Shamir Backup — formally SLIP-39, Satoshi Labs Improvement Proposal 39 — splits a single seed into N shares such that any T of the N (for example, 2 of 3, or 3 of 5) reconstruct the seed. Lose any single share and the seed is still recoverable; compromise any single share and the seed is still safe. Implemented natively on Trezor Safe 3 and Safe 5; also supported via Trezor Suite on older Trezor models.
The cryptographic basis
Shamir's Secret Sharing, designed by Adi Shamir in 1979, is a 47-year-old cryptographic primitive. The math: encode the secret as the constant term of a polynomial of degree T-1, sample N points on the polynomial, distribute the points. T points are sufficient to reconstruct the polynomial — and therefore the constant term, the secret. Fewer than T points reveal literally nothing about the secret.
SLIP-39 packages this with a wordlist (different from the BIP-39 wordlist, optimized for the SLIP-39 use case), checksum bits, and group structure that allows hierarchical splits (for example, 3-of-5 where two groups of holders each need internal threshold approval).
Why this matters in practice
Shamir Backup solves two distinct problems that single-seed backups cannot:
First, geographic redundancy without compromise. With a 2-of-3 split, you can leave one share at home, one at a parent's house, one in a bank safe-deposit box. Any single location can burn down without losing the seed. No single location holds the seed — so a burglar at any single location gets nothing.
Second, inheritance planning without exposing the seed in life. The executor of an estate can be given one share (with instructions on where to find the second after death) while the third stays with the holder. The estate plan works without the holder ever having to write down the full seed for someone else to read.
Shamir vs multisig
Shamir splits a single seed; multisig uses multiple independent seeds. The practical difference: Shamir requires reconstruction in one place (a brief window of vulnerability when the seed exists on a single device), multisig never reconstructs (signatures are combined, the keys themselves are never assembled). For a US holder under $250K, Shamir is simpler and good enough. Above that, multisig's stronger non-reconstruction property becomes worth the complexity.
Common mistakes
Storing two shares in the same location defeats the geographic-redundancy goal. Storing shares with the wallet brand name visible defeats opsec. Forgetting which T you used to split (was it 2-of-3 or 3-of-5?) makes reconstruction guess-and-check. Write the threshold on each share, clearly: "2/3 — Trezor SLIP-39 — Hodler's Handbook setup, May 2026."
Further reading: Multisig, Mnemonic, Five ways to store a seed phrase.