Introduction
Splitting a secret across multiple people so that no single person holds the full key is the core idea behind Shamir's Secret Sharing. Adi Shamir published the scheme in 1979 in his paper "How to Share a Secret" (Communications of the ACM, vol. 22, pp. 612-613). The math is elegant: a polynomial of degree k-1 is uniquely determined by k points, so any k shares reconstruct the secret, but k-1 shares reveal nothing. This tool implements the scheme in GF(256), the Galois field with 256 elements, which maps cleanly to byte-level operations. Everything runs in your browser. No secret or share data is transmitted anywhere.
What this tool does
- Split a UTF-8 text or hex-encoded secret into n shares with a threshold of k
- Generate shares as hex strings, each prefixed with a 1-byte index (1 through n)
- Reconstruct the original secret from any k or more valid shares
- Support thresholds from 2 to 255 and total shares from 2 to 255
- Accept hex-formatted shares for reconstruction, with automatic index parsing
- Display the reconstructed secret as both UTF-8 text and hex bytes
- Copy individual shares or the full share list to your clipboard
How this tool works
The Split tab takes a secret (text or hex), a threshold k, and a total count n. It encodes the secret as UTF-8 bytes, then for each byte position, generates a random polynomial of degree k-1 over GF(256) where the constant term is the secret byte. It evaluates this polynomial at x = 1, 2, ..., n to produce n share bytes for that position. Each share is the concatenation of its index byte and one evaluated byte per secret byte, hex-encoded. The Reconstruct tab accepts hex shares, parses the index and data, and applies Lagrange interpolation in GF(256) to recover each secret byte. Addition in GF(256) is XOR, and multiplication uses the irreducible polynomial 0x11B (x^8 + x^4 + x^3 + x + 1). The tool validates that all shares have matching lengths and unique indices before reconstructing. At least k shares are required, but providing more than k still works (the interpolation is overdetermined but consistent).
How Shamir's Secret Sharing works
Shamir's scheme relies on a fact from polynomial algebra: a polynomial of degree k-1 is uniquely determined by k distinct points, and k-1 points reveal no information about it. To share a secret S, pick a random polynomial f(x) = S + a1*x + a2*x^2 + ... + a(k-1)*x^(k-1) where the coefficients a1 through a(k-1) are random. The shares are the points (1, f(1)), (2, f(2)), ..., (n, f(n)). Any k shares let you recover f(x) via Lagrange interpolation, and evaluating f(0) gives S.
This tool operates in GF(256), the finite field with 256 elements. Working in a finite field is necessary because polynomial interpolation over the real numbers would introduce rounding errors. GF(256) has exactly 256 elements (0 through 255), so each field element maps to one byte. Addition is bitwise XOR. Multiplication uses the standard AES irreducible polynomial 0x11B (x^8 + x^4 + x^3 + x + 1) for reduction. Division is multiplication by the multiplicative inverse, computed via the fact that a^254 = a^(-1) in GF(256).
Shamir published this in 1979 in Communications of the ACM. The scheme is a foundation of threshold cryptography, where a key is split so that a minimum number of parties must cooperate to use it. Real-world deployments include HashiCorp Vault (unseal keys), cryptocurrency wallet backups (e.g. SLIP-39), and distributed key generation protocols. The scheme provides information-theoretic security: with fewer than k shares, every possible secret is equally likely.
How to use this tool
- Go to the Split Secret tab and enter your secret as text or switch to hex input mode
- Set the threshold k (minimum shares needed to reconstruct) and total shares n
- Click Generate Shares to produce n hex-encoded shares, each with a unique index
- Distribute the shares to separate people or systems. No single share contains useful information
- To reconstruct, switch to the Reconstruct tab and paste at least k shares into the input fields
- Add more share fields if needed using the Add Share button
- Click Reconstruct Secret to recover the original text and hex representation
Real-world examples
Splitting an API key among 3 administrators
You have an API key "AKIAIOSFODNN7EXAMPLE" that should not be stored in any single location. Set threshold k=2 and total shares n=3. The tool generates 3 shares. Give one share to each administrator. Any two administrators can reconstruct the key, but a single administrator acting alone learns nothing about the key. This is a (2, 3) threshold scheme.
Backing up a cryptocurrency seed phrase
A BIP-39 seed phrase like "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about" encodes 128 bits of entropy. Enter it as text with k=3 and n=5. Store the 5 shares in different physical locations (safe, bank deposit box, trusted family member). Recovering the wallet requires gathering any 3 of the 5 shares. This matches the approach used by SLIP-39, which also uses Shamir's scheme in GF(256).
Reconstructing with more than k shares
If you split with k=3 and n=5, you can reconstruct with 3, 4, or all 5 shares. The Lagrange interpolation produces the same result in each case because the polynomial is uniquely determined by any k points. Providing extra shares does not change the output but can serve as a consistency check: if one share is corrupted, the result will differ when that share is included versus excluded.
Comparison with similar methods
| Method | Complexity | Typical use |
|---|---|---|
| Shamir's Secret Sharing (GF(256)) | O(k^2 * m) for m bytes | Threshold key protection, wallet backups |
| XOR secret sharing (k=n) | O(m) | Only when all shares are required (no threshold) |
| Blakley's scheme | O(k^2 * m) | Geometric approach, less common in practice |
| Replicated secret sharing | O(m) | Specific threshold structures (e.g. (k, n) with small n) |
Limitations or considerations
This tool processes secrets up to 1024 bytes. Larger inputs would produce very long share strings. The random polynomial coefficients are generated using the browser's crypto.getRandomValues, which provides cryptographically secure randomness. The scheme provides information-theoretic security: with fewer than k shares, every possible secret is equally likely, so brute force is impossible regardless of computing power. However, the tool does not protect against share tampering. If an attacker modifies a share, the reconstructed secret will be wrong but no error is raised (the interpolation still produces a result). For authenticated secret sharing, combine this with a MAC or use a verifiable secret sharing scheme like Feldman's VSS. The tool also does not encrypt shares at rest. Store them securely.
Frequently asked questions
Why does fewer than k shares reveal nothing about the secret?
With k-1 shares, the polynomial has one degree of freedom. For any candidate secret value, there exists a polynomial of degree k-1 consistent with the k-1 shares and that candidate. So every possible secret is equally likely. This is information-theoretic security, not computational security. No amount of computing power helps.
Why use GF(256) instead of regular arithmetic?
Lagrange interpolation over the real numbers involves division, which produces fractions. Rounding those fractions introduces errors that corrupt the secret. GF(256) is a finite field where division is exact (every nonzero element has a multiplicative inverse), so the interpolation is lossless. GF(256) also maps perfectly to bytes, making the implementation clean.
What is the share format?
Each share is a hex string. The first byte is the share index (1 through n), and the remaining bytes are the polynomial evaluations, one per byte of the original secret. When reconstructing, the tool parses the index from the first byte and uses the rest as the share data.
Can I reconstruct with more than k shares?
Yes. Lagrange interpolation works with any number of points. With exactly k shares, the polynomial is uniquely determined. With more than k, the result is the same (the extra points are consistent). This can help detect corrupted shares: if the result changes when you add or remove a share, one of them is wrong.
Is this the same as encrypting the secret?
No. Encryption hides a secret under a key. Shamir's Secret Sharing splits a secret into shares so that a quorum is required to reconstruct it. They solve different problems. You can combine them: encrypt data with a key, then split the key using Shamir's scheme so that k parties must cooperate to recover the key and decrypt the data.
Conclusion
Shamir's Secret Sharing splits a secret so that a threshold of k out of n shares is required to reconstruct it, with fewer than k shares revealing zero information. This tool implements the scheme in GF(256) with the AES irreducible polynomial, handles text and hex inputs, and runs entirely in your browser. Use it to protect API keys, seed phrases, or any secret that should not depend on a single point of failure. For production systems, pair the shares with authentication (MAC or digital signatures) to detect tampering.