VEYRNOX

← Back to VEYRNOX

VEYRNOX · SLIP-39

SLIP-39: Shamir backup for crypto wallets, explained

TL;DR. SLIP-39 is SatoshiLabs' 2017 specification that turns Adi Shamir's 1979 Secret Sharing scheme into a portable, interoperable wallet backup format. Instead of one 12-word BIP-39 phrase you must protect forever, SLIP-39 gives you m-of-n shards: 2-of-3, 3-of-5, or nested groups. Any threshold of shards restores the wallet; fewer reveal nothing. Trezor Model T / Safe 3 / Safe 5, Keystone, and VEYRNOX ship SLIP-39 today.

What SLIP-39 actually is

SLIP-39 is SatoshiLabs Improvement Proposal 39, published December 2017. It defines how to turn a cryptographic secret into a set of human-transcribable mnemonic shards using Adi Shamir's 1979 Secret Sharing scheme, extended with three practical additions that raw Shamir does not have:

The threshold math

Shamir Secret Sharing represents your secret as the constant term of a random polynomial of degree t−1 over a finite field. Each shard is one evaluation of that polynomial at a distinct point. Any t shards uniquely determine the polynomial (and therefore the secret) via Lagrange interpolation; t−1 or fewer shards are consistent with every possible secret, so the leakage is exactly zero, not just computationally hard.

SLIP-39 fixes the field to GF(256), the polynomial degree to t−1, and the shard count to at most 16 per group and 16 groups per wallet. Typical configurations: 2-of-3 for individuals, 3-of-5 for households, or 2-of-3 groups where each group is 2-of-3 for family-plus-executor recovery.

Concrete consequence: with a 2-of-3 split across device, personal cloud, and a paper backup in a safe, an attacker who steals any one shard learns nothing about the wallet. A fire that destroys the paper leaves the wallet recoverable from device + cloud. A phone loss leaves it recoverable from cloud + paper. There is no single artifact whose theft or loss ends the wallet.

The 1024-word wordlist, in one paragraph

SLIP-39 uses exactly 1024 English words (210), each 4-8 letters long, each unique in its first 4 letters, and disjoint from the BIP-39 list to prevent user confusion. Each shard is encoded as 20 or 33 words: the first 15 words carry metadata (identifier, iteration exponent, group index, group threshold, member index, member threshold), the middle words carry the payload, and the last 3 words are the RS1024 checksum. A single-word transcription typo is always detected; a two-word typo is detected with probability > 99.9999%.

Group-of-groups: the feature no other backup format has

The Trezor Model T configurator lets you build recovery policies like: "Any 2 of 3 groups, where Group 1 (me + spouse) needs both members, Group 2 (three kids) needs any two, and Group 3 (family lawyer + brother) needs both." That policy is expressible in exactly one BIP: SLIP-39.

Group-of-groups lets you write recovery instructions your family can actually follow after your death. Executors can produce the lawyer's shard, kids can vote, spouse can hold veto power, and no single person on the tree can drain the wallet. This is a specific answer to the documented "lost keys on inheritance" failure mode that has cost families billions in inaccessible crypto.

SLIP-39 vs BIP-39, side by side

Real-world tradeoffs

Why SLIP-39 has not replaced BIP-39 everywhere. BIP-39 was published in 2013; SLIP-39 in 2017. Every existing wallet, exchange, and custody service already speaks BIP-39. SLIP-39 requires wallet-side code, a UI for shard assembly, and user education. Most wallet teams cannot justify the engineering cost when the perceived risk is "user loses their seed phrase" (which BIP-39 already documents as user error, not their problem).

Why SLIP-39 is right for a coercion-first threat model. If you are worried about physical coercion, kidnapping, or phishing that captures the whole seed, SLIP-39 is a strictly better primitive. The single point of catastrophic failure that BIP-39 encodes is the attack surface those attacks exploit.

The compatibility trap. A SLIP-39 wallet cannot be recovered from BIP-39 shards, and vice versa. If you decide to switch, you have to send funds to a new address controlled by the new wallet. There is no lossless format migration.

How VEYRNOX uses SLIP-39

VEYRNOX is a mobile-native SLIP-39 wallet. Rather than have you write down 33 words per shard by hand, VEYRNOX splits the recovery secret into a 2-of-3 SLIP-39 configuration across three locations you control:

VEYRNOX holds zero shards. We cannot sign for you, cannot recover your wallet for you, and cannot be legally compelled to. It is still self-custody by construction.

When SLIP-39 is not the right answer

Learn more

Download VEYRNOX →