Recovery Share

What Is a Recovery Share?

A recovery share is a cryptographic fragment of a wallet's master secret: a private key, seed phrase, or root entropy. Instead of storing the entire secret in a single backup, the wallet splits it into multiple shares using a threshold scheme. Each individual share is useless on its own, but collecting the minimum threshold of shares allows the original secret to be reconstructed.

The concept originates from Adi Shamir's 1979 paper on secret sharing, which proved that a secret can be divided into N pieces such that any M of them (where M ≤ N) are sufficient to reconstruct it, while any fewer than M reveal zero information about the secret. This mathematical guarantee makes recovery shares fundamentally different from simply splitting a seed phrase into fragments: losing one Shamir share does not reduce the security of the remaining shares.

Recovery shares solve a core problem in self-custody: how to back up a secret without creating a single point of failure. A seed phrase written on one piece of paper can be lost, stolen, or destroyed. Recovery shares distribute that risk across multiple locations, devices, or trusted people (guardians), ensuring that no single compromise can drain the wallet.

How It Works

Recovery share generation follows a structured process, regardless of the specific implementation:

1. The wallet generates a master secret (seed entropy or private key)
2. The user selects the total number of shares (N) and the recovery threshold (M)
3. The wallet runs the secret through a threshold splitting algorithm, typically Shamir's Secret Sharing over a finite field
4. Each share is encoded into a portable format: a mnemonic word list, QR code, or encrypted data blob
5. Shares are distributed to separate storage locations or guardians

To recover the wallet, the user collects at least M shares and feeds them into the reconstruction algorithm. The algorithm uses polynomial interpolation to recover the original secret, which is then used to derive the wallet's keys through the standard derivation path.

The Mathematics of Shamir Splitting

The most widely used recovery share scheme is Shamir's Secret Sharing (SSS). The algorithm encodes the secret as the constant term of a random polynomial of degree M-1 over a finite field. Each share is a point on that polynomial. Given M points, Lagrange interpolation uniquely determines the polynomial and recovers the constant term (the secret). With fewer than M points, every possible secret value is equally likely: the scheme is information-theoretically secure.

# Example: 2-of-3 Shamir split
# Secret s is encoded as f(x) = a₁x + s  (degree-1 polynomial)
# Share 1: f(1) = a₁ + s
# Share 2: f(2) = 2a₁ + s
# Share 3: f(3) = 3a₁ + s

# Any 2 shares solve the system of equations for both a₁ and s
# 1 share alone has infinitely many valid solutions for s

For a deeper exploration of the mathematics and Bitcoin-specific applications, see the research article on Shamir's Secret Sharing for Bitcoin backup.

SLIP-39: The Standardized Format

SLIP-39, developed by SatoshiLabs for Trezor hardware wallets, is the most widely adopted standard for encoding recovery shares as mnemonic word sequences. Each share is represented as 20 words (128-bit security) or 33 words (256-bit security) drawn from a dedicated 1024-word list.

SLIP-39 supports a two-level threshold scheme with up to 16 groups, each containing up to 16 member shares. A group threshold specifies how many groups must participate, and each group has its own member threshold. This enables sophisticated setups: for example, a user might require shares from both a personal group (2-of-3 shares kept at home) and a trusted-contact group (2-of-5 shares held by family members).

The standard also encrypts the master secret with a passphrase using PBKDF2-HMAC-SHA256 before splitting, so each passphrase produces a different wallet. Shares include a checksum that can detect errors affecting up to three words, reducing the risk of transcription mistakes.

Recovery Shares vs. Threshold Signing

Recovery shares and threshold signatures both distribute trust across multiple parties, but they operate at different levels:

In practice, some wallets combine both approaches: FROST-based threshold signing for day-to-day transactions, with Shamir-based recovery shares as a cold backup in case signing devices are lost. Spark uses FROST threshold signing for its cooperative custody model, ensuring the full private key never exists in one place during normal operations.

Storage Considerations

How and where recovery shares are stored is as important as the cryptographic scheme itself. The general principle is geographic and institutional diversity: shares should not all be vulnerable to the same natural disaster, theft, or institutional failure.

• Steel plates or metal backups: shares engraved or stamped onto fireproof, waterproof metal. Each plate stores one share and is kept in a separate physical location such as a home safe, bank vault, or trusted relative's house.
• Encrypted cloud backup: a share encrypted with a strong passphrase and stored in a cloud service. This adds geographic redundancy but introduces a dependency on the cloud provider's availability and the user's passphrase memory.
• Guardian-held devices: shares stored on dedicated hardware wallets or secure elements held by trusted individuals. The guardian may not even know what the share protects, only that they must keep it safe and return it on request.
• Hybrid approaches: some embedded wallet providers store one key share on the user's device, a second encrypted share in their infrastructure, and a third as an optional recovery share for device-loss scenarios.

For a comparison of recovery tools, see the Bitcoin social recovery wallet comparison tool.

Use Cases

Personal Wallet Backup

The most common use case is replacing a single seed phrase backup with a more resilient scheme. A user creates a 2-of-3 split, stores one share at home, one in a bank safe deposit box, and one with a trusted family member. Losing any single share (to theft, fire, or forgetfulness) does not compromise the wallet and does not prevent recovery.

Inheritance Planning

Recovery shares simplify Bitcoin inheritance by distributing shares to heirs and an estate attorney. A 3-of-5 scheme might give two shares to family members, one to an attorney, one to a trusted friend, and one in a bank vault. No single party can access the funds, but any three can cooperate to recover them.

Organizational Key Management

Companies holding cryptocurrency can use recovery shares to ensure business continuity without giving any single employee full access to treasury funds. Combined with multisig for day-to-day operations, recovery shares provide a disaster recovery fallback if signing devices are lost or employees leave the organization.

Social Recovery Wallets

Social recovery wallets extend the guardian model by letting trusted contacts help a user regain access. While Ethereum smart contract wallets rotate signing keys through on-chain guardian votes, Bitcoin wallets can use recovery shares with distributed key generation to achieve a similar result. For a detailed comparison of guardian-based approaches, see the social recovery for Bitcoin research article.

Risks and Considerations

Reconstruction Exposure

The fundamental limitation of Shamir-based recovery shares: the full secret must be reassembled on a single device during recovery. For the duration of that reconstruction, the complete private key or seed exists in memory. If the recovery device is compromised by malware, a side-channel attack, or physical observation, the secret is exposed. Performing recovery on an air-gapped device mitigates this risk.

Guardian Risks

Distributing shares to guardians introduces social risks. Guardians can lose their share, become unresponsive, or collude with other guardians to reach the threshold. The choice of M and N must balance redundancy (lower M makes recovery easier but collusion cheaper) against security (higher M requires more cooperation but resists collusion better). Selecting guardians who do not know each other and are spread across different jurisdictions reduces collusion risk.

Share Verification

Users should verify their recovery shares work before relying on them. A share could be recorded incorrectly, stored in a format that becomes unreadable, or generated by buggy software. Testing reconstruction with all shares immediately after creation, ideally on a separate device, confirms the backup is valid.

No Revocation Mechanism

Once distributed, Shamir shares cannot be individually revoked. If a guardian is compromised, the user must reconstruct the secret, generate a new wallet, transfer funds, and create a fresh set of shares. This contrasts with key shares in threshold signing schemes, where proactive share refresh can rotate individual shares without changing the underlying public key or moving funds.

Compatibility Limitations

Not all wallets support SLIP-39 or other standardized share formats. Recovery shares created with one wallet may not be importable into another. Users should confirm that their recovery software is open-source and can be run independently of any single vendor, reducing the risk of being locked into a product that may become unavailable.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.