Split a secret into several shares so that any K of N can reconstruct it, but fewer reveal nothing. Useful for backup keys, recovery phrases, and shared custody. All math runs in your browser over GF(256) — the secret is never uploaded.
{{base64DecodeError}}
{{ secretFileBytes ? (secretFileBytes.length + ' bytes loaded') : 'Click or drop any file — an SSH key, a small document, random key material.' }}
{{splitErr}}
Any {{k}} of these {{n}} shares recovers the secret. Distribute them separately.Each share below is also passphrase-encrypted — keep that passphrase separate from the shares too.
Click or drop — or paste share text below.
Recovered {{restored.bytes.length}} bytes of binary data — not valid UTF-8 text, so it's shown as a file rather than a string.
{{restoreErr}}
Each byte of the secret becomes the constant term of a random polynomial of degree K−1 over the finite field GF(256). Every share is that polynomial evaluated at a distinct point x.
Given any K points you can reconstruct the polynomial by Lagrange interpolation and read off the constant term — the original byte. With only K−1 points, every possible secret remains equally likely, so fewer shares reveal nothing.
Each Base64 share includes its threshold, a random set identifier and an integrity check alongside x and the polynomial values. Recovery rejects mixed share sets, too few shares and corrupted data instead of displaying garbage as a secret.
All splitting and recovery happen locally with a cryptographically secure RNG. Nothing you enter is transmitted, logged, or stored. Splitting alone does not encrypt — protect each share as you would the secret itself. Optionally, each share can also be wrapped in its own AES-256-GCM passphrase encryption (PBKDF2-derived key, random salt/IV per share) before export; that passphrase is a separate secret from the K-of-N scheme itself, is never stored anywhere, and must reach recipients through a different channel than the shares.
