Threshold Vault

i · Architecture

Where the work happens.

Three columns. The first is what your browser does. The second is what our server does. The third is what never leaves your device under any circumstance.

Browser

secret_input
shamir_split
shard_generation
pdf_render
qr_render
recovery
memory_clear

Server

static_html
static_css
static_js
fonts
icons
(nothing else)
no logging, no analytics

Never transmitted

secret shards reconstructed_secret holder_labels

ii · Guarantees

What we commit to.

Eight properties of the protocol. Each is testable, by reading the source, watching network traffic, or running the tool offline.

Browser-only processing

All cryptographic work runs in your browser. No remote computation.

No server-side storage

Our server holds the static app files. It does not see your data.

No account required

No email, no login, no profile. The tool is anonymous by design.

Open-source code

Every line is on GitHub. Cloneable, auditable, runnable offline.

M-of-N key recovery

Threshold Vault encrypts the secret locally, then splits the encryption key using Shamir's Secret Sharing.

Sub-threshold cannot recover

Fewer than M cards cannot reconstruct the encryption key. The cards still show metadata by design.

Offline-capable

Once loaded, the app works without internet. Cache it, run it later.

Clear local session

One button removes everything. Browser memory is the only memory.

iii · Quantum

What we can honestly say about quantum risk.

The split/recover path avoids public-key assumptions.

Threshold Vault encrypts your secret locally with AES-256-GCM, then splits the encryption key with Shamir's Secret Sharing over GF(256). Neither step uses RSA, elliptic curves, or any assumption that a quantum computer breaks.

Shamir's portion is information-theoretically secure, sub-threshold cards reveal nothing regardless of compute power. AES-256 has no known efficient quantum attack.

Precise claim: the core split/recover path does not rely on public-key cryptography or blockchain signing. We do not claim the product is quantum-proof overall, that would overstate what the mathematics can certify.

Encryption

AES-256-GCM

Symmetric cipher. No known quantum attack reduces it below 128-bit security. Tamper-detecting via GCM authentication tag.

Key splitting

Shamir over GF(256)

Information-theoretically secure. Sub-threshold cards reveal zero bits about the key, not even with unlimited compute.

No exposure

No public-key crypto

No RSA, no elliptic curves, no Diffie-Hellman. Nothing Shor's algorithm attacks in the split or recover path.

iv · Mathematics

How 3 of 5 works.

A polynomial of degree M − 1 has exactly M coefficients. The secret is one of them. The shards are points the polynomial passes through.

            # the secret is the constant term
            secret = f(0)
             
            # pick a random degree-2 polynomial
            f(x) = secret + a1x + a2x2
             
            # 5 shards = 5 points on the curve
            shards = f(1), f(2), f(3), f(4), f(5)
             
            # any 3 points determine f, hence f(0)
            recover = any 3 points → f(0)
             
            # 2 points fit infinite parabolas
            2 points → unbounded ambiguity
          

In a 3-of-5 setup, two shards are not almost enough.
Infinitely many polynomials pass through any two points.

v · Threat model

What we protect, what we don't.

Threshold custody solves one specific problem: the single point of failure. It is not a substitute for general operational security. We are explicit about both sides.

Protected against

Things the threshold scheme defeats by design.

One lost shard.
One stolen shard.
One compromised holder.
One house fire or local theft.
Eternalink-style company shutdown.
Single-point custody failure.
One person having unilateral recovery power.

Not protected against

Risks outside the cryptographic guarantee.

Malware on the splitting or recovery device.
A spoofed Threshold Vault website (phishing).
Browser extensions reading input fields.
Printer memory retaining print jobs.
Screenshots or cloud-synced clipboards.
Storing all shards in one location.
Losing too many shards to meet the threshold.
Mistyping the original secret before splitting.

vi · Best practices

Eight rules for real deployments.

The cryptography only protects what the procedure preserves. These rules close the gaps the math cannot.

Test first with a dummy secret. Verify the recovery before splitting anything you cannot afford to lose.
Use offline mode for high-value secrets. Disconnect from the internet after the page has loaded.
Store shards in different physical locations. The threshold protection assumes physical separation.
Do not photograph all shards together. One image with five shards defeats five-point distribution.
Do not email all shards to yourself. Email is one location, no matter how many addresses you use.
Use a trusted printer or write shards by hand. Office printers commonly retain print jobs in memory.
Keep recovery instructions with each shard. Holders should know how to use what they hold.
Tell trusted holders what their shard is for. Silent shards are often discarded as junk.

vii · Open source

Trust the code, not the company.

The product is the source code. This domain, our copy, our brand are all auxiliary to the math. If we vanish tomorrow, your shards still recover.

The repository & its guarantees.

Six artifacts published alongside the code. Each is independently verifiable.

Repository github.com/threshold-vault/shards-core Public · MIT

License MIT Permissive · forkable

Security policy SECURITY.md Disclosure · 90 days

Build instructions Reproducible SHA-256 verified

Test vectors 51 vectors · all pass Self-test: 100% pass

Run it yourself · 7 steps

~ 4 minutes

01 $ git clone github.com/threshold-vault/shards-core
02 $ cd shards && npm install
03 $ npm test # 51 vectors, ~30s
04 $ npm run build # reproducible build
05 $ ifconfig wlan0 down # go offline
06 $ open dist/index.html
07 → split or recover, fully offline.

View on GitHub → Read the threat model Download offline package

viii · FAQ

Questions we get.

No. Threshold Vault never receives or stores your secret or shards. Recovery requires possession of M of the N shards you generated. If those are lost below the threshold, the secret cannot be recovered by us or anyone.

The secret cannot be recovered. The same property that keeps fewer-than-threshold cards from reconstructing the encryption key also means M − 1 cards cannot recover the secret for you. The privacy guarantee cuts both ways.

Not unless they collude with enough other holders to meet the threshold. A single shard card cannot reconstruct the encryption key or reveal the protected secret on its own. It does still show metadata by design, because the holder needs to know what they are storing.

No. It works for any short secret: BIP-39 seed phrases, Ethereum private keys, password manager master passwords, recovery codes, encryption keys, or arbitrary text up to 4 KB.

It is different. Multisig controls signing: multiple parties cooperate to authorize each transaction. Threshold Vault protects backup and recovery secrets: multiple parties cooperate to reconstruct a key that may then be used however the owner intended. They are complementary, not substitutes.

Yes, and we recommend it for high-value secrets. Load the page once, disconnect from the internet, then split or recover. The codebase can also be cloned and run locally, see the verification steps above.

Each shard card includes recovery instructions pointing to thresholdvault.com/recover and the offline recovery tools included in the archive. Threshold Vault encrypts the secret locally with AES-256-GCM, then splits the encryption key using standard Shamir Secret Sharing over GF(256). If this domain ever becomes unavailable, the open-source recovery tools shipped in your archive are sufficient, no network connection is required.

Security without custody.