Split any sensitive secret — seed phrase, private key, password, or recovery code — into M-of-N shards. Any M can recover it. Fewer than M reveal nothing.
Four steps, performed entirely inside your browser. No account, no upload, no server-side processing.
Seed phrase, private key, password, recovery code, or any short text up to 4 KB.
Pick 2-of-3, 3-of-5, 5-of-7, or any custom M-of-N up to your tier limit.
Print, engrave, write down, or distribute to trusted holders. Never store all shards together.
Any M shards reconstruct the original secret locally in the browser. Fewer than M reveal nothing.
Pass on a self-custody wallet to family without giving any single person full access during your lifetime.
Protect access to your password manager's master key against device loss, fire, or single-point compromise.
Threshold backup for protocol-level recovery secrets. Distinct from operational multisig — for when signing keys must be reconstructed.
Ensure operational secrets survive personnel changes, executive departures, or sudden incapacity of any one officer.
Distribute custody secrets across principal, fiduciaries, and counsel without granting any single party unilateral access.
The minimum viable backup for personal use. Survives one device loss or one location compromise.
Information-theoretic security: the threshold split itself does not depend on computational hardness.
The cryptography is free and runs in your browser. The kit is what makes the scheme real — archival materials, tamper-evident seals, holder instructions, and a written manual your heirs can use without us.
For individuals protecting one important backup
For families, partners, and small teams with real holders to manage
For inheritance ceremonies and high-stakes recovery plans
See the full kit details, materials, and per-tier breakdown.
View all kits → Explore Concierge tiers →You receive a physical kit, mailed from our Orlando workshop. Contents depend on tier:
All tiers include access to the browser-based splitting and reconstruction tool. The kit is what makes the scheme physically real.
You don't have to. The Shamir Secret Sharing protocol itself is free, and any open-source implementation will produce mathematically identical shards. What we charge for is everything around the protocol:
You pay for a thing that arrives at your door. Not for the cryptography — that part is yours, and free.
No. The kit is designed for someone who has never used a cryptocurrency wallet. The setup booklet walks you through generation in plain language, and the recovery manual is written for heirs who may have no technical background at all.
If you're protecting a seed phrase, you obviously have some familiarity with crypto — but your spouse, child, lawyer, or executor does not. That is the point.
No. It works for any short secret: BIP-39 seed phrases, private keys, password manager master passwords, recovery codes, encryption keys, or arbitrary text up to 4 KB. The cryptography does not care what the secret means — only that it is a secret.
No. Shards never receives or stores your secret or your shards. Recovery requires possession of any M of the N shards you generated. If those are lost, the secret cannot be recovered — by us or by anyone.
This is the cost of the security guarantee. The same property that makes Shards safe against compromise (we have nothing to lose) also means we cannot help you recover from a loss of too many shards.
No — not unless they collude with enough other holders to reach the threshold M. A single shard, mathematically, reveals nothing about the original secret. Not "almost nothing." Nothing.
This is the core property of Shamir's Secret Sharing. In a 3-of-5 scheme, the first two shards reveal exactly as much about the secret as zero shards do.
If you fall below the threshold M, the secret is mathematically unrecoverable. This is the same property that protects you against a single compromised holder — the privacy guarantee cuts both ways.
The practical implication: choose holders who are likely to be reachable when you need them, and choose a threshold that builds in redundancy. 3-of-5 is the recommended default precisely because it tolerates two lost shards before recovery becomes impossible.
The threshold split itself is information-theoretically secure. It does not depend on any computational hardness assumption, so a future quantum computer gains no advantage in attacking the split.
Other risks (malware on your device, phishing, physical theft of cards) are outside the cryptographic guarantee. We discuss the full threat model on the threat model page.
Yes, and we recommend it for high-value secrets. Load the page once, disconnect from the internet, then perform the split or recovery. The codebase can also be cloned and run locally — see the run offline section for the procedure.
The Legacy tier explicitly supports air-gapped setup, walking you through how to run the split on a never-connected machine.
We dispatch within two weeks of order confirmation. Each kit is assembled by hand at our Orlando workshop. Transit depends on destination:
You receive tracking by email the moment your kit leaves our facility.
Your scheme keeps working. This is the most important thing to understand about the product.
Because Shards never sees your secret and never holds your shards, our continued existence is not required for you to recover. The offline recovery manual in your kit explains how to reconstruct using:
The trust model is not "Shards stays in business forever." The trust model is that the mathematics is permanent, the open-source tools are permanent, and your printed materials are designed to outlive us.
Your scheme tolerates lost holders up to N minus M. In a 3-of-5 scheme, you can lose two holders entirely and still recover. That is a deliberate design choice — schemes should always have built-in redundancy.
If a holder becomes unavailable, you can also redistribute — generate a new set of shards from the original secret, distribute to a new set of holders, and have the old holders destroy theirs. The recovery manual includes the procedure. The Legacy tier includes a written lost-holder replacement plan tailored to your specific scheme.
No. Shards is a cryptographic tool, not a legal service. Nothing on this website, in our documentation, or in our communication constitutes financial, legal, tax, or estate-planning advice.
For matters involving inheritance, estate planning, tax treatment of digital assets, or fiduciary duties, consult a qualified professional. Many customers integrate Shards into a broader estate plan — but the legal architecture (wills, trusts, powers of attorney) is something a lawyer should build alongside the cryptographic scheme.