Shamir Secret Sharing Calculator

How it is calculated

The secret S becomes the constant term of a polynomial of degree k−1: f(x) = S + a1x + … + ak−1xk−1 (mod p). Share number i is the pair (i, f(i)), for i = 1 … n, and any k shares determine the polynomial and so recover S = f(0). Here p is the prime modulus, and the secret must be a whole number from 0 up to p−1.

Unlike a real implementation, the coefficients are not random: each a_i is computed from a CRC-32 checksum of the text “seed#i” taken mod p, so the same inputs and seed always give the same shares. This makes the output repeatable, which suits learning and checking by hand, but it is not secure. All numbers must be whole and no larger than about 3 billion. The threshold must be at least 2 and no larger than the share count, the share count must be between 1 and 1,000 and smaller than p, and p must be prime. Any input that breaks these rules shows no result.

Common mistakes

• Using the shares as a real secret split. The coefficients come from a public checksum of the seed, so anyone who knows the seed (the default is “demo”) can rebuild the polynomial and even one share would then reveal the secret. Use it to learn the method only.
• Choosing a modulus that is not prime, such as 7920. The tool rejects it, because division in the recovery step needs a prime field.
• Entering a secret equal to or larger than the modulus. The secret must be below p, so a 4-digit secret needs a prime above 9999.
• Making the share count as large as the modulus. Shares are numbered 1 … n and those numbers must be distinct non-zero residues mod p, so n has to be smaller than p; with p = 7, asking for 7 shares shows no result.
• Setting the threshold to 1 or above the number of shares. Thresholds below 2 give no result, and a threshold above n could never be met.