How Recovery Shards Work: Splitting a Key So No One Holds It Alone

A truly private vault has a hard edge to it. If only you can open your documents and passwords, then losing the way in means losing the vault. So most people fall back on a single recovery secret: one passphrase, written on one card, kept in one drawer. It works right up until the day it does not.

One secret is fragile in both directions. Lose it and you are locked out forever. Hand a copy to someone for safekeeping and now one person holds the keys to your entire life. Recovery shards solve this by refusing to put all that power, or all that risk, in a single place.

The problem with one secret

Imagine your master key written on a single slip of paper. Everything hinges on that slip. If it burns in a fire, floods in a basement, or simply gets thrown out with old mail, the vault seals permanently. If instead you copy it and give the copy to a relative, you have traded fragility for a different problem: that one relative can now open everything, at any time, with no one else involved.

Both failures come from the same root. You concentrated all the trust and all the risk into a single object or a single person. What you actually want is to spread it out, so no one point can lose the key and no one point can misuse it.

What a recovery shard is

A shard is one piece of a key that has been mathematically split into several parts. The important trick is that a shard on its own reveals nothing about the key. It is not a fragment you could squint at and guess the rest from. It is only meaningful in combination with enough of its siblings.

This is a well understood idea in cryptography called threshold secret sharing. You choose how many pieces exist in total and how many are needed to rebuild the whole. Kinship Vault uses a 3 of 5 arrangement: the key is split into five shards, and any three of them reconstruct it.

No single shard is the key, and no single shard holder can open your vault alone.

Why 3 of 5 is the sweet spot

The two numbers do different jobs. The total (5) is how widely you spread the pieces. The threshold (3) is how many must come together to recover. The gap between them is deliberate slack.

• It tolerates loss. Because you only need three of the five, up to two shards can be lost, damaged, or unreachable and you can still get back in. One person moving house, changing phones, or being on a plane does not strand you.
• It resists misuse. No two people can quietly collude to open your vault, because two is below the threshold. It takes a genuine majority of your chosen circle to act.
• It stays human. Three trusted people is a realistic number to actually gather in a real emergency, without being so few that any single loss is fatal.

How you hold and share the shards

In Kinship Vault this lives in the Recovery Network. You choose the trusted contacts, and each shard can be handed over in whatever form fits that person:

• A QR code they scan and keep in their own vault.
• A small file they store safely.
• A printed PDF card for a drawer or a safe.

Because the shards were generated on your device from a key that never left it, and no Kinship Vault server ever holds the vault, distributing the shards does not quietly leak the key to anyone in the middle. You are handing out sealed pieces, not the whole.

Recovery today, inheritance tomorrow

The same structure quietly solves a second problem. Threshold recovery is not only for the day you drop your phone in a lake. It is also how a family reaches what they need if you cannot act. Three trusted people, each holding a piece, can come together and reconstruct access, and no one of them could have done it alone or behind the others' backs. That is a far calmer arrangement than leaving a full passphrase in a note somewhere and hoping. We go deeper on the family side in our digital inheritance guide.