer, 3 by family. See our multi-sig + estate planning learn page for the full template.