CLI

The CLI binary is safeparts. It reads from stdin by default and writes to stdout unless you pass -o.

Split

Split a secret from stdin into 3 shares, requiring any 2 to recover:

echo -n "my secret" | safeparts split -k 2 -n 3 -e base64

Write shares to a file:

echo -n "my secret" | safeparts split -k 2 -n 3 -e base64 -o shares.txt

Combine

Combine from stdin (any k shares):

printf "%s\n%s\n" "<share1>" "<share2>" | safeparts combine

Write the recovered secret to a file:

printf "%s\n%s\n" "<share1>" "<share2>" | safeparts combine -o secret.bin

Passphrases

Caution

Prefer —passphrase-file over —passphrase in shells that keep history.

Split with a passphrase:

echo -n "my secret" | safeparts split -k 2 -n 3 -e base64 -P passphrase.txt

Combine with a passphrase:

printf "%s\n%s\n" "<share1>" "<share2>" | safeparts combine -P passphrase.txt

Practical workflow

1. Do a practice run with a synthetic secret.
2. Split the real secret.
3. Store shares in separate places.
4. Immediately test recovery with k shares.
5. Delete the original secret from temporary locations.

Troubleshooting

• no shares provided: input was empty or only whitespace.
• could not detect share encoding: pass —encoding explicitly.
• combine failed: shares are from different sets, corrupted, or the passphrase is wrong.