Encrypt & Decrypt Flows

Overview

Shamir backup splits a BIP-39 mnemonic into M-of-N Shamir shares, then honey-encrypts each share independently with its own password (or a shared password). Each share becomes a standalone QR code or encrypted text string.

There is no Google Account, no Google Drive backup, no device enrollment. The shares themselves are the only backup material. To restore, collect M shares, enter each share's password, and combine the decrypted shares to reconstruct the mnemonic.

Encryption Flow

1. 1

   Enter mnemonic

   User provides a valid BIP-39 mnemonic (12 or 24 words). W2QR validates the checksum and extracts the raw entropy bytes (128 bits / 16 bytes for 12 words, 256 bits / 32 bytes for 24 words).

2. 2

   Open Shamir Split

   After creating an encrypted wallet, use Tools → Shamir Split from the navigation menu, or the “Split into Shamir Shares” option on the wallet result page.

3. 3

   Configure M-of-N

   User sets the threshold (M) and total shares (N). For example, 2-of-3 means any 2 shares can reconstruct the mnemonic. Constraints: M ≥ 2, N ≥ M, N ≤ 10.

4. 4

   Choose password mode

   Option A — Same password

   One password encrypts all N shares. Simpler to remember, but if the password is compromised, all shares are vulnerable.

   Option B — Individual passwords

   Each share gets its own password. Stronger security: compromising one share's password doesn't affect the others. User enters N passwords sequentially.

5. 5

   Shamir split

   The mnemonic entropy is split into N shares using Shamir Secret Sharing over GF(256). For each byte position in the entropy, a random polynomial of degree (M−1) is generated with the entropy byte as the constant term. The polynomial is evaluated at x = 1, 2, …, N to produce N share bytes. Each share has the same length as the entropy.

6. 6

   Honey-encrypt each share

   For each share i (1 to N):

   salt_i   = random(16 bytes)

   key_i    = Argon2id(password_i, salt_i, 64 MB, 3 iter)

   cipher_i = share_data_i XOR key_i[0..entropy_length]

   This is identical to V2B (Basic) encryption, applied to the share data instead of the full entropy. Every password produces valid-looking share data (random bytes), preserving the honey encryption property.

7. 7

   Encode share payloads

   Each encrypted share is encoded as a binary payload (see Share Format below) and rendered as:

   • • QR code — scannable image (PNG/SVG), downloadable and printable
   • • Text string — base64url-encoded payload, copyable and pasteable
8. 8

   Distribute shares

   User downloads/prints each share QR or copies the text strings. Each share should be stored in a different location or given to a different custodian.

Share Format

Each share is encoded as a compact binary payload:

Total payload size: 37 bytes (12-word mnemonic) or 53 bytes (24-word). Compact enough for a small QR code.

Decryption Flow

1. 1

   Collect M shares

   Gather at least M share QR codes (scan/upload) or text strings (paste). W2QR detects the version = 6 byte and enters Shamir restore mode automatically.

2. 2

   Validate share compatibility

   All shares must have matching threshold, totalShares, and wordCount. Duplicate share indices are rejected.

3. 3

   Decrypt each share

   For each collected share i:

   key_i        = Argon2id(password_i, salt_i, 64 MB, 3 iter)

   share_data_i = cipher_i XOR key_i[0..entropy_length]

   If “same password” was used during creation, one password entry suffices. If “individual passwords” were used, the user enters each share's password separately.

4. 4

   Combine shares

   The M decrypted share data values are combined using Lagrange interpolation over GF(256) to reconstruct the original mnemonic entropy bytes.

5. 5

   Reconstruct mnemonic

   The entropy bytes are converted back to a BIP-39 mnemonic (with checksum verification). The derived Ethereum address is shown so the user can verify correctness.

Password Modes

Security Properties

• ✓Information-theoretic security: Fewer than M shares reveal zero information about the mnemonic, even with unlimited computing power. This is a mathematical guarantee of Shamir Secret Sharing.
• ✓Honey encryption on shares: Any password on any share produces valid-looking share data (random bytes). An attacker cannot tell if they have the right password without combining M shares and checking the derived address on-chain.
• ✓No password verifier: No hash, MAC, AEAD tag, sentinel, or address is stored in the share payload. The only verification is reconstructing the mnemonic and checking the derived address.
• ✓Argon2id hardening: Each share is independently protected by Argon2id (64 MB, 3 iterations). Brute-forcing each share's password is expensive.
• ✓Fully offline: No server, no account, no network connection required. All operations run client-side in the browser.
• ✓Independent encryption: Each share has its own random salt and (optionally) its own password. Compromising one share's encryption reveals nothing about other shares.

Shamir Shares & W2QR Cards

Additional Recovery: Authenticator App (TOTP)

Why Shares Are Harder to Attack Than a Single QR

Why W2QR

Comparison: Basic vs Advanced vs Shamir Shares

When to Use Shamir Shares

Recommended Configurations

What Shamir Shares Mode Does NOT Provide

• ✗No password recovery — if you forget the password(s), the shares are unusable. Choose strong, memorable passwords.
• ✗No cloud backup — shares are not backed up to Google Drive. You manage storage yourself.
• ✗No Google Account integration — no sign-in, no server storage, no authorization secret.
• ✗No device enrollment — no WebAuthn, no biometric unlock.
• ✗No disaster recovery — if fewer than M shares + passwords survive, the mnemonic is permanently lost.
• ✗No automatic format upgrade — shares cannot be upgraded to Advanced mode. Create a new Advanced QR separately if needed.

Shamir Shares vs Recovery Root Splitting