SPLITSTEEL — the demo

00 · what this is

A seed backup that is worthless in any one place.

SPLITSTEEL takes the twelve or twenty-four words of a wallet and turns them into two random-looking halves, the pad and the ciphertext. Either half on its own carries no information about the seed at all, not to a thief and not to a computer of any size. Both together give the words back with a pencil and a printed table. The sitting that makes them happens on a small computer that has never been online and forgets everything when the power goes off, and this page replays that sitting exactly as the machine shows it.

This is a demonstration for feedback. The values on every screen are published test values. Nothing here asks for a seed, and nothing here ever should.

01 · before you sit down

A small computer, a screen, a keyboard, two dice.

The blender is a Raspberry Pi with the SPLITSTEEL card in it. It has no Wi-Fi hardware and no network lead, nothing typed into it is ever written to the card, and when the power goes off everything it knew is gone. Everything else on the table is paper, dice and steel.

On the table

The Pi with the SPLITSTEEL card, and its power supply
Any HDMI screen and a USB keyboard
Two casino dice, two colours, so first and second stay distinct
Two USB sticks, any size; they become R and B
The three printed cards: dice card, ARITHMETIC CARD, SEED GRID CARD (pages 11 to 13 of the field manual, or in the box)
Pencil and paper

Not in the room

No network lead and no Wi-Fi hardware on the machine
No phone on the table
No camera that can see the screen
Nobody who does not need to be there

The wizard asks you to confirm this before it does anything, and it means it.

For afterwards

Steel plates, the punch jig and letter punches, or an engraver
Two M-DISCs and a drive that burns them
Two ordinary computers, one for each half, never both halves on one
Two hiding places in two buildings

The rules

Practice first. [3] at the menu is the whole sitting with toy values.
Either half alone is nothing. Both halves together are the key.
The two halves never meet on one computer or in one hiding place.
Power off with [p], never by pulling the plug.
Never type a seed into a website. Not this one, not any.

The whole set-up. The Pi drives the screen over HDMI and takes a keyboard over USB. The two sticks are counted at the start and written one at a time, so both halves can never land on the same one. Wi-Fi, a network lead, a phone and a camera are the four things that must not be in the room.

02 · the sitting, screen for screen

The wizard, replayed from the program itself.

Eight episodes. Pick one, or let it run: it plays the whole sitting in order, typing what you would type, and the panel beside the screen fills in the cards and paper on the table as the screens ask for them. Every frame is the wizard's own output, captured by driving build … with a fixed script; the page cannot drift from the code because the test suite regenerates it and compares.

The seed, pad and numbers on these screens are published. They are on this page, in the videos, and in the PDF, so the wallet they make is a wallet anybody can open and empty. It exists to be looked at. Never send anything to it, and never reuse one of these numbers in a real sitting — a real one uses your own dice, and nobody but you ever sees the result.

the kit's console · 80 columns · Linux console colours wizard build …

This replay needs JavaScript. Every screen is also in the printed quick start (PDF).

speed 1 / 1

Space plays and pauses; the arrow keys step one screen. Too quick? Choose ½× or ¼×; the screen also waits longer whenever there is a new caption to read. The seed in this replay is a published demonstration value: …. It must never hold money.

Prefer a video file? Each episode is also an MP4, rendered from the same frames.

03 · after the sitting

Two sticks, two numbers on paper. From here on, one half at a time.

The blender is the only machine that ever holds your whole seed. Everything after it handles one half, and a half is a random number, so the computers that make the copies need no trust and no skill. One rule replaces all of that: the two halves never meet on the same computer.

R and B, the sticks

Each stick carries one half, its plate files and the recovery tools, and a page called START-HERE.html that opens with a double-click and walks that half through to finished: the disc, the plate, and where to put it. Take R to one computer and B to a different one.

The discs

One M-DISC per half, burned on that half's computer from the files on its stick. A disc is the copy that survives being forgotten in a drawer for decades; the stick is the copy that is convenient this year.

The steel

A keeper plate and a spare for each half, punched with the jig from the plate files, eight groups and the check group. No labels, ever. The plates carry no red or blue and no name: the arithmetic does not care which is which.

Then prove it, then split it

Run RECOVER on the kit reading only off the finished objects
Only then destroy the old paper seed
Two halves, three copies each, and no hiding place holds both halves
Wipe the SD card, power off, post the heirs' letter

The two-machine rule. Each stick goes to its own ordinary computer and becomes a disc and a plate there. Neither computer ever holds both halves, so neither needs to be trusted. The plate values are the demonstration pad and ciphertext from the replay above.

04 · two halves, or three parts

Both needed, or any two of three.

The wizard asks one question before a die is rolled. Two halves is the simplest thing and the most private: copies of one half can go anywhere, and nobody you hand one to can ever combine with anyone. Three parts buys loss tolerance with maths instead of copies: numbers 1 and 2 come from you, number 3 is the seed combined with both, and each part carries two of the three. RED holds 1 and 2, BLUE 2 and 3, GREEN 3 and 1. One part alone is two random numbers. Any two parts hold all three, and recover on the same printed table. Episode 07 in the replay is the same wallet made as three parts.

	two halves, both needed	three parts, any two recover
a thief finds one hiding place	nothing	nothing
you lose one object outright	everything, unless you made copies	nothing: the other two recover it
objects for one-loss tolerance	four, two copies of each half	three
characters an object, twelve words	32 and a check group	64 and two check groups, so two plates a part
lookups to recover by hand	32	64, in two passes
can the people you give pieces to combine without you	never: copies of one half never add up	any two holders can: choose them like cosigners, or keep two parts yourself in two buildings
the rule for hiding places	no place holds both halves	no place holds two different parts

Neither is the wrong answer, which is why the wizard asks. Two halves if you will make and place copies properly and you value that nobody else can ever assemble it. Three parts if losing a place worries you more than two holders conspiring, or you want three people to each hold something and any two to suffice.

05 · inheritance

Split the secret, not the trust.

Copies of the same half never add up. Twenty people holding twenty copies of the ciphertext hold nothing between them, which is what makes a split different from a multisig: nobody you give a half to can ever spend, alone or together. The whole design of the inheritance is deciding who could hold one half and also reach the other.

Many ciphers

Spread the ciphertext as widely as is useful: a solicitor, a family member, a hole in the garden. A copy in an online account is defensible on the arithmetic - a hacked account learns a random string and nothing else - but only if nothing beside it hints where a pad is, and only if you accept that an online copy is one a future dispute, subpoena or breach also reaches. Metal and paper in two places is the stronger habit; if you do put one online, it carries no label, no note and no name.

Few pads

Keep the pad copies few, in places only you control, never online, never with anyone who holds a cipher. Once a thief has a pad, every cipher copy in the world is a place they can finish the job.

The one rule

No person, account or place ever holds one half and the whereabouts of the other. A solicitor with a cipher and a sealed letter saying where a pad is holds the whole secret.

The after-death path takes two

Not in the will itself. A will usually becomes a public record once probate is granted - in England and Wales anyone can order a copy - so whereabouts written into it are published after your death. Put them in a sealed letter of wishes lodged with the will instead: it is not part of the will, it is not published, and it can be replaced whenever a hiding place changes. The letter says where the pad is; the person who holds it holds no cipher. A cipher sits with someone who does not know where the pad is. Either alone has nothing. Together, after you, they recover it. With three parts the shape is simpler: one part each to three people or places, and any two of them recover, which is also why those holders are chosen like cosigners.

Wills, probate and how a letter of wishes is treated differ by country and change over time. This is a description of the design, not legal advice - take a solicitor's before you rely on it.

One layout that satisfies the rule. Cipher copies are spread, because they are worthless alone. The pads stay with you. The will says where a pad is, and the person who holds the will holds no cipher, so the after-death path needs two people and no single one of them can rob you while you are alive.

06 · why a split

Any other steel is the seed.

A punched plate of twelve words, a capsule of letter tiles, a laminated card in a safe: whoever finds it has the wallet, at once, with no way back. A SPLITSTEEL plate is a random number. Found, photographed, copied a hundred times, it says nothing about the seed until it meets its other half, and it only has one.

If the backup is…	and someone finds one hiding place	getting the money back needs
twelve words on paper or steel	they have everything	any wallet
words plus a passphrase	they have everything but a guess: the passphrase is all that stands, and it is in one head	any wallet, and the passphrase remembered
multisig, with keys held by others	nothing from one key; but enough holders together can spend without you, and enough can refuse to sign	the right software, the wallet descriptor, and enough of the keys
Shamir shares	nothing below the threshold	software that speaks the scheme
SPLITSTEEL, two halves or three parts	nothing: a half or a part is random numbers, and copies of the same one never add up	a printed table and a pencil, or the kit

Both halves are needed, so each is kept in more than one place: two halves, three copies each. That is the whole of the trade. Nobody a half is given to can spend it, alone or together, which is what a split has that a multisig does not.

07 · the bad day

For the person who inherits this.

The wizard has a help screen written for you, and the recovery is two grids typed from two objects. The words it gives you are the money. Nothing about this is urgent, whatever anyone says.

Read the help screens first. Choose [?] at the menu. They are short, and they are the difference between keeping the money and losing it. Watch them here.
Gather one pad object and one ciphertext object, a red stick or disc and a blue one, or two plates, or for a three-parts backup any two of the red, blue and green parts. Plates carry no mark, and it does not matter which goes first.
Sit at the kit, in a private room, with no phone and nobody helping who wants to take the words away. Choose [2] recover and type each half box by box; the check box catches a misread character. Watch the recovery.
Write the words on paper when the screen shows them, before pressing enter.
Put them into a hardware wallet bought new, never a website, never a phone or PC that browses the web. Confirm the balance, then move everything to a wallet that is yours.
Burn the scrap, wipe the SD card, and put the two objects back in different buildings until the old wallet is empty.

Real help never needs your words. If anyone offering support asks for them, they are a thief. Walk away.

Print

The quick start (PDF)

These pages on paper: the set-up, the key screens, the objects and the inheritance layout.

Read

The field manual (PDF)

Every step in detail, the three printed cards, the heirs' letter and the field checklist.