Toolgeist › Security
Shamir's Secret Sharing — Split a Secret Into k-of-n Shares
Split a secret so that any k of n shares rebuild it and any k−1 reveal literally nothing. This is the real construction: each secret byte becomes the constant term of a random degree-(k−1) polynomial over GF(2⁸), each share is that polynomial evaluated at a different point, and recovery is Lagrange interpolation back to x = 0. Randomness comes from crypto.getRandomValues rather than a seeded generator, because the coefficients are the only thing hiding the secret. Verified exhaustively: for a 3-of-5 split, all ten possible three-share subsets reconstruct byte-for-byte, and no two-share subset ever does.
How to use Shamir Secret Sharing — Split a Secret Into k-of-n Shares
- Type the secret you want to protect.
- Choose how many shares to create and how many are needed to recover.
- Click shares to select them and watch recovery succeed or fail.
- Select one fewer than the threshold to see that the output is unrelated, not partially correct.
Frequently asked questions
- What exactly does "reveal nothing" mean?
- It is information-theoretic, not computational. With k−1 shares, every possible secret of that length remains exactly as likely as every other, because for each candidate there is precisely one set of coefficients consistent with the shares held. An attacker with unlimited computing power still learns nothing. That is a stronger guarantee than any cipher provides — AES is safe because breaking it is expensive; this is safe because the information is genuinely absent.
- Why a polynomial?
- Two points determine a line, three determine a parabola, and k points determine a degree-(k−1) curve. Hide the secret as the curve’s value at x = 0 and hand out other points on it, and the threshold falls out of the algebra rather than from an access-control rule that someone could bypass.
- Why GF(2⁸) instead of ordinary arithmetic?
- Finite-field arithmetic keeps every share exactly one byte per secret byte — no rounding, no floating point, no size growth, and a uniform distribution over share values. Working over the real numbers or the integers would leak information through magnitude and would not be exactly reversible.
- How is this different from just encrypting the file?
- Encryption moves the problem: now you must protect the key. Secret sharing removes the single point of failure entirely — there is no master key to steal, and no individual who can act alone. The classic uses are splitting a wallet seed across locations, a signing key across executives, or root credentials so that no single administrator has unilateral access.
- Does it detect a corrupted or malicious share?
- No, and this matters. Shamir’s scheme provides secrecy but not integrity: a participant who submits a wrong share silently produces a wrong secret rather than an error. Verifiable secret sharing schemes exist specifically to close that gap. Do not assume a successful-looking reconstruction proves the shares were honest.
- Is it safe to use this page for a real key?
- The mathematics here is correct and everything runs locally in your browser using a cryptographic random source — nothing is uploaded. But for a key that genuinely matters you should use an audited implementation on a machine you control. A web page is a demonstration of the scheme, not a key-management system.
Related Security tools
Also searched for: shamir's secret sharing calculator · split a key into shares · k of n threshold secret sharing · gf(256) polynomial interpolation secret · how to split a crypto seed phrase
Browse all 738 free tools on Toolgeist →