Recovery shares are Shamir Secret Sharing fragments of the vault master key. Eternum uses a 3-of-5 threshold.
Share holders
A beneficiary needs at least three valid shares to recover the vault.
Trusted-contact shares are first encrypted with a bootstrap key. During activation, the trusted contact re-seals the share to their own key pair and protects the private key with a passphrase.
Cold backup share
The cold backup share is intended for offline storage. It is displayed during setup and should be printed or saved outside the app.
If you close the setup session before saving the cold backup, the app cannot display the same backup share again. Rotate credentials to regenerate recovery shares.
Device share
The device share normally lives only in your browser. During setup you can print it once as a second offline backup; after you print it, the app purges it from the browser and cannot show it again. A printed device share can be entered during recovery the same way as a cold backup. Keeping both offline shares means the vault stays recoverable even if both trusted contacts are unavailable (platform share + two printed shares meet the 3-of-5 threshold). 
