Why?

Seed phrases are a convenient way to backup a wallet while maintaining total and secure ownership. They do, however, have their disadvantages. If the seed phrase is lost or stolen, then the funds are at risk of being irremediably taken away. Another overlooked drawback is that planning inheritance would require entrusting the phrase to a third party, which once again places the funds at risk.

There's a straightforward, cryptographically secure way to solve those issues: "secret splitting". A 2-of-3 split produces 3 "shares", out of which any 2 can be used to recover the seed phrase. Each share can be stored in a separate location, and no single share can be used to guess anything about the seed phrase. Inheritance can be executed more securely, for instance by handing one share directly to an heir, and leaving another as part of a will.

Components

Steps Overview

1. Name the group of shares on the worksheet.
2. Write the seed phrase on the worksheet.
3. Generate a random share A using the tiles.
4. Generate the checksums for the seed phrase and for share A using the wheel.
5. Derive shares B and C using the wheel.
6. Verify the checksums for shares B and C using the wheel.
7. For first time users, recover the first seed word from shares B and C to verify that the result is correct.

Naming the Group of Shares

Each share has a "Group:" area for that purpose. Write the brand and the model of the wallet securing the seed phrase, and the date of creation of the shares (i.e.: "Brand Model MM/DD"). This will serve as a unique identifier for this particular group of shares. This can also serve as a recovery hint: despite seed phrases being a standard, there might be compatibility quirks that can be avoided by sticking to the same wallet model.

Writing the Seed Phrase

Write the seed phrase in the "Secret"" section of the worksheet, ensuring only the gray fields are used and the numbering of words is preserved. If a word is more than 4 characters long, write only write the first 4 characters. If a word is only 3 characters long, use a "-" (dash) as the final character.

Generating a Random Share A

Tiles are a fast and reliable way to generate randomness if they are well-shuffled. The wash shuffle is similar to how children shuffle, i.e. by spreading the cards with both hands and mixing them arbitrarily. This is considered one of the most efficient ways to shuffle, and will ensure the security of the seed phrase. Note that this way of shuffling works best on a fabric surface.

1. Remove the 6 tiles pictogram tiles, that will not be used here. There should be 2 tiles for each of the 29 characters, for a total of 58.
2. Wash-shuffle the tiles thoroughly.
3. Pick up a tile randomly.
4. Copy its character into the share A's gray field.
5. Put the tile back and repeat from step 2 until all share A's gray boxes are filled.

Generating the Checksums

Checksumming is essential for detecting and correcting any mistake that could happen during the phrase splitting process. It guarantees the soundness of the final result. To checksum the seed phrase, use the wheel as follows:

1. Skip the first checksum character (we will identify this in step 7).
2. Place the wheel pointer over the first character of the seed phrase.
3. Find the second character of the seed phrase on the outer row.
4. The corresponding inner-row character is the second character of the checksum. Write that character in the white box under the second seed phrase character.
5. Now place the wheel pointer over the second character of the seed phrase.
6. Find and write the third character of the checksum, located under the third character of the seed phrase.
7. Continue until you reach the last character. Finally, place the last seed character under the pointer and look under the first character of the seed phrase for the first checksum character that was skipped.

Generate the checksum for the share A by following the same process.

Deriving More Shares

This is the most demanding part of the process; it is advised that the user take a pause if they are beginning to lose focus. Deriving shares is done through a similar process to checksumming, but with a twist:

1. Place the pointer on the first character of the seed phrase.
2. Find the first character of share A on the outer row.
3. Write the inner-row corresponding character as the first character of share B.
4. Without moving the wheel, locate that first character of share B on the outer row.
5. Write the inner-row corresponding character as the first character of share C.
6. Repeat this process for each character until for both the gray and white fields are filled.

Verifying the Checksums

When deriving shares, the derived checksums will be correct unless there was a mistake. Compute the checksums for shares B and C by following the process explained in "Generate the Checksums", and compare the results with the derived values. Each time the results differ, circle the 3 characters involved in the operation.

If mistakes were found, correct them as follow:

1. Redo the checksum for that group of characters on the secret section.
2. Redo the checksum for that group of characters on the share A.
3. Derive the 3 characters again.
4. Verify that this results in a correct checksum.

Recovering the First Word

A successful checksum verification is normally enough to guarantee that all the shares are error-free. However, if this is your first time following this process, it is recommended to recover the first seed word to ensure that all the steps were followed correctly. This is also a way to verify for yourself that this method is sound.

To do this, follow the steps described in Recovering the Seed Phrase at the end of this guide, recovering the first word from shares B and C.

Storing the Shares

The "Secret" part of the worksheet can now be destroyed, as well as the original secret data. The other shares should be rewritten over using permanent ink. The shares must be kept separately, and no two shares must be accessible to anyone other than the wallet owner. Below is an example of secure share distribution:

• Share A goes to the heir / trusted person.
• Share B is stored using a private and encrypted cloud storage (or email draft).
• Share C is stored physically in a safe or another secure storage that can be passed on or willed to the inheritor.
• If share C is not readily accessible, the wallet owner can keep their own copy of share A to aid the recovery process.

This redistribution ensures that the wallet owner can perform on-site recovery without relying on the trusted person. Off-site recovery is also possible by comyining the trusted person's share with the share stored online. It is paramount that the trusted person shouldn't be able to easily access shares B or C outside of the inheritance process, and that any shares other than B remain fully offline.

It is advised to use water-proof containers such as stainless steel pill bottles to protect physically-stored shares against damages. If one of the share gets damaged, then the seed phrase can be recovered from the other 2 shares, and the damaged share can be derived again. If a share is lost or compromised, if the trusted person is no longer trusted, or if inheritance must be revoked, a new split followed by the destruction of the old shares will make the last remaining share useless.

Recovering the Seed Phrase

To recover the seed phrase, pick two shares that belong to the same group. Using the table below, identify which one should be the outer share and which one the inner share. Take note of the solving window for these shares.

Print a worksheet to write the seed phrase, then follow these steps:

1. On the outer row of the wheel, find the first character of the outer share.
2. On the inner row of the wheel, find the first character of the inner share.
3. Turn the wheel so that both character align.
4. Read the first character of the seed phrase from the indicated solving window.
5. Write it on the worksheet in the correct position.
6. Repeat from step 1 with the following characters until you have recovered the complete phrase.

For error checking, recover and verify the checksum. If errors are found, solve them as indicated previously in Verifying the Checksums.