How to Choose Your Shamir Backup Threshold: Share Count vs. Loss Risk
The choice of threshold is a trade-off with no one-size-fits-all answer, but a general rule applies: the more shares you create and the closer the threshold is to the total number of shares, the higher the security, but the risk of losing any single share also increases. For most everyday users, 2-of-3 or 3-of-5 strikes a sweet spot between security and usability.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
1. Understand the Parameter Range You Can Choose
According to the SLIP39 standard implementation, the lower and upper limits for both the number of shares and the threshold are 2 and 16—you can split your secret into a minimum of 2 shares requiring 2 to recover, and up to 16 shares requiring all 16 to recover. The Shamir backup feature on Trezor wallets follows this range. Mainstream hardware wallets (such as Keystone, Trezor, OneKey) all support this standard.
In practice, wallets typically ask you to set the "share count" first, then the "threshold". For example, in the OneKey interface, setting "Shares: 5, Threshold: 3" means generating 5 mnemonic shares, any 3 of which can recover the wallet.
2. Risk Comparison of Different Threshold Combinations
You can think of Shamir backup as a tug-of-war between "distributed storage" and "centralized recovery." Below we break down three common setups.
2-of-3 (Recommended for Beginners)
Loss risk: If you lose any 1 share, you can still recover with the remaining 2 (since 2 out of 3 are enough). But if you lose 2 shares, the funds are permanently lost.
Security risk: Any 1 stolen share is insufficient to recover the wallet; but if 2 shares are stolen (or two custodians collude), the funds can be recovered.
Use case: Personal multi-site backup—keep one share at home, one at the office, and one with a trusted friend or relative. If any site is destroyed or lost, you have a fallback.
3-of-5 (Officially Recommended by Trezor)
This is the recommended setup in the Trezor Shamir HODL Pack, which they call the "majority" scheme. The 5-pack metal backup kit from Cryptosteel also recommends this configuration.
Loss risk: You can afford to lose any 2 shares and still recover with the remaining 3. This means even if two storage locations fail simultaneously (fire, flood, theft), your funds remain safe.
Security risk: An attacker needs at least 3 of the 5 shares to recover the wallet, a higher bar than 2-of-3. The probability of three custodians colluding is also lower than two.
Use case: Individuals with significant holdings, or small-team multi-signatory control—each person holds one share, and daily transactions require at least three people to cooperate.
5-of-5 / High Threshold Configurations
Loss risk: Extremely high. Losing any single share means permanent loss of funds, because all 5 shares are required for recovery.
Security risk: Extremely high. An attacker who obtains any 4 shares still cannot recover any information; all 5 are needed.
Use case: Very rare extreme-security scenarios, such as requiring all founders to be present to access funds. For the average user, unless you are 100% certain you can safeguard every single share, this is strongly discouraged.
A leading global cryptocurrency platform,suitable for both beginners and experienced traders.
New user benefit: 20% off trading fees upon registration!！
3. Remember Three Core Principles
Principle 1: The threshold must be greater than half the total shares to offer meaningful defense
Shamir's paper noted that when n = 2k - 1, the scheme is most robust: even if k-1 shares are destroyed, recovery is still possible; even if k-1 shares are leaked, an attacker cannot recover the secret. Simply put, the threshold should exceed half the number of shares. 3-of-5 fits this logic, as does 2-of-3.
Principle 2: More shares increase management costs nonlinearly
Every additional share requires another secure storage location. Each extra share also increases the time needed to gather the threshold number of shares during recovery. Keystone has warned that Shamir backup is more complex than multisig wallets—recovery requires special steps to import enough shares and reconstruct the seed phrase, unlike multisig where you can sign directly.
Principle 3: Hardware compatibility comes at a cost
Currently, SLIP39 support is mainly found on a few hardware wallets like Trezor and Keys ton e. If your device breaks, you cannot simply switch to another brand of wallet for recovery; you must buy another device from the same manufacturer that supports SLIP39. Before choosing a threshold, confirm that your device vendor is committed to long-term support for this standard.
Risk Reminder: A SLIP39 share mnemonic is a string of 20 or 33 English words, with the first three words identical across all shares (used to identify that they belong to the same set). If someone obtains multiple of your shares but not enough to reach the threshold, they cannot recover the seed, but they can still identify that these shares belong to the same wallet through the first three words—a privacy risk exists. When storing shares, do not keep different shares together, and do not allow the same person to see multiple shares.
After making the above judgment, how do you confirm you've chosen correctly?
After completing the Shamir backup setup in your wallet, first perform a full recovery test with a small amount of assets—record your shares, wipe the device, then restore the wallet using exactly the threshold number of shares, and verify that you can sign and make transactions normally. If the recovery process goes smoothly, your threshold combination is functional. It is recommended to perform a recovery test once a year thereafter to confirm that all shares are still readable and usable.
