TL;DR
Don’t cut a 24-word seed into pieces. Each piece tells a thief most of your seed, and losing a piece can lock you out. SLIP39 Shamir shares do the splitting properly, but the full seed still comes back together on one device. For savings, a 2-of-3 multisig is the stronger choice: the keys never meet.
The idea comes up all the time: write the 24 words on three cards, put one card in each of three places, and nobody who finds one card has your bitcoin. It feels like multisig for free. It isn’t. Here’s why, what the proper version of the idea looks like, and when each option makes sense.
Why splitting your seed words is a bad idea
A 24-word BIP39 seed holds 256 bits of randomness plus an 8-bit checksum. Each word stands for 11 bits, picked from a list of 2,048. That’s what makes a seed impossible to guess: there are more possible seeds than anyone could ever try.
Splitting throws most of that away. The usual “2-of-3” trick puts 16 of the 24 words on each card, arranged so any two cards cover all 24. A thief with one card is only missing 8 words.
| What the thief has | Words missing | Guesses needed, roughly |
|---|---|---|
| Nothing | 24 | 2256 (out of reach, forever) |
| One card of a 16-word split | 8 | 288, and the checksum rules out 255 of every 256 guesses before any blockchain lookup |
| One card of a 12-word seed split the same way | 4 | 244, about 17.6 trillion |
288 is still a big number today. But you’ve given up almost all of the safety margin the seed was designed with, and that margin is there for a reason: computers get faster, and attackers only need to succeed once. With a 12-word seed split the same way, 244 is a number that rented graphics cards can work through. That’s a realistic project for someone who knows what’s at stake.
The other way of splitting, three cards with 8 different words each and all three needed, has the opposite problem. Lose one card in a flood or a move and the whole seed is gone. You’ve turned one place that must not fail into three.
Shamir backups (SLIP39): splitting done right
SLIP39 is a standard for splitting a backup with Shamir’s secret sharing. You pick a threshold, for example 2 of 3, and the device creates three shares of 20 or 33 words from a separate list of 1,024 words. The key property, in the words of the standard: knowing fewer than the required number of shares doesn’t leak anything about the secret. One share on its own is worth nothing, not even a head start.
According to Trezor’s documentation, the Safe 5, Safe 3 and Model T can create and recover Shamir backups, with up to 16 shares. Trezor Suite makes 20-word shares by default. My BIP39 vs SLIP39 article explains why this guide still asks for a plain 24-word BIP39 seed on the Trezor: a SLIP39 backup can’t be restored on a BitBox02 or a Ledger.
What Shamir doesn’t change: when you restore, the shares are combined and the complete seed exists again on one device. And day to day, that one device holds a single key that can sign everything. The backup is spread out; the wallet isn’t.
Multisig: keys that never meet
In a 2-of-3 multisig there’s no single seed to split. Three devices each make their own seed, and any two of them must sign. A thief who finds one seed backup has one key, and one key can’t move anything. Losing one seed doesn’t lock you out either: the other two can still spend, as long as you also kept the wallet descriptor.
Because each seed comes from a different maker, a flaw in one device’s random number generator only weakens one key. With seed splitting or Shamir, a bad seed is bad in every piece. More on that in why three brands.
Compare with
| Cut-up seed words | SLIP39 Shamir shares | 2-of-3 multisig | |
|---|---|---|---|
| One piece found by a thief | Leaks most of the seed | Reveals nothing | One key, can’t spend |
| One piece lost | Depends on the split; can be fatal | Fine, if you set a threshold below the number of shares | Fine, with the descriptor |
| Is there a standard? | No, home-made | Yes, SLIP39 | Yes, descriptors and PSBT |
| Full key on one device | Yes | Yes | No, never |
| Hardware | Any BIP39 wallet | A device that supports SLIP39, such as a Trezor | Three devices, ideally three brands |
| Extra to back up | Nothing | Nothing | The wallet descriptor |
| Effort | Low, but risky | Low | A weekend to set up |
When each fits
- Cut-up seed words: never. If you’ve already done it, the safest fix is a fresh wallet with a new seed, then move the coins. Don’t just glue the pieces back together.
- SLIP39 Shamir: a single-sig wallet on a Trezor where you want the backup spread over two or three places without the work of a multisig. Fine for a moderate amount you want to keep simple.
- 2-of-3 multisig: savings you’d hate to lose. It protects the backups and the signing, and it survives a problem at one maker. The setup guide walks you through it in ten steps.
Common mistakes
- Splitting a 12-word seed. Four missing words is within reach of a determined attacker.
- Typing or photographing the words to “split them digitally”. Never put seed words on a computer or phone, in pieces or whole.
- Making a SLIP39 backup on the Trezor in a multisig with other brands. The other devices can’t restore it.
- Thinking a passphrase fixes a split seed. A passphrase helps against a leaked seed only if it’s stored separately, which brings back the problem of more pieces to lose.
- Treating multisig seeds as optional because “two are enough”. Store all three properly; see where to store three seed backups.
Nobody legitimate needs your words
No support desk, wallet maker or “recovery service” ever asks for seed words or shares, not even part of them. See someone asks for your seed words.