How we keep you safe.
Non-custodial, offline-first, and open source. Verify the threat model and the cryptographic core yourself.
Three rules. No exceptions.
Non-custodial
We never hold the key to your funds, only you do. Seedcase can't access, recover, or transmit your seed phrase on your behalf, by design.
Offline-first
No internet connection is required, ever. Fragmentation, encryption, reconstruction: every operation runs entirely on your machine.
Open source core
The cryptographic engine is open source and auditable on GitHub. Anyone can inspect how fragments are created and reconstructed.
Shamir is safe by design.
A fragment below the threshold reveals nothing about your seed phrase. That is not a probability. It is an information-theoretic guarantee: the secret is not hidden in the share. It is absent.
The same scheme protects the DNS root keys that underpin the internet. Seven trusted community members hold shares. Five must meet to reconstruct.
- course
- graduate
- academic
- acid
- detect
- wireless
- pregnant
- warmth
- aunt
- domestic
- educate
- ticket
- firm
- mental
- perfect
- else
- gravity
- alarm
- buyer
- mountain
Don't trust. Verify.
The seed is never written to disk
It exists in memory only during fragmentation, then it is erased. Never cached, never logged, never stored in plaintext. View the repository
No network during cryptographic operations
The application makes no outbound calls while fragmentation, encryption, or reconstruction is running. No usage data, no crash reports, no telemetry.
SLIP-39, not a Seedcase format
Seedcase uses a standard that any compatible tool can read. If Seedcase disappears, your fragments still work. Read the SLIP-39 specification
An independent audit is planned before the V1 stable release. The full report will be published. We will announce the date once contracted.
What we protect against. And what we don't.
Seedcase protects against
Loss of one or several fragments
An M-of-N scheme is designed for this. As long as M fragments survive, your seed phrase can be fully reconstructed.
Theft of a single fragment
An attacker holding fewer than M fragments learns nothing about your seed phrase.
Single point of failure
No fire, no flood, no lost notebook can wipe out your access if your fragments are distributed across locations.
Service shutdown or company failure
Seedcase is non-custodial. If the project disappears tomorrow, your fragments still work; the format is an open standard.
Seedcase does not protect against
A compromised machine during fragmentation
If your computer has malware reading memory or keystrokes when you enter your seed phrase, no software can save you. Use a clean, preferably air-gapped device for the initial fragmentation. An old laptop, wiped and never reconnected to the internet, works perfectly.
Coercion of M or more fragment holders
If someone forces M people to give up their fragments simultaneously, the seed phrase can be reconstructed. You can get around this with an encryption password. Gathering the fragments is then no longer enough: reconstruction still requires the password.