All articles

SLIP39 FAQs

SLIP39 is the default wallet backup standard we have set for the Trezor Safe 5 and Trezor Safe 3.
 

Trezor devices with firmware version 2.7.2 or newer support the SLIP39 Multi-share Backup feature. Older firmware versions (before 2.7.2) don’t support this feature.

Supported devices: Trezor Safe 5, Trezor Safe 3, and Trezor Model T with firmware 2.7.2 

Backward Compatibility: Devices with firmware version 2.7.2 and newer can restore older SLIP39 backups, but older firmware versions can't restore backups made with the newer Multi-share setup


SLIP39 may seem complex initially, but it becomes straightforward once you start using it. Here are some answers to common questions about Single-share and Multi-share SLIP39 backups.
 

To help you digest the full potential of SLIP39, we’ve included the basic questions at the beginning, and the more advanced questions in a separate section at the end of this FAQ.
 

SLIP39 Basic FAQs:

Who is SLIP39 for?

 

SLIP39 is for anyone who wants to increase the security of their self-custody setup. You don’t have to be an advanced user to understand SLIP39 or to use it to safely store your funds!
 

SLIP39 is designed to empower you in managing your own security. We recommend learning how SLIP39’s flexibility can support your self-custody needs.
 

What is SLIP39, and why should I use it?

 

SLIP39 is the most advanced and secure wallet backup standard.
 

In practice, SLIP39 is a simple way to back up your wallet without the need to move your funds, and a way to create future backups after your wallet was already created, which is not possible with other wallet formats.
 

SLIP39 improves your security by letting you split your wallet backup into multiple parts, called recovery shares. Unlike a standard wallet backup, SLIP39 allows you to control how many recovery shares you want and how many are needed to recover your wallet, called the threshold.
 

The threshold is the minimum number of recovery shares in one backup required to recover your wallet.


This can be helpful because you have the option to spread recovery shares across different locations, which may reduce the risk of losing access if one recovery share is lost or compromised.
 

Is SLIP39 a safe way to store my crypto?

 

At Trezor, we believe in empowering you through safe self-custody, where you securely have full control over your crypto. However, self-custody also means you’re responsible for your wallet backup, and losing it would prevent you from accessing your funds.
 

SLIP39 offers a safer, more flexible way to manage this risk compared to other backup methods.
 

What makes SLIP39 safer?

SLIP39 backups are safer for several reasons:
 

  1. Flexible backups: Unlike other backup standards, SLIP39 lets you create new backups over time without needing to move your funds to a new wallet. This adaptability allows you to add new recovery shares or adjust your setup as your needs change, helping keep your wallet secure in the long term.
  2. Multiple recovery shares: SLIP39 allows you to split your wallet backup into multiple parts (called recovery shares), which you can store in different locations. You decide how many shares to create and how many are needed to recover your wallet. This setup means that even if one share is lost, your wallet remains secure as long as you meet the minimum required shares, known as the threshold.
  3. No single point of failure: With SLIP39, you have the option to avoid a single point of failure by spreading recovery shares across secure locations.
 

What should I do if I lose access to my Trezor device? Can SLIP39 still help?

 

Yes, SLIP39 can still help you recover your wallet even if you lose access to your Trezor device. Since SLIP39 stores your wallet backup as multiple recovery shares, you can restore your wallet on a new Trezor device or another SLIP39-compatible wallet if you have enough recovery shares to meet your threshold.

 

To restore your wallet on a new device:

 

  1. Get a new Trezor device or SLIP39-compatible wallet.
  2. Enter the required number of recovery shares  (based on your threshold) to recover your wallet.
 

If you need assistance with the recovery process, refer to Trezor’s recovery guide or contact Trezor Support for additional help.
 

What is the difference between a Single-share Backup and a Multi-share Backup?

 

A Single-share Backup is a SLIP39 wallet with only one recovery share, meaning it has a 1-of-1 setup: a single recovery  share provides full access to the funds.
 

Important: When setting up a Single-share Backup, you’ll see the word “academic” appear twice in a row. This signals that your backup is a Single-share configuration.


A Multi-share Backup, on the other hand, allows you to create up to 16 recovery shares in an X-of-Y setup, where you need a specified number (X) out of the total (Y) shares to access the funds. This flexibility reduces the risk of losing access if one or more recovery shares are lost.
 

Is a Single-share or Multi-share Backup better than a standard wallet backup?

 

Choosing between a Single-share, Multi-share, or standard wallet backup depends on your personal security needs.
 

A Multi-share SLIP39 wallet can be a good option if you want to avoid a single point of failure, as it lets you create multiple recovery shares that can be stored in separate locations.
 

If you choose a Single-share SLIP39 wallet, it carries similar risks to a standard wallet since it relies on a single recovery share. This risk also applies if you upgrade from a Single-share to a Multi-share Backup but decide to keep the Single-share Backup as a master key. Keeping this additional backup can add flexibility, but it may also reduce the security benefits of a Multi-share setup.
 

Ultimately, the best setup is the one that meets your needs. With SLIP39, you can create new backups and adjust how you store your private keys over time without having to move funds to a new wallet, which is required with other wallet types.
 

If you start with a Single-share Backup and upgrade to a Multi-share Backup later, your Single-share Backup will still be valid unless you decide to securely destroy it.


Can I make multiple backups whenever I want?


Yes! One of the great advantages of SLIP39 is flexibility allowing you to update or switch backups as needed. Whether you want to switch from a Single-share to a Multi-share setup, adjust the configuration of your existing Multi-share Backup, or even revert to a Single-share, you can create a new backup at any time. For example:
 

  • Multi-share to a new Multi-share: You can create a new Multi-share Backup with a different configuration, such as changing from a 2-of-3 setup to a 3-of-5 setup for added security.
  • Multi-share to Single-share: If you decide you no longer need the complexity of a Multi-share Backup, you can move to a simpler Single-share setup.
  • Single-share to Multi-share: Conversely, if you started with a 1-of-1 single-share and want more security, you can easily switch to a Multi-share Backup.
 

In each case, the old backup remains valid and can still recover your wallet unless you decide to securely destroy it. This allows you to always have the option to adjust your security and backup strategy without losing access to your funds.
 

Which Trezor devices support SLIP39?


SLIP39 is supported by the Trezor Safe 5, Trezor Safe 3 and Trezor Model T.
 

What happens with the the Single-share Backup if I upgrade to Multi-share Backup?


When you upgrade from a Single-share Backup to a Multi-share Backup, the new configuration creates additional recovery shares.
 

The original Single-share Backup will remain valid and can still be used to access your wallet unless you securely destroy it. You can recognize your Single-share Backup by the repeated word “academic” in the 3rd and 4th positions.


For increased security and to avoid a single point of failure, consider securely destroying any copies of the Single-share Backup once you complete the Multi-share setup (e.g., by physically destroying paper backups).
 

Keeping the original Single-share Backup as a fallback is an option, but note that it may reduce some of the security benefits of a Multi-share setup, as anyone with access to the original backup could still access your wallet.
 

Can I make my original Single-share Backup part of my new Multi-share Backup?

 

No, your original Single-share Backup cannot be combined with a new Multi-share Backup, and you cannot add new shares to an existing Multi-share Backup. Each backup is created as a unique set of shares, which are not interchangeable.
 

Once a backup is set up, its configuration cannot be modified. However, you can always create new backups with different setups if you wish to update your configuration. If you create a new backup, remember to securely dispose of any old backups that you no longer need to maintain your security.
 

How many shares can I make?

 

You can make as many backups as you want, and each backup can consist of a maximum of 16 shares. You then choose a number of shares from your backup needed to access the funds, called a threshold.
 

What should I do if I lose a recovery share?

 

If you lose a recovery share, there’s no need to worry right away. As long as you still have enough remaining shares to meet the threshold you set when creating your SLIP39 backup, you can still recover your wallet. For example, if your backup is set to require 3 out of 5 shares, you’ll be able to access your wallet as long as you still have any 3 of those 5 shares.
 

However, to maintain your security, consider creating a new backup configuration if possible. With SLIP39, you can create a fresh backup with updated shares and securely dispose of the old backup if needed, helping you keep your setup resilient and up-to-date.
 

You can identify which shares belong to the same Multi-share Backup by matching the first two words on each recovery share.


What happens if I lose some recovery shares but still meet the threshold?

 

As long as you have enough recovery shares to meet your threshold, you’ll be able to recover your Multi-share Backup and access your funds. Any combination of shares that meets or exceeds the threshold will allow recovery of the wallet.
 

If you lose access to more shares than your threshold allows, you will no longer be able to recover your funds with that backup.


For example, if you create a 2-of-3 Multi-share Backup, you can lose one share and still access your funds. However, losing two shares would prevent recovery with that backup. If you still have your original Single-share Backup, you may use it as a fallback.
 

When setting up your Multi-share Backup, consider the threshold and number of shares carefully to match your needs and risk tolerance.
 

What happens if I lose more SLIP39 recovery shares than the threshold?

 

If you lose more recovery shares than your threshold allows, it won’t be possible to recover your SLIP39 wallet, and access to your funds will be permanently lost. To reduce this risk, we recommend setting a threshold and number of shares that balance security with flexibility.


SLIP39 offers the advantage of customizing your backup to suit your needs, but it’s important to keep your setup manageable. Avoid making it too complex, and ensure you have enough room to recover your wallet.
 

What are best practices for storing my recovery shares?

 

Everyone’s security setup should be catered to their needs. A general rule of thumb is to distribute recovery shares geographically, making it difficult to access the funds without access to several locations.
 

How do I test my recovery shares are valid?

 

You can easily test your Single-share and Multi-share Backups by using the Check backup feature. When using the Check backup feature, you will test the minimum number of shares required to meet the threshold and not every single recovery share. To test more shares, you will have to do a separate Check backup process with your other shares.
 

Check backup on Trezor Safe 5

Check backup on Trezor Safe 3

Check backup on Trezor Model T
 

Can I only access my SLIP39 wallet from a Trezor device?

 

Our long-term philosophy is based on open-source principles and industry-wide accessibility. When you use SLIP39, our intention is that you have the ability to use your SLIP39 wallet across multiple wallets and platforms and not just Trezor devices.
 

We strongly believe that this enhanced standard will be widely adopted by other wallet developers, and are actively encouraging its integration into other wallets through a bounty program. At this time, it is possible to import your SLIP39 wallet backup into Electrum wallet, Rabby, Sparrow and Keystone among others.
 

Advanced SLIP39 FAQs:

What is Shamir’s Secret Sharing?

 

Shamir’s Secret Sharing (SSS) is an algorithm that allows one wallet backup to be split into multiple wallet backups, called recovery shares. You need a certain number (referred to as a threshold) of these recovery shares to reconstruct the original wallet backup.
 

This makes it a secure way to back up your wallet, as no single recovery share can grant access to your key, ensuring your assets remain protected even if something happens to a share.
 

In June 2024, we introduced an updated version to our SLIP39 standard which allows you to use SSS to create backups of your wallets after they have been created.
 

Can I use a passphrase with my SLIP39 wallet?

 

Yes, you can use a passphrase with a SLIP39 wallet. However, you should be aware that this is an advanced feature which adds even more complexity to your setup.
 

If you send funds to a passphrase wallet, you must have the correct passphrase to access them. If you forget or lose the passphrase, you will not be able to access your funds!


We do not have access to any passphrases you set. Even with your complete Single-share or Multi-share Backup, you will not be able to access your funds without the passphrase if you send your funds to a passphrase wallet. 
 

Important: Make sure you properly understand how the passphrase feature works before using it. Funds secured by a passphrase cannot be recovered if you lose the passphrase! 
 
We recommend you write down your passphrase and keep it separate from both your Wallet Backup and Trezor device. Decide how many copies you want to make, but consider creating an extra copy stored in a different location for added security. Do not store any of these copies digitally - this includes as a picture on your phone, a file on your computer, or in your password manager. 

If you choose not to write down your passphrase, consider creating a hint that reminds you of it. Be cautious: if the hint is too hard to decipher and you forget the passphrase, or if beneficiaries need to guess it, you will lose access to your funds. Make sure the hint is clear and memorable, accounting for details like case sensitivity, spaces, or punctuation.


 

Does each SLIP39 recovery share contain the full private key?

 

This only happens in the case of a Single-share Backup. A Single-share Backup will be able to fully control the funds and the private key. It is not possible to access the funds with one share of a Multi-share Backup.
 

Why does the word “academic” appear twice in my Single-share Backup?

 

The word “academic” appearing twice in the third and fourth space on your backup is used to indicate that this is a Single-share Backup. It’s a similar feature to the www that appears at the beginning of a web address. If you create a Multi-share Backup in the future you may notice that one or both of these words change. The academic/academic words are not used to secure your wallet, rather they just are there to tell the Trezor that this backup consists of a single share.
 

What is the difference between BIP39 and SLIP39?

 

Let’s start with the similarities between BIP39 and SLIP39 - both standards represent your private keys by using a word list. This word list serves as your wallet backup, and your funds can be controlled by inputting the word list into a compatible device. It is not possible to change your list of words in either standard.
 

The most important difference between these two standards is that a SLIP39 wallet can be split into multiple different word lists which can then be accessed by a combination of these lists, providing a significant advantage to your security. These lists are referred to as “recovery shares”.
 

As a SLIP39 user, you are able to choose how many recovery shares you want to create, and how many of those shares are required to access your funds. The most interesting part is that these backups can be created after the wallet was created, meaning you don’t need to move your funds to a new wallet if you want to change your wallet backup setup.
 

Another difference is the list of words themselves. SLIP39 wallets use a different word list from BIP39 wallets. SLIP39’s word list is optimized for error resistance with distinguishable words, reducing the likelihood of typos and errors when performing a recovery of your wallet backup and providing a much more user friendly experience.
 

Is SLIP39 multisig?

 

SLIP39 is not multisig, although they share some similar characteristics. In the context of removing a single point of failure, SLIP39 can be seen as an alternative to multisig.
 

There are key differences between SLIP39 and BIP39, particularly in how each handles backup security and flexibility.
 

  • Once a multisig wallet is created, if the user wants to swap a key or change the amount of signatures needed, they will need to move their funds to a new wallet. With a SLIP39 wallet, it is possible to simply create a new set of backups after the wallets creation.
  • A multisig wallet consists of several keys which sign for a transaction. A SLIP39 wallet is one key which is then cryptographically split into parts. In practice, this means that your one device controls your funds with a PIN, and you don’t need to sign the transaction from multiple devices.
  • Multisig wallets require access to each key's extended public key (XPUB) for transactions. Even if you have all the signing keys, transactions cannot proceed without the full set of XPUBs, adding an extra layer of complexity in multisig setups.
 

Managing a multisig wallet requires managing multiple keys and devices which becomes complicated for a single user. Multisig is ultimately an appropriate solution for groups of people who control a single wallet, and SLIP39 is more user friendly for the individual.
 

We recommend individual users who want to distribute their keys geographically and avoid a single point of failure to use a SLIP39 Multi-share Backup instead of a multisig wallet.
 

Can I convert my existing BIP39 wallet into a SLIP39 wallet?

 

While technically possible, converting a BIP39 wallet to a SLIP39 wallet is not recommended due to several limitations and security concerns. Trezor Suite will not allow you to convert your BIP39 wallet to a SLIP39 wallet. If you chose to do this, you will need to use trezorctl, Trezor’s command-line tool.
 

There are several reasons why this approach is not recommended:
 

  1. Longer Shares: Each SLIP39 share converted from BIP39 Wallet Backup will be 59 words long, which significantly complicates both backup and recovery.
  2. Limited Passphrase Support: If you use multiple passphrases to access different wallets from one BIP39 wallet, only one passphrase wallet can be converted to SLIP39.
  3. Security Risks: Old BIP39 backups must be fully and securely destroyed to prevent unauthorized access. Users who don’t securely erase the original mnemonic face the risk of theft from any remaining copies.
 

For a safer approach, create a new SLIP39 wallet and transfer your funds there. This keeps your backup fully compatible with SLIP39’s features and reduces security and user error risks.
 

Can I convert my SLIP39 wallet into a BIP39 wallet?

 

Converting SLIP39 wallets back to BIP39 isn’t possible due to key differences in how both standards generate and secure wallets.
 

If you ever need to access your funds on a BIP39-only device, you can simply recover SLIP39 shares in a SLIP39 compatible wallet and move funds to a new BIP39 wallet. This offers compatibility without any risk of vendor lock-in.
 

How was the SLIP39 word list determined?

 

SLIP39’s word list was determined by the following criteria:
 

  • The wordlist is alphabetically sorted.
  • No word is shorter than 4 letters.
  • No word is longer than 8 letters.
  • All words begin with a unique 4-letter prefix.
  • The wordlist contains only common English words (+ the word "satoshi").
  • The minimum Damerau-Levenshtein distance between any two words is at least 2.
  • The similarity between the pronunciation of any two words has been minimized.
 

Can I split my SLIP39 recovery shares into even more layers?

 

Yes, SLIP39 offers a more advanced option called either a "two-level" or "Super Shamir" setup, allowing for greater flexibility in controlling access to your wallet backup. 

Unlike the standard single-level backup where all shares are created equally and require a single threshold (e.g., any 3-of-5 shares to recover the wallet), a two-level setup introduces an additional layer of control.
 

In a two-level SLIP39 setup:
 

  1. Group Shares: The backup is first split into groups, each with its own threshold. For example, you could assign one group to family members and another to friends.
  2. Member Shares: Each group share can then be divided further among individuals within that group, with custom requirements for each. For instance, the family group could need any 2-of-6 family members to access their share, while the friends’ group might require any 3-of-5.
 

This structure is especially useful when you want different groups to have partial access, such as in scenarios where family members might need to work with trusted friends to restore the wallet. This advanced two-level setup is not available in Trezor Suite and must be configured using trezorctl, Trezor’s command-line tool. You will also need to use trezorctl to test your recovery shares and to send funds from the wallet.

 

This is a very advanced feature and should not be used unless you know exactly what you are doing.