What is a Shamir backup or multi-share backup?

A Shamir backup, which Trezor now calls a multi-share backup, splits a wallet's recovery secret into several separate word lists called shares. You choose how many shares exist and how many are needed to rebuild the wallet, so no single copy is a point of failure.

How does Shamir secret sharing work in crypto?

The method is named after the cryptographer Adi Shamir, who devised the underlying algorithm. Applied to wallets, it turns the master secret, the number every key is built from, into shares so that any threshold number of them can rebuild it.

The SLIP-0039 specification states that holding fewer than the required number of shares leaks no information about the master secret. Trezor gives a 3-of-5 example. Any three shares restore the wallet, while someone holding two learns nothing, and losing two still leaves the wallet recoverable. But if fewer than the threshold survive, the wallet cannot be restored.

This differs from a multisig wallet. Multisig needs several keys to approve each transaction. A Shamir backup protects a single ordinary wallet, and the shares come together only during recovery.

What is SLIP39?

SLIP39 is the open standard behind the format, created in December 2017 by six authors including Pavol Rusnak and Marek Palatinus, two of the authors of BIP39. Its main features are:

• A list of 1,024 words, so each word carries 10 bits.
• Shares of 20 words for a 128-bit secret, or 33 words for a 256-bit secret.
• Up to 16 shares, with an optional second layer of groups, each with its own threshold, so that different holders can be given different levels of trust.
• A checksum in the last three words that is guaranteed to detect mistakes in up to three words.

SLIP39 also supports an optional passphrase. It is mostly incompatible with BIP39, the standard behind 12 and 24-word phrases. The specification says SLIP39 shares cannot be converted back into a BIP39 phrase.

Why is Trezor only 20 words?

Since June 2024, new Trezor Safe models start with a 20-word SLIP39 backup as a single share. Trezor says 20 words give 128-bit security, the same as a 12-word phrase, with the extra words carrying the share details and checksum. Trezor adds that the words are easier to tell apart and typos are caught. The odds of anyone guessing either format are covered in can someone guess your seed phrase.

What is a Trezor multi-share backup?

It is the Shamir option on Trezor devices. Trezor lists support on the Safe 7, Safe 5, Safe 3 and Model T, with 1 to 16 shares. A wallet that began with a newer single 20-word share can be upgraded to multi-share without moving funds, since the accounts stay the same. Trezor notes the old single share stays valid after the upgrade, so it remains a risk until checked and destroyed. Backups made in the older format before June 2024 cannot be upgraded this way.

Trezor says wallets including Sparrow, MetaMask, Rabby and Electrum support SLIP39, which matters when using your seed phrase in another wallet.