A public demo · the whole sitting, screen for screen

Every screen you will see, before you see it.

The wizard below is not drawn, it is replayed. A script drives the real program, build …, through a complete sitting and records what it puts on the console, colours included. Then the objects it leaves behind, and how the halves are placed so your heirs can find them and a thief cannot.

Watch the sitting Print the quick start (PDF)
The full field manual (PDF) ↓

every frame generated from the real program · demonstration values, not a real wallet

no cookies · no analytics · no requests leave this page

00 · what this is

A seed backup that is worthless in any one place.

SPLITSTEEL takes the twelve or twenty-four words of a wallet and turns them into two random-looking halves, the pad and the ciphertext. Either half on its own carries no information about the seed at all, not to a thief and not to a computer of any size. Both together give the words back with a pencil and a printed table. The sitting that makes them happens on a small computer that has never been online and forgets everything when the power goes off, and this page replays that sitting exactly as the machine shows it.

This is a demonstration for feedback. The values on every screen are published test values. Nothing here asks for a seed, and nothing here ever should.

01 · before you sit down

A small computer, a screen, a keyboard, two dice.

The blender is a Raspberry Pi with the SPLITSTEEL card in it. It has no Wi-Fi hardware and no network lead, nothing typed into it is ever written to the card, and when the power goes off everything it knew is gone. Everything else on the table is paper, dice and steel.

On the table

  • The Pi with the SPLITSTEEL card, and its power supply
  • Any HDMI screen and a USB keyboard
  • Two casino dice, two colours, so first and second stay distinct
  • Two USB sticks, any size; they become R and B
  • The three printed cards: dice card, ARITHMETIC CARD, SEED GRID CARD (pages 11 and 12 of the field manual, or in the box)
  • Pencil and paper

Not in the room

  • No network lead and no Wi-Fi hardware on the machine
  • No phone on the table
  • No camera that can see the screen
  • Nobody who does not need to be there

The wizard asks you to confirm this before it does anything, and it means it.

For afterwards

  • Steel plates, the punch jig and letter punches, or an engraver
  • Two M-DISCs and a drive that burns them
  • Two ordinary computers, one for each half, never both halves on one
  • Two hiding places in two buildings

The rules

  • Practice first. [3] at the menu is the whole sitting with toy values.
  • Either half alone is nothing. Both halves together are the key.
  • The two halves never meet on one computer or in one hiding place.
  • Power off with [p], never by pulling the plug.
  • Never type a seed into a website. Not this one, not any.
SPLITSTEEL · the Pi is a blender · steel is the vault MAIN MENU [1] build a vault words -> pad + ciphertext [2] recover pad + ciphertext -> words [3] practice the whole sitting, toy values [?] help new to this? start here [p] power off the safe way to finish First time with this kit? Do [3] practice before anything real. choose: ▌ any HDMI screen or TV USB SPLITSTEEL card Raspberry Pi HDMI USB a USB keyboard stick R stick B counted at the start, written one at a time,never both in together DICE CARD ARITHMETIC CARD SEED GRID CARD the three printed cards pencil and paper two dice, two colours Wi-Fi network lead phone camera nothing in the room talks to anything
The whole set-up. The Pi drives the screen over HDMI and takes a keyboard over USB. The two sticks are counted at the start and written one at a time, so both halves can never land on the same one. Wi-Fi, a network lead, a phone and a camera are the four things that must not be in the room.

02 · the sitting, screen for screen

The wizard, replayed from the program itself.

Eight episodes. Pick one, or let it run: it plays the whole sitting in order, typing what you would type, and the panel beside the screen fills in the cards and paper on the table as the screens ask for them. Every frame is the wizard's own output, captured by driving build … with a fixed script; the page cannot drift from the code because the test suite regenerates it and compares.

the kit's console · 80 columns · Linux console colours wizard build … 
This replay needs JavaScript. Every screen is also in the printed quick start (PDF).
1 / 1

Space plays and pauses; the arrow keys step one screen. Too quick? Choose ½× or ¼×; the screen also waits longer whenever there is a new caption to read. The seed in this replay is a published demonstration value: …. It must never hold money.

Prefer a video file? Each episode is also an MP4, rendered from the same frames.

03 · after the sitting

Two sticks, two numbers on paper. From here on, one half at a time.

The blender is the only machine that ever holds your whole seed. Everything after it handles one half, and a half is a random number, so the computers that make the copies need no trust and no skill. One rule replaces all of that: the two halves never meet on the same computer.

R and B, the sticks

Each stick carries one half, its plate files and the recovery tools, and a page called START-HERE.html that opens with a double-click and walks that half through to finished: the disc, the plate, and where to put it. Take R to one computer and B to a different one.

The discs

One M-DISC per half, burned on that half's computer from the files on its stick. A disc is the copy that survives being forgotten in a drawer for decades; the stick is the copy that is convenient this year.

The steel

A keeper plate and a spare for each half, punched with the jig from the plate files, eight groups and the check group. No labels, ever. The plates carry no red or blue and no name: the arithmetic does not care which is which.

Then prove it, then split it

  • Run RECOVER on the kit reading only off the finished objects
  • Only then destroy the old paper seed
  • Two halves, three copies each, and no hiding place holds both halves
  • Wipe the SD card, power off, post the heirs' letter
the blender saw both halves once and is powered off R B computer one any laptop, START-HERE.html computer two another room, another building never the same machine M-DISC 2D94 081F 5E1C 0473 B9A2 E8D1 370F 6A5C keeper plate + spare no labelno colour M-DISC 1E46 A0B0 D90D 19B7 E1A8 E74F EE1E 68ED keeper plate + spare no labelno colour
The two-machine rule. Each stick goes to its own ordinary computer and becomes a disc and a plate there. Neither computer ever holds both halves, so neither needs to be trusted. The plate values are the demonstration pad and ciphertext from the replay above.

04 · inheritance

Split the secret, not the trust.

Copies of the same half never add up. Twenty people holding twenty copies of the ciphertext hold nothing between them, which is what makes a split different from a multisig: nobody you give a half to can ever spend, alone or together. The whole design of the inheritance is deciding who could hold one half and also reach the other.

Many ciphers

Spread the ciphertext as widely as is useful: a solicitor, a family member, a hole in the garden, even a dead man's switch in an online account. A hacked account learns a random string and nothing else.

Few pads

Keep the pad copies few, in places only you control, never online, never with anyone who holds a cipher. Once a thief has a pad, every cipher copy in the world is a place they can finish the job.

The one rule

No person, account or place ever holds one half and the whereabouts of the other. A solicitor with a cipher and a sealed letter saying where a pad is holds the whole secret.

The after-death path takes two

The will names where the pad is, and the person who holds the will holds no cipher. A cipher sits with someone who does not know where the pad is. Either alone has nothing. Together, after you, they recover it.

you three pads, three places you control never online, never with a cipher holder solicitor holds the will · holds no cipher family member a cipher · not told where the pad is a hole in the garden a cipher · a place only you know an online account a cipher · worthless if hacked the will: where the pads are a cipher copy each never the same person after you the will says where a pad is + any one cipher copy + the ARITHMETIC CARD = the words, on a blender two people, each holding something worthless alone
One layout that satisfies the rule. Cipher copies are spread, because they are worthless alone. The pads stay with you. The will says where a pad is, and the person who holds the will holds no cipher, so the after-death path needs two people and no single one of them can rob you while you are alive.

05 · why a split

Any other steel is the seed.

A punched plate of twelve words, a capsule of letter tiles, a laminated card in a safe: whoever finds it has the wallet, at once, with no way back. A SPLITSTEEL plate is a random number. Found, photographed, copied a hundred times, it says nothing about the seed until it meets its other half, and it only has one.

If the backup is…and someone finds one hiding placegetting the money back needs
twelve words on paper or steelthey have everythingany wallet
words plus a passphrasethey have everything but a guess: the passphrase is all that stands, and it is in one headany wallet, and the passphrase remembered
multisig, with keys held by othersnothing from one key; but enough holders together can spend without you, and enough can refuse to signthe right software, the wallet descriptor, and enough of the keys
Shamir sharesnothing below the thresholdsoftware that speaks the scheme
SPLITSTEELnothing: a half is a random number, and copies of the same half never add upa printed table and a pencil, or the kit

Both halves are needed, so each is kept in more than one place: two halves, three copies each. That is the whole of the trade. Nobody a half is given to can spend it, alone or together, which is what a split has that a multisig does not.

06 · the bad day

For the person who inherits this.

The wizard has a help screen written for you, and the recovery is two grids typed from two objects. The words it gives you are the money. Nothing about this is urgent, whatever anyone says.

  1. Read the help screens first. Choose [?] at the menu. They are short, and they are the difference between keeping the money and losing it. Watch them here.
  2. Gather one pad object and one ciphertext object. A red stick or disc and a blue one, or two plates. The plates carry no mark, and it does not matter which goes first.
  3. Sit at the kit, in a private room, with no phone and nobody helping who wants to take the words away. Choose [2] recover and type each half box by box; the check box catches a misread character. Watch the recovery.
  4. Write the words on paper when the screen shows them, before pressing enter.
  5. Put them into a hardware wallet bought new, never a website, never a phone or PC that browses the web. Confirm the balance, then move everything to a wallet that is yours.
  6. Burn the scrap, wipe the SD card, and put the two objects back in different buildings until the old wallet is empty.

Real help never needs your words. If anyone offering support asks for them, they are a thief. Walk away.