What does someone with fewer than the threshold shares actually learn?

Nothing about the secret's value at all — not even a narrowed-down range. With one share short of the threshold, every possible secret from 0 up to the prime still has exactly one polynomial consistent with the shares held, so the missing share isn't hard to guess, it's genuinely undetermined by the information available. That's what "information-theoretically secure" means here, as opposed to merely computationally hard.

What happens if a shareholder submits a wrong value?

The reconstruction runs anyway and produces a wrong answer with no warning, since this scheme has no way to tell a genuine share from a corrupted one. Real deployments add a verification step (verifiable secret sharing) specifically to catch this, which is not implemented in this teaching version.

Secret Sharing Generator

Shamir's scheme rests on one fact: two points determine a line, three determine a parabola, and k points determine a polynomial of degree k−1. Hide the secret as the constant term, hand out points, and any k of them rebuild it while k−1 leave every value equally possible. This issues the shares and then reconstructs from every single combination of the threshold. These parameters are far too small to protect anything and are chosen so the arithmetic can be followed by hand. This is a teaching demonstration, not a security tool — real work belongs in a reviewed cryptographic library.

Secret (0–60)

The number to split. Everything here works modulo the prime 61.

How many shares

How many people receive a piece.

Threshold

How many shares are needed to recover the secret. Fewer reveal nothing at all.

Seed (optional)

A word reproduces the same values — useful for teaching, useless for secrecy.

Your result will appear here.

What this generator does

Hides the secret as the constant term of a random polynomial over a small prime field, issues one point per share, and then reconstructs by Lagrange interpolation from every combination of exactly the threshold.

How to use this tool

Choose a secret between 0 and 60.
Set how many shares to issue and how many are needed.
Read the shares — each is a point on a hidden polynomial.
Check the note: every combination of the threshold was tried.

Understanding the controls

Secret: A number below 61, the prime this works over. Everything is done in modular arithmetic so the shares reveal nothing about the size of the secret.
How many shares: Between 2 and 8 people each receive one point on the hidden polynomial.
Threshold: How many are needed. Fewer than this leave the secret genuinely undetermined, not merely hard to guess.
Seed: Reproduces the same polynomial, which is useful for teaching and useless for secrecy.

Worked examples

Secret 30, seeded with "demo": 5 shares issued from a threshold of 3: (1,29), (2,46), (3,20), (4,12), (5,22). Every one of the 10 possible combinations of 3 shares reconstructs 30 exactly — including combinations that share no share with each other's first pick.

Common use cases

Demonstrating threshold secret sharing with numbers you can check
Teaching why k points determine a polynomial of degree k−1
Producing worked examples for a cryptography or algebra class
Showing what information-theoretic security actually means
Generating share sets for a puzzle or escape-room exercise

How this generator works

A random polynomial of degree one less than the threshold is built with the secret as its constant term, and each share is that polynomial evaluated at a different point. Lagrange interpolation at zero recovers the constant term from any k points. Working modulo a prime is what makes it secure rather than merely awkward: with k−1 shares, every possible secret still has exactly one polynomial fitting the points, so nothing at all is leaked. Before display every combination of the threshold is reconstructed, and all must return the secret.

Randomness and fairness

Uses your browser's cryptographic random source for the polynomial coefficients by default. A seed switches to a reproducible sequence, which is deterministic and not cryptographically secure. These parameters are far too small to protect anything and are chosen so the arithmetic can be followed by hand. This is a teaching demonstration, not a security tool — real work belongs in a reviewed cryptographic library.

For how randomness is produced across the whole site, see how Generate Random works.

Limitations and good to know

The prime field is tiny, so a secret here is a number below 61 rather than a real key — real implementations use large fields and split bytes.
Shares are not authenticated, so a participant who supplies a wrong share silently corrupts the reconstruction.
The scheme protects confidentiality, not availability: losing more than the spare shares makes the secret unrecoverable forever.
This demonstrates the mathematics and should not be used to split anything that matters.

Privacy and your data

Shares are generated in your browser and never transmitted, stored or included in analytics.

Frequently asked questions

What does someone with fewer than the threshold shares actually learn?: Nothing about the secret's value at all — not even a narrowed-down range. With one share short of the threshold, every possible secret from 0 up to the prime still has exactly one polynomial consistent with the shares held, so the missing share isn't hard to guess, it's genuinely undetermined by the information available. That's what "information-theoretically secure" means here, as opposed to merely computationally hard.
What happens if a shareholder submits a wrong value?: The reconstruction runs anyway and produces a wrong answer with no warning, since this scheme has no way to tell a genuine share from a corrupted one. Real deployments add a verification step (verifiable secret sharing) specifically to catch this, which is not implemented in this teaching version.