For crypto self-custody

One piece of paper stands between your crypto and zero.

A seed phrase can be lost, or found — and every backup scheme trades one risk for the other. Splitting it ends the trade. Lastnote seals your seed with Shamir Secret Sharing: any three of five keys recover it, and fewer reveal mathematically nothing.

Sealed on your device — nothing uploaded  ·  Chain-agnostic  ·  Recovers with open tools, even without us

Failure mode one Loss

Fire, flood, a move, a memory. The paper is gone — so are the coins, permanently.

Failure mode two Theft

Anyone who reads it owns everything. Safes get opened; photo backups get synced.

Every folk remedy trades one for the other. More copies — more theft surface. Fewer copies — more loss risk. A safer hiding spot — a spot your heirs will never find. The trade-off isn't a discipline problem. It's a structural one.

How the math ends the trade

Below the threshold, there is nothing to steal.

Lastnote splits your vault's key with Shamir Secret Sharing — published in 1979, used by HSMs and root key ceremonies ever since. Pick a threshold: 3‑of‑5, 2‑of‑3, 4‑of‑7.

  • Lose two of five? Still recoverable. The threshold tolerates loss by design.
  • One or two stolen? Below the threshold, the keys carry zero information about the secret — not "hard to crack," but information-theoretically nothing.
  • Coercion-resistant. No single person — you included — can be forced to produce the funds. The $5 wrench needs three victims in three places.
The part multisig can't do

Multisig protects you. It doesn't protect your family.

Your family can't co-sign a transaction. They can read a booklet. Every Lastnote vault prints a Recovery Codex — the format spec plus a single-file Python script — so a threshold of trustees and any competent developer can recover the vault decades from now, with no Lastnote, no wallet expertise, and no chain-specific anything.

vs. a metal plate

Fireproof, waterproof — and still one findable, stealable object.

vs. multisig

Protects your transactions. Chain-specific, and your family can't operate it.

vs. SLIP-39 hardware

Shamir, but bound to one vendor's devices and firmware.

vs. an exchange

Someone else's keys entirely. You know the phrase.

Verify, don't trust

The floor is public.

The format specification, a single-file reference decryptor, and a known-good test vault are published under Apache-2.0. Every release runs a dead-company drill in CI: decrypt the fixture using only the public tools. Your exit doesn't depend on our uptime, our goodwill, or our existence.

Sealing runs entirely client-side — keys are generated, split, and encrypted in your browser. Open the network tab and watch. That's the review we want.

github.com/edbyrne/lastnote-recovery

lastnote-recovery Apache-2.0
  • spec/ — the vault format, every constant declared
  • lastnote_recover.py — single-file reference, no dependencies on us
  • fixtures/ — a known vault + keys to verify against

CI decrypts the fixture on every release — the dead-company drill.

We never see your seed, and never hold enough keys to matter. Below the threshold, a key is mathematically silent.

Asked by people who read whitepapers

Fair questions.

Do you ever see my seed phrase?

No. The vault is sealed entirely in your browser — key generation, encryption, and Shamir splitting all run client-side. Nothing leaves your device unless you explicitly choose hosted storage for the (already encrypted) vault file. Watch the network tab while you seal; we invite exactly that scrutiny.

Never digitize your seed — isn't typing it into a browser a violation?

For the strictest threat models, two answers. First: seal on an air-gapped machine — the sealing page and the recovery path both work offline. Second: don't vault the seed at all — vault the map. Where the plates are, which safe, what the passphrase hint means. A thief who reads one key gets nothing; your heirs who assemble the threshold get everything they need.

Which chains does it support?

All of them, trivially: Lastnote stores bytes, not transactions. A BIP-39 phrase, an XMR seed, a passphrase, a keystore file, a text file of instructions — the vault is chain-agnostic because it never touches a chain.

Why not just use multisig?

Use both — they solve different problems. Multisig protects operations while you're alive and competent. It does nothing for inheritance: your family can't co-sign a transaction, and each chain needs its own setup. A Shamir-split vault with a printed recovery booklet is something a grieving family can actually execute — with help from any competent developer, no wallet expertise required.

What happens if Lastnote disappears?

Your vault still opens. The format spec, a single-file Python reference implementation, and a test vault are published in a public Apache-2.0 repository. Every release runs a dead-company drill in CI: decrypt the fixture vault using only the public tools. If we vanish, recovery is an afternoon's work with the printed booklet.

What does it cost?

Sealing and recovering are free, forever — the cryptography is never paywalled. Paid plans add the living layer: check-ins that notice when you stop responding, and hosted recovery that brings your trustees together without anyone having to organize it. That layer is optional; the math isn't.

Split it once. Sleep after.

Sealing is free and takes minutes — your keys, your people, and nothing on our side we could ever read.

Read first: the public spec & reference implementation

Feedback