How to Split a Seed Phrase into 3 Parts — Safely

The instinct is good: a recovery phrase in one place is a single point of failure — one fire, one burglar, one nosy houseguest. Splitting it across locations feels like the obvious fix.

The two ways most people do it are both worse than they look. Here is why, with numbers, and what to do instead.

Mistake 1: cut it into thirds

Words 1–8 in the safe, 9–16 at your parents’, 17–24 in a deposit box.

The problem is not theft, it is loss. You now need all three pieces, so you have tripled the ways to lose the wallet: any one fire, flood, move or forgotten hiding place and the money is gone for good. You made theft a little harder and loss three times easier — and loss, not theft, is how most self-custodied coins disappear.

Mistake 2: the overlapping cards (“2-of-3 by hand”)

The well-known trick: three cards, each holding two thirds of the words, arranged so any two cards together have everything.

• Card A: words 1–16
• Card B: words 9–24
• Card C: words 1–8 and 17–24

Redundancy is fixed — lose one card and you are fine. But look at what a single card gives a thief: two thirds of your phrase, with the positions known.

How bad that is depends on the phrase length. Each BIP-39 word is 11 bits.

About a trillion candidates is within reach of someone with GPUs and patience; each one is a key derivation and an address check, and the work parallelises perfectly. A 12-word phrase on overlapping cards is protected by the cost of a rented cluster.

The 24-word case (2⁸⁰) is not practical to brute-force today. But you have thrown away 176 of your 256 bits of safety margin to get there, and you are betting the next decade of hardware on it.

The proper way: a threshold scheme

What you actually want is this property:

Any two of the three pieces recover the phrase. Any one piece reveals nothing at all.

That is exactly what Shamir’s Secret Sharing provides — not “hard to guess”, but mathematically nothing: with one share, every possible secret is equally likely. The idea, in one sentence: the secret is the point where a curve crosses the axis, each share is one point on the curve, and you need enough points to pin the curve down. The longer explanation is in Shamir’s Secret Sharing, Explained.

You can choose any threshold: 2-of-3 for a couple, 3-of-5 for a family with a lawyer, and so on.

Ways to get it

SLIP-39 on a hardware wallet. Trezor devices can create a wallet whose backup is a set of Shamir shares, each a list of words. Robust and offline. The catch: it is decided when the wallet is created, so it does not split the 12 or 24 words you already have.

A threshold tool for an existing phrase. This is what StegoSafe does on iPhone, iPad and Mac, fully offline: the phrase is encrypted with AES-256-GCM, split with Shamir’s scheme into n shares with a threshold k, and each share is hidden inside an ordinary photo. No share — and no photo — tells anyone that there is a wallet, let alone which words. The worked example is Five Photos, Any Three.

Multisig instead of splitting. A 2-of-3 multisig wallet never has a single secret to reassemble. For significant holdings it is worth the extra complexity. It answers a different question — protecting the funds rather than the backup — and you still need to back up each key.

Rules that apply whatever you choose

1. Never type a seed phrase into a website, including “seed splitter” pages. Use something that runs offline on a device you trust.
2. Test recovery before you fund the wallet. Reassemble from the minimum number of shares, on a clean device, and check the first address matches.
3. Spread the shares across failure modes, not just places: not all in one city, not all with one person, not all in one cloud account.
4. Write down the scheme — “2 of 3, shares are with A, B, C” — somewhere your heirs will find it. A perfect backup that nobody knows how to use is a loss with extra steps.
5. Leave the metal plate debate for the share, not the phrase. Steel is for surviving fire. It does nothing about someone reading it.

Splitting is the right idea. Do it with a scheme where a lost piece costs you nothing and a found piece tells the finder nothing.

A threshold is also what makes inheritance possible without trusting anyone in advance — What Happens to Your Crypto When You Die? is the same mechanism pointed at a different problem.

Once you have decided how to split it, the next question is where each share should live. We compare paper, steel, safes, password managers, photos and multisig in Where to Store Your Seed Phrase Safely.