# Shamir Secret Sharing

> Split a secret into n shares so any k recover it, and combine shares, locally. Splits a secret (recovery code, password, key) into n shares with a threshold k using Shamir's scheme over GF(256): any k shares reconstruct it, fewer reveal nothing. Combines and verifies shares with an optional checksum. With JavaScript on, splitting and combining happen in your browser.

Part of usefulweb.site (https://usefulweb.site/). Results are deterministic calculations from the inputs and the listed assumptions; the API returns exactly what the web page shows.

## Use it
- Human interface: https://shamirsecretsharing.usefulweb.site/ (interactive tool at https://shamirsecretsharing.usefulweb.site/tool)
- JSON API: POST https://shamirsecretsharing.usefulweb.site/api/v1/calculate with a JSON object of inputs (schema: https://shamirsecretsharing.usefulweb.site/api/v1/tool)
- OpenAPI: https://shamirsecretsharing.usefulweb.site/openapi.json
- MCP (Streamable HTTP): https://shamirsecretsharing.usefulweb.site/mcp - tool `shamir_secret_sharing`

## Inputs
- action (select): Action
- secret (textarea): Secret (split) - Text up to 10,000 characters (UTF-8).
- shares (integer): Number of shares (n)
- threshold (integer): Threshold (k shares needed) - Split: any k shares recover the secret. Combine: used to check extra shares for consistency.
- format (select): Share format
- checksum (boolean): Add a 4-byte SHA-256 checksum so wrong or too few shares are detected
- sharesInput (textarea): Shares (combine), one per line
- seed (text): Demo seed (optional, reproducible — never for real secrets) - Split only. With a seed the shares are predictable; leave empty for real use.

## Method
- Each byte of the secret is the constant term of its own random polynomial of degree k−1 over GF(2^8) (field polynomial x^8+x^4+x^3+x+1, as in AES). Share i holds the value of every polynomial at x = i (i = 1…n), so a share is as long as the secret.
- Combining uses Lagrange interpolation at x = 0. Any k shares give the secret; with k−1 or fewer, every possible secret is equally consistent with the shares (information-theoretic security).
- Optional checksum: the first 4 bytes of SHA-256(secret) are appended before splitting. After combining, a wrong share or too few shares are detected with probability 1 − 2^−32.
- Shares are written as "<index>-<data>" in hex or Base64. The format is not interchangeable with other tools (e.g. ssss-split, which uses a larger field).
- With JavaScript on, the page splits and combines in your browser with crypto.getRandomValues; the secret is not sent to the server. Without JavaScript or via the API the server does it with Node.js crypto and does not store anything.

## Limits
- Store shares in different places and test recovery before relying on them. Anyone holding k shares can recover the secret.