A practical guide to Split-Key secret sharing
Threshold sharing divides access across distinct participant fragments so one fragment is insufficient. It can reduce reliance on one holder, but link delivery, viewer devices, recovery planning, and post-reconstruction handling still matter.
By Strumio Editorial Team · Published August 28, 2026 · Updated August 28, 2026
Understand what is split and what Strumio coordinates
The sender's browser creates an AES-256-GCM key, encrypts the payload, and applies Shamir's Secret Sharing to produce fragments. Creation supports examples such as 2-of-3 and 3-of-5. A single fragment is insufficient; an authorized viewer reconstructs the key in the browser after enough distinct contributions arrive.
Strumio stores encrypted payload and operational records needed to deliver participant contributions and coordinate the flow. Complete participant and viewer links remain sensitive capabilities. Browser-side cryptography reduces plaintext exposure to the service but does not mean that metadata, availability, endpoints, or every surrounding action disappears.
Choose holders and a threshold for the real failure model
A 2-of-3 plan tolerates one unavailable fragment but lets any two holders collaborate. A 3-of-5 plan tolerates two unavailable fragments and requires broader participation. More holders create more delivery and device surfaces, while a high threshold raises the chance that illness, travel, staff turnover, or loss blocks recovery.
Choose people with independent availability and appropriate authority. Avoid placing every link in the same inbox, shared drive, device, or administrator account because one compromise or outage could defeat the intended separation. Document roles and escalation without recording complete links in the procedure.
Deliver distinct participant links carefully
Verify each intended holder through a known method and send only that person's complete participant link. Separate channels can reduce common-mode compromise when they are genuinely independent. A forwarded link can transfer a participant capability, and a display label by itself does not establish identity.
Ask holders not to paste links into tickets, public chat, shared notes, link shorteners, or analytics systems. QR codes and printed copies need physical protection. If a participant link is disclosed or assigned to the wrong person, do not assume a threshold alone makes the plan safe; replace the secret and create a fresh distribution.
Protect reconstruction and plaintext after access
The authorized viewer reconstructs the key in the browser when the threshold is met. That browser, device, screen, clipboard, extensions, and surrounding environment become part of the trusted path. Use a managed, updated endpoint and stop screen sharing, recording, remote access, and synchronization that could capture plaintext.
Threshold control determines when enough fragments permit access. It cannot stop the viewer from copying, photographing, printing, or redistributing the reconstructed secret. For recovery codes, API keys, and administrator credentials, rotate after emergency use and monitor the underlying account rather than relying on the Split-Key item as continuing control.
Test availability and retain an independent recovery plan
Practice the process with non-production data so holders understand contributions, absence handling, and authorized viewing. Review assignments after staff changes and confirm that enough usable fragments remain. If the threshold cannot be met, Strumio cannot recreate missing fragments or decrypt the payload.
Split-Key sharing complements but does not replace hardware-backed credentials, individual administrator accounts, audited approval systems, credential rotation, offline backups, or incident response. Use it for a focused threshold handoff whose security and availability tradeoffs have been explicitly accepted.
Related guidance
When an encrypted delivery link is appropriate, Create a free Strumio account.