Keeping a secret safe

Triple mnemonic

On a tool created by Stepan Snigirev, anyone can generate what he calls a “double mnemonic”. Starting with firmware v1.4, Seedmate can generate this type of structure offline, though we consider it more accurate to call it a 'Triple Mnemonic'.

Quoting Stepan on the original concept: “The 24-word mnemonic generated by this tool consists of two valid 12-word mnemonics. So you can use both, or combined. Have fun and make everyone confused.”

Why "Triple" instead of "Double"?

This structure allows you to take a valid 24-word master mnemonic and split it into two valid 12-word mnemonics, giving you a total of three working seeds. You can then keep the two halves physically separated and place decoy funds on them to hand over under duress, or to serve as an early-warning "canary" if the funds move. To access the main wallet, simply enter both 12-word parts in the correct order (there are only two possible combinations).

Splitting a mnemonic is often criticized because an attacker obtains part of the seed if they find one half. But each part being 12 words the missing entropy makes it effectively impossible to brute-force. However, because it is a 2-of-2 scheme, losing either half means losing access to your main funds. Redundancy (keeping multiple copies) is mandatory.

Triple Mnemonic vs. Standard Passphrase

Comparing a Triple Mnemonic split to a strong passphrase approach reveals several structural advantages:

• Higher brute-force protection.
• Easier to input and use on hardware devices.
• Lower chance of typographical errors (passphrases are case-sensitive and use special characters).
• Broader wallet compatibility.

There are, however, a few minor disadvantages to keep in mind:

• Passphrases allow for the creation of multiple hidden wallets under the same seed, using different passphrases.
• A few entropy bits are lost in the split: 4 bits from the first checksum and 4 bits from the last checksum. The resulting master mnemonic contains 248 bits of entropy rather than 256. Regardless, this remains astronomically large (128 bits is already considered impossible to guess).
• Passphrases provide some protection against weak entropy risk, but if you created your triple menmonic using real world randomness then you are already protected.

How to create a Triple Mnemonic in Seedmate

1. Generate the master

   Create a 24-word mnemonic using your preferred trustless input method (dice, cards, etc.). Write it down or store it temporarily on an SD card.

2. Apply the modifier

   Navigate to Create new seed words -> Triple mnemonic, and enter your previously created mnemonic (or load it from the SD card).

3. Verify the checksums

   Seedmate will adjust the seed to meet the checksum rules for all three mnemonics. It will display the details of the checksums, highlighting the modified words in green. Verify that only words #12, #24, and potentially #23 were modified compared to your original list.

4. Test and store

   Write down the final 24-word list in two separate 12-word parts. Verify that all 3 mnemonics (the 24-word master and the two 12-word halves) are mathematically valid by loading them into Seedmate or any standard wallet. Finally, clear the SD card and store the physical parts securely and redundantly.

Shamir over BIP39

Applying Shamir's Secret Sharing (SSS) to a BIP39 recovery phrase means cutting your master backup into multiple mathematical "shares" instead of keeping it as a single vulnerable list of words.

The Problem

A standard BIP39 seed phrase (12 or 24 words) is a single point of failure. If someone finds it, they take your funds. If you lose it, your funds are gone.

The SSS Solution & Security Benefit

You split your seed into N different shares (e.g., 5) and set a threshold k (e.g., 3). You can then hide the 5 shares in different locations.

• An attacker finding just 1 or 2 shares gets zero information about your seed.
• If you lose 1 or 2 shares due to a fire or theft, you can still fully recover your wallet using the remaining 3.

The main trade-off is that other manufacturers do not implement this specific Shamir BIP39 scheme. You will need a Seedmate device to recover the master mnemonic, or alternatively, use our free HTML backup tool in a strictly air-gapped, offline environment.

Another advantage is operational security: even if someone gathers enough shares, it is highly unlikely they would know how to combine them without the appropriate instructions. (Make sure your loved ones have access to proper recovery instructions in case something happens to you).

Mapping your shares

To recover and merge correctly, you must write down the k value (threshold) and the specific Id for each share. A single share backup should look like this:

Alternatively, you can store the k threshold and the share IDs in a completely different location (or even on a cloud server). This way, if someone finds a share, they won't have a clue that it is part of a Shamir scheme. However, you cannot lose this "treasure map" to reconstruct it. In a simple 2-of-3 scheme, you could still manually test all combinations, but higher thresholds require exact ID mapping.

An example of an ID mapping map:

Testing and Decoys

Always test your recovery scheme properly before moving funds. Entering a wrong share ID does not produce an error; it simply generates a different mnemonic other than where you put your funds. Entering repeated share IDs, however, will generate an error.

Because each share is a valid BIP39 mnemonic with the same length as the master seed, they can be loaded with small amounts of funds to act as decoys. If those funds ever move, you instantly know that specific share has been compromised.

Lock risk

Being a custom implementation means you may become dependant on this device. Even with the existence of the HTML backup file. But there is yet even another way: in this modern world you could just ask your prefered AI model to code a tool for you to merge shares. Here is a promt:

Ey 'AI', I need you to make a tool to merge BIP39 Shamir Shares, make it HTML - insert your prefered language here -. Shares are valid BIP39 mnemonics of the same size, provide input methods to type shares, shares id, and threshold 'k'. Look at the Shamir.c library attached and mimic the logic. Take this file containing several split results, use it to do merge testing and verify you tool. Give me a summary of all tests executed. I will never send you or anyone the actual shares because I'm not stupid and I know that these can never touch an online device.

Then go offline and run it to recover your secret. Anyway, Shamir is advanced stuff, if you don't feel confortable, don't use it. If you decide to use it, don't rely solely on it, have opther backup strategies.

How to use seedXOR

Good randomness is the foundation everything else sits on. If your seed can be guessed, nothing you do afterwards matters.

Mixing randomness from different sources

If a mnemonic is predictable, sooner or later the funds behind it are gone. Weak entropy has already cost people real money — which is why the safest habit is to generate your seed from real-world randomness rather than trusting a device to produce it for you.

Seedmate lets you build a mnemonic from dice rolls, coin tosses, poker cards, or words you picked yourself. Those words must come from the BIP39 list and must be picked at random: print the list, cut it into slips, shuffle, and pull 24 blindly.

Word typing is the most transparent method, because you did the picking — there is nothing to trust. The one catch is the final word, which carries the checksum and can't realistically be worked out by hand. Seedmate adjusts the last bits of that final word to satisfy the checksum. Every other word stays exactly as you drew it.

If you want to push entropy further, generate several mnemonics by different methods and combine them with seedXOR. The result carries the entropy of all of them and is safe to hold funds.

Creating recovery schemes

XOR is reversible, and that's the whole trick:

A 2-of-2 scheme

Say A is the mnemonic holding your funds. Generate a random mnemonic B with Seedmate and compute C = A ⊕ B. Now store B and C instead of A, and recover A by combining them again.

Lose either one and access is gone — same weakness as a passphrase, no redundancy. Keeping multiple copies of B and C in different places helps, but there's a better shape.

A 2-of-3 scheme

Start again from A, where the funds are. Generate two random mnemonics B and C, then compute:

Now distribute the pieces:

• Location 1 — B and C
• Location 2 — B and D
• Location 3 — C and D

Lose any single location and you can still rebuild A from the other two. Find a single location and you learn nothing. That is a 2-of-3 scheme, and it's the shape most people should be aiming for.

What is Seedmate?

Maybe start with what it is not. Seedmate is not another hardware wallet. It cannot connect to the internet — no PC, no phone, no software to install.

Seedmate is an air-gapped, standalone BIP39 calculator, built to cover the security gaps most hardware wallets leave behind. Seedmate doesn't replace your hardware wallet, Seedmate complements it.

Self-custody comes down to keeping a secret safe: safe from loss, and safe from prying eyes.

First — you generate the secret yourself

No third party creates it for you. With Seedmate you build mnemonics from real-world randomness: dice, coins, words and poker cards. Seedmate allows several conversion methods like raw entropy input and "string-hash". In raw entropy the user can verify every bit input, every word built, and finally every detail of the checksum. Most HW wallets make a SHA256 hash of a text string with the dice rolls: "45411...". That hash is a black box that is impossible to verify, users have to compare the ouput to another black box (usually online tools). Seedmate provides almost all known methods, so you can either verify details yourself, or use it to compare the result of another device, but fully offline.

Second — you can mix entropy sources

Combine randomness from different physical sources for maximum entropy. Inputs and outputs are standard BIP39 mnemonics, typed on the on-screen keyboard or moved with an SD card. The SD card is there to make operations easier, not to store data long term: wipe it afterwards and keep your backups analog.

Third — you can build real recovery schemes

Split your secret into three parts where a single part reveals nothing, and any two rebuild it completely. That's redundancy and secrecy at the same time — safe from loss, safe from prying eyes.

• XOR — compatible with other devices, limited to 2-of-3.
• Shamir — custom, flexible schemes up to 6-of-9.

Fourth — obfuscation

Rather than storing a clear-text copy of your secret, apply a reversible transformation to it. Whoever finds that backup holds a valid mnemonic that isn't yours, unless they guess the exact reverse operation. Shifting every word by n positions is enough to produce a completely different, valid BIP39 seed.

Load that obfuscated seed with a small amount and it becomes a canary: if the coins ever move, you know your physical backup has been found. The same trick works with the recovery schemes above, since every part is a valid BIP39 seed.

The hardware

Seedmate is a personal project engineered in Spain. Two boards: a custom processor board around a PIC32, paired with a commercial display and SD module. The software is fully open source, written from scratch in C plus a few libraries for SHA256, QR generation and Shamir arithmetic.

It is stateless. Power it off and it clears completely — no seed can be stored inside the device.

Self-custody checklist

This applies to amounts that would genuinely hurt to lose. As the number grows, so does the security you owe it.

1. A mnemonic you can trust

   Generated properly, and genuinely random, without taking any software's word for it. Weak entropy has shipped in real products before and will again — don't take the risk.

   A simple, trustless method: print the BIP39 word list, cut it into slips, and blindly pull 23. Use offline hardware only for the 24th, which carries the checksum and can't be worked out by hand. You picked 23 words; a third party contributed a checksum.

   For the properly paranoid, mix several entropy sources with seedXOR on offline hardware — after testing the XOR logic. Twelve words are considered fine; we'd stay with 24.

   If your funds sit on addresses that don't meet this bar, generate a new seed and move them carefully.

2. The secret has never been online

   No phone photos, no SeedQR scans on a phone, no text files, never imported into a hot wallet, and no one else has had access to it. Never type it into a website. Never share it.

   A seed that was used in a hot wallet does not become safe by being loaded into a cold one. The exposure already happened. Generate a new one and move the funds.

3. Redundancy

   Lose the seed and you lose the funds, so keep redundant physical copies in separate locations, ideally on fire- and water-resistant material — or use a 2-of-3 scheme, below.

4. Physical compromise

   Redundant copies protect against loss and expose you to discovery. Several ways to resolve that tension:

   • Passphrase. Combined with the mnemonic to derive different keys. An attacker needs both — but so do you. It's a 2-of-2: safer than single-sig, easier to lock yourself out.
   • SeedXOR 2-of-3. Generate A and B, derive C, and split the pairs across three locations. One location on its own tells an attacker nothing. Several hardware wallets support SeedXOR.
   • Shamir k-of-n. Any k shares rebuild the secret; fewer reveal nothing. Trezor's SLIP39 uses its own word list and few manufacturers adopted it. Seedmate implements Shamir over BIP39 instead: shares are BIP39 seeds of the same length, you write the share id and k alongside each one, and merging returns the original mnemonic. You'll need a Seedmate or the offline HTML tool to merge.
   • Obfuscation. Transform S reversibly into another valid seed X. Whoever finds X gets nothing without the reverse operation, and decoy funds on X turn it into an early warning.
   • Invisible ink, or simply hiding the copies well. Sometimes simpler is better.
   • Bitcoin multisig, multi-vendor. Several keys from different manufacturers required to spend. Keep the descriptor file safe — losing it loses the funds. The final boss of self-custody.

   Every option buys security with complexity, and they combine. Find your own point on that trade-off.

5. Test it

   Whatever scheme you choose, test it thoroughly before moving real money. Wipe every wallet and rebuild from scratch, try every k-of-n combination, generate receiving addresses, send small amounts, confirm you can spend them. Then move the rest.

   Check your backups and rehearse the recovery at least twice a year.

6. Write the treasury map

   Leave instructions so your family can recover the funds if something happens to you — and so you don't forget them yourself.

   Never store seed words with the map. The map holds locations and instructions, nothing more.

7. Privacy

   Prefer non-KYC routes and learn to use P2P networks. Use anonymous payment and delivery when buying hardware wallets and related products. Those customer databases eventually leak, and being on one marks you as a holder worth visiting.

Self-custody is a demanding puzzle, and that's one reason mass adoption won't be simple. Notice how little of this list a hardware wallet actually does for you. It's all about keeping a secret safe: not losing it, not exposing it.