Shamir’s Secret

Key advantages over a current single ciphered seed + passphrase:

• No single point of failure: Lose one plate or forget part of your long passphrase → still recoverable if you hit the threshold.
• Family-friendly: Distribute shares to spouse, kids, trusted lawyer, or safe deposit boxes. No one has full access while you’re alive.
• Theft resistance: A thief needs multiple shares (from different locations/people).
• Still works with your metal plates: You can stamp the individual Shamir shares (they look like word lists) onto separate ciphered or plain metal plates.
• Inheritance: Your “letter of instructions” just says “Gather any 3 of these 5 people/locations and follow the recovery steps on this device.”

It doesn’t replace your ciphering habit—you can still cipher each share before stamping if you want that extra “if seen, still safe” layer.

How “Layering” Shamir Works in Practice

“Layering” usually means combining Shamir with other protections instead of using it alone:

1. Generate a standard BIP-39 seed (12/24 words) on an air-gapped device.
2. (Optional but smart) Add a BIP-39 passphrase on top — this creates a “hidden wallet” effect.
3. Split the resulting master secret (or just the BIP-39 seed) into Shamir shares.
4. Store the shares in multiple secure locations (metal plates, different homes, etc.).
5. For daily use, you can still use a single hardware wallet loaded with the full seed + your strong passphrase.
6. For inheritance or redundancy, family only needs the threshold number of shares + clear instructions.

You can also run Shamir inside a multisig setup (each multisig key gets its own Shamir backup).

Important reality check: SLIP-39 shares are not directly compatible with plain BIP-39 hardware in most cases. You usually recover to a device that supports SLIP-39, or use software (Sparrow, Electrum, etc.) to recombine shares into a BIP-39 seed.

Compatibility with Devices (QR, Jade, SeedSigner)

Your air-gapped, QR-heavy stack is excellent for sovereignty, but here’s the honest breakdown:

• Blockstream Jade (and Jade Plus):
  No native SLIP-39 support as of early 2026. There have been GitHub requests and discussions, but it’s not implemented yet. Jade excels at BIP-39 + optional passphrase, QR air-gapped signing, and multisig. You can still use it for the active wallet, but you’d handle Shamir shares separately (e.g., recombine in Sparrow Wallet on an air-gapped computer, then load the resulting BIP-39 into Jade). Not seamless for direct Shamir recovery on the device itself.
• SeedSigner:
  Primarily a BIP-39 + QR air-gapped signer. No native SLIP-39 support. There’s discussion around Codex32 (Blockstream’s alternative Shamir-like scheme for paper/QR), but standard SLIP-39 isn’t built-in. SeedSigner is great for signing with a recombined seed, but not for generating or recovering Shamir shares directly.
• QR codes in general:
  Excellent for Shamir workflows when using compatible software. Many tools export/import shares via QR (or animated QR series). Foundation Passport uses its own 2-of-3 Shamir-style “Magic Backup” with NFC/QR, which is similar in spirit and very family-friendly.

Bottom line for your stack: Shamir layers beautifully for backup/inheritance, but your daily signing devices (Jade + SeedSigner) stay on BIP-39. Workflow:

• Keep your main wallet on Jade/SeedSigner with your strong setup.
• Create Shamir shares as a redundant/inheritance layer.
• Recombine shares offline (software or a Trezor) when needed, then import the resulting BIP-39 seed into your Jade/SeedSigner for access.

If you want fully native Shamir on hardware, the gold standard right now is Trezor Safe 3 or Safe 5 (native SLIP-39, easy UI). Keystone 3 Pro and some others also do it well. You could add one Trezor just for the Shamir backup/recovery side without replacing your Jade/SeedSigner sovereignty stack.

Recommended Practical Setup

Since you love ciphered metal plates and stateless cold storage:

1. Generate or use your existing BIP-39 seed (air-gapped).
2. Optionally keep a long passphrase on the active wallet.
3. Choose a 3-of-5 or 2-of-4 Shamir configuration.
4. Generate the shares (best on Trezor Suite, or offline tools like python-shamir-mnemonic, or Sparrow Wallet).
5. Cipher each share individually (current method) → stamp onto separate metal plates → store in dispersed, secure locations.
6. Write a simple, sealed “Inheritance Instructions” document: locations of shares, exact threshold, step-by-step recovery (e.g., “Use Sparrow on air-gapped laptop → combine shares → load BIP-39 into Jade”).
7. Test the entire process with a tiny test wallet first.

This keeps your current paranoid level (cipher + metal + air-gapped QR) while solving the family simplicity problem.

Pros of this layered approach:

• Better loss tolerance than single seed + long passphrase.
• No one (including family) needs your passphrase characters.
• Still fully under your control while alive.

Cons / Risks to watch:

• More pieces to manage → test recovery annually.
• SLIP-39 isn’t as universally supported as BIP-39 (yet), so software fallback is key.
• Human error in combining shares under stress → clear instructions + practice matter most.

In the next decade, expect better native support across more devices (including potential Jade updates) and tools like Codex32 gaining traction for pure QR/paper workflows.

If your stack is significant, a hybrid is ideal:

Jade/SeedSigner for daily sovereign operations + Shamir layer (via Trezor or software) for inheritance redundancy.