> ## Documentation Index
> Fetch the complete documentation index at: https://docs.archivecircle.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Recovery shares

> Understand the 3-of-5 recovery share design.

Recovery shares are Shamir Secret Sharing fragments of the vault master key. Eternum uses a 3-of-5 threshold.

## Share holders

| Share | Holder                                     |
| ----- | ------------------------------------------ |
| 1     | Trusted contact                            |
| 2     | Trusted contact                            |
| 3     | Platform share                             |
| 4     | Device share (printable once during setup) |
| 5     | Cold backup share                          |

A beneficiary needs at least three valid shares to recover the vault.

## Trusted-contact shares

Trusted-contact shares are first encrypted with a bootstrap key. During activation, the trusted contact re-seals the share to their own key pair and protects the private key with a passphrase.

## Cold backup share

The cold backup share is intended for offline storage. It is displayed during setup and should be printed or saved outside the app.

<Warning>
  If you close the setup session before saving the cold backup, the app cannot display the same backup share again. Rotate credentials to regenerate recovery shares.
</Warning>

## Device share

The device share normally lives only in your browser. During setup you can print it once as a second offline backup; after you print it, the app purges it from the browser and cannot show it again. A printed device share can be entered during recovery the same way as a cold backup. Keeping both offline shares means the vault stays recoverable even if both trusted contacts are unavailable (platform share + two printed shares meet the 3-of-5 threshold).