Secret sharing is a cryptographic protocol that splits a secret, like a private key, into multiple shares (n pieces) distributed among participants (k shares), such that only a predefined subset can reconstruct the original secret. This is done using polynomial mathematics: a random polynomial is generated where the secret is the constant term, and each share is a distinct point on that curve. The defining property is that any k shares (the threshold) can reconstruct the polynomial and thus the secret, but any k−1 shares reveal absolutely no information about it.
A secret kept by one person dies with them and betrays you if they turn against you. However, one can not simply split it among several. That naïve split gives each keeper a slice but exposes the group to a single point of failure since every slice is needed (high risk of loss if a piece is lost; or a party is unwilling). Demanding all custodians is as fragile as trusting one.
In 1979 Adi Shamir — the S in RSA — answered this with a threshold: choose k of n. Any k keepers reconstruct the secret; any k−1 learn nothing. Shares can be added, revoked, or re-handed without ever changing the secret, and the guarantee is not "computationally hard" — it is information-theoretic. A quorum opens it; less than a quorum holds a fact about nothing.
One point on a plane fixes nothing: endless lines pass through it, each crossing the meridian (x = 0) somewhere different. Two points fix exactly one line. Hide the secret where the line meets the meridian, hand each keeper a single point on it, and one keeper alone holds a point consistent with every possible secret.
Below, the secret is a copper star on the meridian; each keeper is a star on the curve. Tap a keeper to hide its share. Hide enough that you are one short of the threshold, and watch the secret refuse to settle — every value on the axis still possible.
Bend the curve to demand more keepers. Three points fix a parabola, four a cubic: a threshold of k rides on a polynomial of degree k − 1. The secret is the constant term — the value at x = 0 — and the other coefficients are pure randomness, present only to hide it. Raise k on the orrery above and the curve gains a bend; raise n and you simply mint more points on the same curve. The threshold is the degree; the count of shares is free.
The tidy graph is a convenience, and a leak. Over ordinary numbers, a keeper one share short can use algebra to narrow the candidates — the slope can only bend so far — and brute-force the rest. The picture quietly betrays the secret. So the real scheme abandons the smooth plane for a finite field: arithmetic that wraps around a prime, where adding one more share gives no leverage at all. Toggle the orrery to finite field · the truth and the same shares scatter into noise. There is no curve to read; below the threshold, the field carries no information whatsoever.
Cleave a real secret — a phrase, a passphrase — into shares you could actually hand out, then reconstruct it from any quorum. Each byte is split with its own random polynomial over the AES field — GF(2⁸), the 256-element finite field whose byte arithmetic underpins the AES cipher, so "adding" and "multiplying" wrap cleanly within a single byte. The random coefficients come from the system CSPRNG: the operating system's cryptographically secure random number generator, reached through crypto.getRandomValues. Nothing is stored, nothing is sent: it runs entirely in this page.
A threshold scheme is a gate: a line sealed below, broken into five shards, that opens only to three of them. Hold fewer and it stays empty.
Demonstration. The sealed line lives in this page, so it is readable to anyone who reads the source. A real gate serves its secret from behind the wall, so the plaintext never ships.
The demonstration above seals a fixed line. This is the real instrument: bring your own secret and the page seals it for keeps. It does not split your secret directly — it encrypts it under a fresh AES-256 key (authenticated, GCM), then Shamir-splits only the key. So your plaintext never exists anywhere but the instant you decrypt it, not even in your own copy: what you keep is one public sealed payload and a handful of shards.
Hand the shards to different keepers or hide them in different places; publish or store the payload anywhere — it is useless without a quorum. Because the payload is authenticated, the wrong shards fail to open it cleanly, rather than returning a plausible lie. Everything runs in this page; nothing is stored or sent.
This runs real cryptography locally — nothing leaves your browser, which is the point. But it is unaudited demonstration code with no recovery: lose too many shards, mistype past the checksum, or lose the payload, and the secret is gone for good, and a future version of this page may not decode shards you make today. Learn how sealing works here; trust real valuables to an audited tool, and never seal anything you can't afford to lose.
To open a sealed secret, paste the payload and any k shards back:
Adi Shamir set this down in How to Share a Secret (Communications of the ACM, 1979) — three years after co-inventing RSA. The idea was a catalyst for things to comes: cryptocurrency key backups split across custodians, the ceremonial keys that sign the DNS root, secret stores that unseal only to a quorum of operators, and hardware-wallet recovery built on its verifiable cousin. While J.K. Rowling’s inspiration for Horcruxes stems from ancient world mythology and folklore it has been often referenced as a similar concept to the Shamir's Secret Sharing. It is also said that to create a Horcrux is to commit a horrific sin in the wizarding world. Technically, Horcruxes were backups, but the emotional weight of the concept came from splitting your soul, lessening your essence as you hedge against danger. Partial backups follow the spirit of the idea better since they allow for more flexible recovery options.
sources reviewed · Shamir 1979 — How to Share a Secret · Ente — a visual explanation · Evervault — why the finite field matters · Ledger — threshold custody & verifiable sharing · GeeksforGeeks — Lagrange interpolation · BIP-39 — the 24-word checksum wordlist · asecuritysite.com — engine cross-check · Harry Potter Wiki — Horcruxes