Digital delivery · Legacy assembled in Orlando

A system, not just software.

The cryptography is free and runs in your browser. Personal and Guardian deliver a complete digital archive you download immediately. Legacy ships physical kits, assembled individually in Orlando, within two weeks. Three tiers, one promise: we hold zero of your secrets.

i
Delivery
Digital: immediate download
Legacy physical: within two weeks
ii
Format
Digital archive
Legacy adds physical kits, Orlando
iii
Refunds
Before dispatch
Full refund before a Legacy kit ships
iv
Custody
Always yours
We ship materials, not secrets
iWhat every tier installs

The same cryptography, every tier.

Every tier sets up the same real threshold cryptography. What changes is how much of the human system around it we build for you, and whether we make it physical.

Browser-side splitting

Your secret is encrypted with AES-256-GCM and the key is split with Shamir's Secret Sharing, entirely on your device. We see nothing. The split happens before the archive is generated.

Every tier · Personal · Guardian · Legacy
Bearer's Reference

Your own master record: ceremony ID, scheme parameters, holder names and shard fingerprints. Not for distribution. Lives with your will or trust documents so your estate knows the scheme exists and where to begin.

Every tier · Personal · Guardian · Legacy
Offline Recovery Manual

Reconstruction without our website, without internet, written for heirs with no technical background. Includes step-by-step instructions for reconstruction by hand if every digital tool fails.

Every tier · Personal · Guardian · Legacy
Offline tools + CLI

A self-contained HTML recovery tool and a Node.js command-line tool, both bundled in the archive, both run with no network connection, both implement the same AES-256-GCM + Shamir algorithm that split the secret.

Every tier · Personal · Guardian · Legacy
iiThree tiers

Start free. Choose how much of the system we build for you.

All three tiers use the same cryptography. They differ in how much of the human system around the cryptography we install, and, for Legacy, whether we make it physical.

Try it
Practice mode · 2-of-3 demo.
$Free
Practice mode · 2-of-3 demo
  • Real Shamir cryptography (same as paid tiers)
  • Locked 2-of-3 scheme for learning
  • No downloads, no print, no QR
  • Exists on screen only
  • Open-source verifiable core
Try it now
Personal
For one person protecting one important backup, alone.
$39
One-time · digital · no shipping
  • Up to 5 printable shard cards
  • Offline Recovery Manual
  • Bearer's Reference card
  • Holder briefing + letter template
  • Browser-side splitting · we see nothing
  • Open-source verifiable core
Start with Personal
Legacy
For inheritance ceremonies and high-stakes recovery plans.
$899
One-time · physical kits · two weeks fulfillment
  • Every Guardian document, for owner and each holder
  • Physical kits: archival shard cards, tamper-evident envelopes, wax seal and sigil, presentation case
  • Sixty-minute live setup call
  • Thirty days of priority support
Commission a Legacy kit
Dead-Man Switch

The Dead-Man Switch, a separate product.

Self-hosted on your own infrastructure: if you stop checking in, it delivers a message you wrote to people you chose. Choose how much we help: run it yourself, have us build it, or let us watch it.

Self-Hosted Kit
The same switch, with a guide that walks you through every step.
$39
One-time
  • You host it yourself and hold your own keys
  • A step-by-step illustrated guide
  • The packaged release
  • A walkthrough for verifying the signed build
  • Setting up your sending domain
  • For doing it yourself, without guessing
  • We don't keep your email after delivery
You host it; you hold the keys. We just make the setup painless.
Get the kit
Managed Hosting
Don't touch a thing. We build it and hand you a working switch.
$300
One-time. Setup and 30 days of email support
  • We deploy your switch
  • We configure and verify your sending domain
  • We test the whole chain end to end
  • A finished switch with a simple check-in page
  • 30 days of email support for setup & deployment questions
  • One-time setup, no recurring fee for the switch
  • It then runs on infrastructure you own
  • We delete your email after the 30-day support window
  • Pairs well with Monitoring
One-time setup with 30 days of support. The switch then runs on infrastructure you own.
Get set up
Switch Monitoring
We watch your dead-man switch and tell you if it goes quiet.
$36
Per year · recurring
  • A weekly health check on your switch
  • If it stops responding, drifts off schedule, or fires, we email you
  • We never hold your secret, recipients, or keys
  • Only a read-only liveness check
  • Cancel anytime
  • Your switch is never affected
  • We delete your email on cancellation
Monitoring is a safety net, not custody. Your switch keeps working whether or not you subscribe.
Start monitoring

Comfortable with the command line? The switch is open source. Verify it or build it yourself on GitHub.

ii A closer look · the human protocol $179 · one-time

What makes Guardian different.

Guardian is the tier most people choose, because it is where the scheme stops being a pile of cards and becomes a system the people around you can actually run. The cryptography is the easy part. The hard part is the moment, years from now, when someone contacts a holder with a convincing story and a deadline. Guardian is the set of documents that prepares each holder for exactly that moment, before it happens, in calm conditions, in writing.

i
The safe word and pause wordA shared signal that a request is genuine, and a way for any holder to halt everything without explanation.
ii
The five rulesDo nothing immediately. Two channels or no movement. Never act alone. Never transmit your shard. When in doubt, pause.
iii
Pressure-Situation PlaybookWhat a holder does when the protocol is tested, and the urgency is the warning sign.
iv
Extortion Response ProtocolHow the group acts together when someone is threatened, and an honest account of what paper can and cannot protect.
v
Holder AgreementA signed understanding, PDF and editable Word, so every holder knows the weight of what they accepted.
vi
Recovery Trigger ChecklistThe conditions under which recovery is allowed, agreed in advance, so no one has to improvise under pressure.
Best for: real schemes with multiple holders who are not crypto experts

Guardian installs a protocol into the people who hold the secret, not just a card in their drawer. If you are protecting something that matters and want the holders to know what to do when it matters, this is the tier.

iii A closer look · Legacy $899 · one-time

When the scheme deserves a ceremony.

Legacy is the same protocol as Guardian, made physical and set up with you. The documents are identical; what you are paying for is the time we spend, and the materials that make holders treat the scheme with the gravity it deserves.

The sixty-minute live setup call is where the cryptographic split actually happens. You perform it on your own device while we walk through the procedure with you in real time. We see nothing. The call ends; the scheme exists.

i
Every Guardian documentThe complete digital archive, all owner and holder protocol documents, identical to Guardian.
ii
Archival shard cardsCotton-rag, acid-free, fifty-year archival stock. Each card carries a single shard in printed form.
iii
Tamper-evident envelopesOne per shard. Sealed perimeter, signature paper, holographic strip. Any attempt to open leaves visible evidence.
iv
Wax seal and sigil stampWax stick, brass stamp, matches. Traditional tamper-evidence that survives temperatures paper does not.
v
Presentation caseA linen-covered case that holds the full kit. A physical signal that the materials inside are serious.
vi
Sixty-minute live setup callA real person walks you through the entire split in real time, on your own device. We still see nothing.
vii
Thirty days of priority supportContinued access to a real person for the first month after dispatch.
Best for: generational inheritance and high-value secrets, done once, properly

Legacy is for someone who wants to do this once, properly, with help. The cryptography is identical to Guardian. What changes is the gravity of the objects, and the time we put in to set it up with you.

ivMaterials

Made to outlive a filing cabinet.

These physical materials ship with Legacy only. Every component is chosen to be archival, tamper-evident, and obviously serious, so holders treat the materials with the gravity they deserve.

Legacy · Cotton-rag stock
Archival shard cards

100% cotton, acid-free, lignin-free. Designed for fifty-year archival use. Each card carries a single shard in the Threshold Vault compact recovery format, with reconstruction guidance and a QR code on the back.

Legacy only
Tamper-evident envelopes

Signature paper with a sealed perimeter and a holographic strip. Any attempt to open the envelope leaves visible evidence. Holders can verify their shard has not been examined.

Legacy only
Wax seal & sigil stamp

A traditional sealing wax in deep oxblood with a brass sigil stamp. Not for show: wax is the cheapest, most reliable physical tamper-evidence ever invented, and it survives temperatures paper does not.

vFrequently asked

Before you buy.

Your scheme keeps working. The offline recovery manual in your kit explains reconstruction using our website, the Threshold Vault offline recovery tool (included in your archive), or Lagrange interpolation by hand. The trust model is not "Threshold Vault stays in business forever." The trust model is that the mathematics is permanent, the open-source tools are permanent, and your printed materials are designed to outlive us.
Personal and Guardian are digital archives, you download them immediately after payment, no shipping involved. Legacy physical kits are assembled by hand in Orlando and dispatch within two weeks of order confirmation. US transit is 3–5 business days standard; international is 7–14 business days depending on customs. Tracking is sent on dispatch.
No. The setup booklet walks you through generation in plain language, and the recovery manual is written for heirs who may have no technical background. If you're protecting a seed phrase you obviously have some familiarity with crypto, your spouse, child, or lawyer doesn't need any. That's part of the point.
Your scheme tolerates lost holders up to N minus M. In a 3-of-5 scheme, you can lose two holders entirely and still recover. If a holder becomes unavailable, you can redistribute, generate a new set of shards from the original secret and reassign. The Recovery Manual includes the procedure; Guardian and Legacy tiers include a written Lost-Holder Replacement Plan matched to your scheme.
Yes. Photographs of the Guardian and Legacy materials are coming to this page shortly. In the meantime, the full kit contents are itemised in the tier cards above, and the materials section describes what each component is made of.
No. Threshold Vault is a cryptographic tool, not a legal service. For matters involving inheritance, estate planning, or tax treatment of digital assets, consult a qualified professional in your jurisdiction. Many customers integrate Threshold Vault into a broader estate plan, but the legal architecture (wills, trusts, powers of attorney) is something a lawyer should build alongside the cryptographic scheme.
A separate product from the shard kits, a check-in timer that emails a message you wrote in advance to people you chose if you stop checking in. Pick Self-Hosted Kit ($39) to deploy it yourself on your own accounts, Managed Hosting ($300) to have us set it up for you, or Monitoring ($36/yr) to have us watch that an existing switch stays healthy. The switch solves a different problem from the shards: when to act, not how to recover.
No, and it can't. We hold zero; that's the whole approach. The switch carries only the message you wrote, the "go act now" signal. Your keys stay in the shards you already handed to your holders. A triggered switch tells your people to begin recovery; it does not, and structurally cannot, hand them the keys. The Self-Hosted Kit is open source so you can verify exactly that.
No. Monitoring is a read-only health check layered on top of a switch that runs on its own, we can see whether yours is reachable, but we can't check in for you, change it, or make it fire. If payment lapses you get a 60-day grace window and the switch keeps running the entire time. Monitoring stopping never touches the switch itself.
Threshold Vault presents

No single point of failure.

The cryptography runs in your browser. The kit arrives by mail. The scheme outlives us, or never depended on us in the first place.