One piece of paper stands between your crypto and zero.
A seed phrase can be lost, or found — and every backup scheme trades one risk for the other. Splitting it ends the trade. Lastnote seals your seed with Shamir Secret Sharing: any three of five keys recover it, and fewer reveal mathematically nothing.
Sealed on your device — nothing uploaded · Chain-agnostic · Recovers with open tools, even without us
Fire, flood, a move, a memory. The paper is gone — so are the coins, permanently.
Anyone who reads it owns everything. Safes get opened; photo backups get synced.
Every folk remedy trades one for the other. More copies — more theft surface. Fewer copies — more loss risk. A safer hiding spot — a spot your heirs will never find. The trade-off isn't a discipline problem. It's a structural one.
Below the threshold, there is nothing to steal.
Lastnote splits your vault's key with Shamir Secret Sharing — published in 1979, used by HSMs and root key ceremonies ever since. Pick a threshold: 3‑of‑5, 2‑of‑3, 4‑of‑7.
- Lose two of five? Still recoverable. The threshold tolerates loss by design.
- One or two stolen? Below the threshold, the keys carry zero information about the secret — not "hard to crack," but information-theoretically nothing.
- Coercion-resistant. No single person — you included — can be forced to produce the funds. The $5 wrench needs three victims in three places.
Any three recover it. Two reveal nothing — literally.
Multisig protects you. It doesn't protect your family.
Your family can't co-sign a transaction. They can read a booklet. Every Lastnote vault prints a Recovery Codex — the format spec plus a single-file Python script — so a threshold of trustees and any competent developer can recover the vault decades from now, with no Lastnote, no wallet expertise, and no chain-specific anything.
Fireproof, waterproof — and still one findable, stealable object.
Protects your transactions. Chain-specific, and your family can't operate it.
Shamir, but bound to one vendor's devices and firmware.
Someone else's keys entirely. You know the phrase.
The floor is public.
The format specification, a single-file reference decryptor, and a known-good test vault are published under Apache-2.0. Every release runs a dead-company drill in CI: decrypt the fixture using only the public tools. Your exit doesn't depend on our uptime, our goodwill, or our existence.
Sealing runs entirely client-side — keys are generated, split, and encrypted in your browser. Open the network tab and watch. That's the review we want.
spec/— the vault format, every constant declaredlastnote_recover.py— single-file reference, no dependencies on usfixtures/— a known vault + keys to verify against
CI decrypts the fixture on every release — the dead-company drill.
We never see your seed, and never hold enough keys to matter. Below the threshold, a key is mathematically silent.
Fair questions.
Do you ever see my seed phrase?
No. The vault is sealed entirely in your browser — key generation, encryption, and Shamir splitting all run client-side. Nothing leaves your device unless you explicitly choose hosted storage for the (already encrypted) vault file. Watch the network tab while you seal; we invite exactly that scrutiny.
Never digitize your seed — isn't typing it into a browser a violation?
For the strictest threat models, two answers. First: seal on an air-gapped machine — the sealing page and the recovery path both work offline. Second: don't vault the seed at all — vault the map. Where the plates are, which safe, what the passphrase hint means. A thief who reads one key gets nothing; your heirs who assemble the threshold get everything they need.
Which chains does it support?
All of them, trivially: Lastnote stores bytes, not transactions. A BIP-39 phrase, an XMR seed, a passphrase, a keystore file, a text file of instructions — the vault is chain-agnostic because it never touches a chain.
Why not just use multisig?
Use both — they solve different problems. Multisig protects operations while you're alive and competent. It does nothing for inheritance: your family can't co-sign a transaction, and each chain needs its own setup. A Shamir-split vault with a printed recovery booklet is something a grieving family can actually execute — with help from any competent developer, no wallet expertise required.
What happens if Lastnote disappears?
Your vault still opens. The format spec, a single-file Python reference implementation, and a test vault are published in a public Apache-2.0 repository. Every release runs a dead-company drill in CI: decrypt the fixture vault using only the public tools. If we vanish, recovery is an afternoon's work with the printed booklet.
What does it cost?
Sealing and recovering are free, forever — the cryptography is never paywalled. Paid plans add the living layer: check-ins that notice when you stop responding, and hosted recovery that brings your trustees together without anyone having to organize it. That layer is optional; the math isn't.
Split it once. Sleep after.
Sealing is free and takes minutes — your keys, your people, and nothing on our side we could ever read.
Read first: the public spec & reference implementation