Shamir Secret Sharing Calculator

About this calculator

Introduced by cryptographer Adi Shamir in 1979, Shamir's Secret Sharing splits a secret into n shares so that any k of them reconstruct it exactly, while any k−1 or fewer reveal absolutely nothing about it (information-theoretic, not just computational, security). It works by picking a random polynomial of degree k−1 whose constant term is the secret, then handing each participant one point (x, f(x)) on that polynomial, evaluated over a finite field defined by a large prime modulus.

Recovery uses Lagrange interpolation: any k of the distributed points uniquely determine the degree-(k−1) polynomial, and evaluating it at x = 0 returns the original secret. This threshold scheme underlies real key-management systems — HashiCorp Vault's unseal keys, hardware security module backup procedures, and cryptocurrency wallet-recovery standards like SLIP-0039 all use it so that no single key holder, and no small subset of them, can reconstruct a master secret alone.