SLIP-39 Shamir backup: shares, thresholds and wallet support

A Shamir backup splits a wallet’s secret into several shares and sets a threshold: any set of shares that meets the threshold restores the wallet, and fewer reveal nothing. SLIP-0039, created by SatoshiLabs in December 2017, is the published standard for Shamir backups of wallet seeds, and the one Trezor, Keystone and OneKey implement. Our seed phrase guide introduces it next to ordinary recovery phrases; this sheet covers how SLIP-39 works and which wallets support it.

What is a SLIP-39 Shamir backup?

SLIP-0039 describes “a standard and interoperable implementation of Shamir’s secret-sharing (SSS)” for backing up hierarchical deterministic wallets. In its words, SSS “splits a master secret into unique parts which can be distributed among participants”, a minimum number of parts is needed to rebuild it, and “Knowledge of fewer than the required number of parts does not leak information about the master secret.”

Each share is a list of words from SLIP-39’s own word list, which contains exactly 1,024 words (BIP39’s has 2,048). A share is 20 words for a 128-bit secret and 33 words for a 256-bit secret. SLIP-0039 says the last three words “form a checksum and contain no information”, so a wallet can reject a mistyped share.

SLIP-39 also defines a two-level scheme: shares sit in groups, each group has its own threshold, and a group threshold sets how many groups must be complete. The standard gives the reason as the need to “distribute the amount of trust unevenly between shareholders”, for example one group of shares you hold and another held by relatives.

How does a 2-of-3 Shamir backup work?

You create three shares and store them in three places. Any two restore the wallet; one alone is useless to a thief. Trezor’s SLIP39 FAQ spells out the limit in the other direction: with 2-of-3, “losing two shares would prevent recovery with that backup.” Trezor allows “a maximum of 16 shares” and recommends you “distribute recovery shares geographically”.

That is the trade: a single recovery phrase is one point of theft and one point of loss; a 2-of-3 split removes both single points but gives you three places to keep secure and an heir who needs to find two of them. Trezor’s recovery guide says “Ideally, the shares of a Multi-share Backup are kept in different locations.”

Is SLIP-39 compatible with BIP39?

Not directly. The two standards use different word lists and turn words into a seed differently, so a SLIP-39 share cannot be typed into a wallet that expects a BIP39 phrase. SLIP-0039 says converting an existing BIP39 phrase into shares “is possible, but only at the price of all SLIP-0039 shares being 59 words long”. Trezor’s backup guide is blunter: “You can’t directly convert an existing BIP39 backup to SLIP39.” The supported route is a new SLIP-39 wallet and a transfer of the funds. For how BIP39 phrases work, see the BIP39 sheet.

A single share counts as SLIP-39 too. Trezor’s Single-share Backup, one 20-word share with a threshold of one, “became the default wallet backup for all Trezor Safe Family devices and the Trezor Model T starting in June 2024.” Trezor lists software wallets “such as Rabby, Electrum, Sparrow, BlueWallet, and Wasabi, as well as the Keystone hardware wallet” as supporting it.

Which hardware wallets support SLIP-39?

Create and restore SLIP-39 shares:

• Trezor Safe 3, Safe 5, Safe 7 and Model T: Single-share and Multi-share Backup. The updated Multi-share feature needs “firmware version 2.7.2 or newer”. A Single-share Backup can later be upgraded to several shares, but Trezor warns that afterwards “your Single-share Backup is still valid!”, so destroy or secure the original 20 words.
• Keystone 3 Pro: Keystone’s Shamir guide lets you “Specify the desired number of shares and the threshold”, and imports shares of “20 or 33” words. Its older support page says “Keystone supports the importing and creation of SLIP39 Shamir Backups”, and its firmware notes record updated SLIP-39 compatibility in version 2.2.6.
• OneKey Pro: “OneKey Pro has supported the SLIP39 standard since version 4.15.0” (OneKey), with 20-word shares.

No SLIP-39, per the maker’s documentation: the Trezor Model One (BIP39 only), Tangem Wallet and Tangem Ring, Arculus, KeepKey, Blockstream Jade Plus and BitBox02 Nova Multi. For these the table’s “Inferred” rows rest on the recovery formats the maker lists: 12- to 24-word BIP39 phrases or a microSD card, never 20- or 33-word shares. ELLIPAL says outright that Trezor Shamir shares cannot be imported into the Titan 2.0, and Bitkey has no recovery phrase to split.

No statement found: the five Ledger models, the two SafePal models, the NGRAVE ZERO, the two COLDCARD models and the Passport Prime.

Which Shamir-style backups are not SLIP-39?

Three makers split secrets in other ways. The shares are not interchangeable with SLIP-39 shares.

• COLDCARD Codex32. Coinkite describes Codex32 as “Defined by BIP-93, it lets you split a secret into several shares and choose how many are needed to recover it.” Firmware 5.6.3 (Mk4 and Mk5) and 1.5.3Q (Q), released on 1 October 2026, let you “split the wallet already on your device into Codex32 Shamir shares” (Coinkite blog).
• COLDCARD Seed XOR. Not a threshold scheme: “You must have access to all parts of the split seed to complete the process” (COLDCARD).
• Ledger Recover. An “optional and opt-in paid subscription service” (Ledger). When you subscribe, “a pre-BIP39 version of your private key is encrypted, duplicated and divided into three fragments” held by Coincover, Ledger and EscrowTech, and “2 of the 3 parties will send fragments back to your Ledger device” to restore it (Ledger). Ledger Academy calls the method Pedersen’s Verifiable Secret Sharing, “a specific variant of Shamir’s Secret Sharing”. The fragments sit with companies, not with you.
• Passport Prime Magic Backups. Foundation says they “store critical Passport Prime master key data in a 2-of-3 Shamir setup” across NFC Keycards and its Envoy app (Foundation).

A Shamir backup is not multisig. Coinkite draws the line: with Shamir you rebuild one secret, while “With multisig, the keys remain separate, and spending requires multiple signatures.” Keystone’s Shamir guide calls its Shamir wallets “multi-signature wallets”, which they are not in that sense.

What should you check before choosing a Shamir backup?

• Where you can restore it. Among the devices in the table: a Trezor (not the Model One), the Keystone 3 Pro or the OneKey Pro. Trezor’s recovery guide says Multi-share Backup “is supported by software wallets such as Rabby, Electrum, Sparrow, BlueWallet, and Wasabi, as well as the Keystone hardware wallet.” If your device breaks, its replacement has to read SLIP-39 shares.
• The threshold. 2-of-3 tolerates the loss of one share; 3-of-5 tolerates the loss of two but needs three shares brought together to restore.
• Old copies. Upgrading a Single-share Backup on Trezor leaves the original valid.
• Firmware. Trezor’s updated Multi-share feature and OneKey’s support need recent firmware (2.7.2 and 4.15.0 respectively).
• Your heirs. They need to know the shares exist, where they are and how many are needed. The self-custody guide covers inheritance planning.

What we could not verify

• Ledger, SafePal, NGRAVE, COLDCARD and Foundation: no statement either way on SLIP-39 shares, which is why their rows show “Not documented”.
• Cross-brand restores: Trezor names Keystone as supporting both its Single-share and Multi-share Backup; we found no OneKey statement on restoring Trezor shares, no Keystone or OneKey statement on the reverse direction, and no test across specific firmware versions.
• Share limits on Keystone and OneKey: their guides do not state a maximum number of shares or threshold.
• Trezor Model T default: Trezor’s backup-format table lists 12-word BIP39 for the Model T, while its Single-share article says Single-share became the default in June 2024.