Di-kairos/seedsplit

📦 Moved: development continues in the paranoid-tools monorepo (seedsplit/ directory, full history preserved). This repository is archived: its published releases stay downloadable and the installers keep working, but new issues, PRs and releases happen in the monorepo.

English · Русский

seedsplit

Split a secret across shares with Shamir Secret Sharing — no "unbreakable" snake oil.

Part of the Paranoid Tools ecosystem.

Why

Split a seed phrase, password or key into N shares so that any T of them reconstruct the secret, while T-1 shares reveal nothing about it. That way no single medium or backup is a single point of failure or compromise: lose one sheet and the secret survives; find one sheet and you learn nothing.

Install

The installer targets macOS, but the tool itself does not: split, combine and verify are arithmetic over POSIX utilities (od, tr, printf) with no macOS-specific calls, so the script runs on Linux too — clone it and run bash seedsplit. The Windows port has never had a platform gate either. (The rest of the Paranoid Tools suite genuinely needs macOS — it drives hdiutil, fdesetup and friends.)

The installer pulls the binary and SHA256SUMS from the release tag (not from a moving main branch) and verifies the checksum before installing — it fails closed on any mismatch.

Verify-then-run (don't trust, verify)

Piping any script into a shell means running code you haven't read. Prefer this — download, check the checksum, read it, then run:

base=https://github.com/Di-kairos/seedsplit/releases/latest/download
curl -fsSLO "$base/install.sh"
curl -fsSLO "$base/SHA256SUMS"
curl -fsSLO "$base/SHA256SUMS.sig"
printf '%s\n' 'releases@paranoid-tools namespaces="file" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICb2nz4EliRJIU0ExeF41klE/zlyo7XFY119mfzscn2U' > allowed_signers
ssh-keygen -Y verify -f allowed_signers -I releases@paranoid-tools -n file -s SHA256SUMS.sig < SHA256SUMS &&   # authenticity: Ed25519, pinned key
shasum -a 256 -c SHA256SUMS --ignore-missing &&   # integrity: verifies install.sh
less install.sh &&                               # read it — then run:
bash install.sh

One-line install via curl

curl -fsSL https://github.com/Di-kairos/seedsplit/releases/latest/download/install.sh | bash

Integrity vs authenticity (honest scope). The checksum proves the downloaded binary matches the SHA256SUMS published in the same release — it catches corruption, partial/cached tampering, and stops you running code off the moving main branch. Authenticity comes from the Ed25519 signature over SHA256SUMS: the snippet above and install.sh both verify it against a key pinned in this repo, and the installer fails closed when it can't (see SECURITY.md). Residual risk: one project key signs all five tools — see the ecosystem threat model. Pin a specific version with SEEDSPLITVERSION=0.5.5 instead of latest for reproducibility. Override the source with SEEDSPLITBASEURL and the install path with SEEDSPLITDEST.

Language

Output is English by default. For Russian, set STLANG=ru (the tool also honors a Russian system locale automatically).