Shamir Shares
Split your mnemonic into M-of-N shares, each honey-encrypted with its own password. Distributed custody with no account, no server, fully offline.
Two Shamir systems in W2QR
Advanced mode uses a built-in 2-of-3 Shamir split for disaster recovery — shares are distributed automatically to your Google Account (R1), your device (R2), and your Recovery Code (R3). This page describes the separate Shamir Shares mode, which splits your mnemonic into independently encrypted shares for distributed custody.
How Shamir Shares Mode Works
Shamir Secret Sharing (SSS) is a cryptographic technique that splits a secret into N shares, where any M shares (the threshold) can reconstruct the original. No single share reveals any information about the secret — this is an information-theoretic guarantee.
In Shamir Shares mode, your mnemonic entropy is split first, then each share is independently honey-encrypted with its own password using the same Argon2id + XOR scheme as Basic mode. Each share becomes a standalone QR code or encrypted text string.
Encrypt Flow
1. Enter your mnemonic
Provide your BIP-39 seed phrase (12 or 24 words). W2QR extracts the raw entropy bytes.
2. Choose M-of-N
Set the threshold (M) and total shares (N). For example, 2-of-3 means any 2 shares can reconstruct the mnemonic. M ≥ 2, N ≥ M, N ≤ 10.
3. Choose password mode
Same password: one password encrypts all shares (simpler). Individual passwords: each share gets its own password (stronger, ideal for multi-party custody).
4. Split & encrypt
The mnemonic entropy is split into N Shamir shares over GF(256). Each share is then honey-encrypted with its password using Argon2id (64 MB, 3 iterations) + XOR masking. Each share has its own random salt.
5. Get your shares
Each share is output as a QR code (scannable, printable) and an encrypted text string (copyable, pasteable). Distribute them to different locations or custodians.
Decrypt Flow
1. Collect M shares
Gather at least M share QR codes (scan or upload) or text strings (paste).
2. Enter passwords
Enter the password for each share. If all shares use the same password, you enter it once. Each share is decrypted independently using Argon2id + XOR.
3. Reconstruct mnemonic
The decrypted share data is combined using Lagrange interpolation over GF(256) to reconstruct the original entropy. The derived Ethereum address is shown for verification.
Security Properties
- ✓Information-theoretic security: Fewer than M shares reveal zero information about the secret, even with unlimited computing power.
- ✓Honey encryption per share: Any password on any share produces valid-looking data. An attacker can't verify a password without M shares and a blockchain check.
- ✓No password verifier: No hash, MAC, AEAD tag, or sentinel stored in the share. The only verification is the derived wallet address.
- ✓Independent encryption: Each share has its own salt and (optionally) its own password. Compromising one share reveals nothing about the others.
- ✓Fully offline: No server, no account, no network. All operations run client-side in the browser.
No recovery safety net
Shamir Shares mode has no Recovery Code, no Google Account backup, and no device enrollment. If fewer than M shares survive (lost, corrupted, or password forgotten), the mnemonic is permanently unrecoverable. This is the trade-off for maximum simplicity and decentralization.