Announcing Penlock v1: Paper-Based Secret Splitting for BIP39 Seed Phrases

[Rama Gan]

Hello everyone,

I am thrilled to announce the public release of Penlock!

The goal is achieved! If you have a printer, scissors, a craft knife,
and a pin, you can mechanically secret-split a 12-word seed phrase
in under two hours. This includes the entire process—learning,
printing, assembling, executing, and storing the shares.

Penlock is a printable paper calculator that guides you through
splitting a seed phrase into a 2-of-3 backup. It is open-source,
uses straightforward and robust cryptography, and includes various
fail-safes that protect against errors. A beta was announced on
this list last year, and the public release is now available at:
<https://v1.penlock.io/en/>

This release breaks backward-compatibility with the beta, allowing for
enhancements that make Penlock significantly easier to operate. Here
are the main improvements in v1:

- Faster Secret-Splitting: Penlock now focuses exclusively on producing
2-of-3 backups using its own paper-optimized splitting algorithm. The
previous iteration supported K-of-M splitting with Shamir Secret
Sharing, but at the cost of more complexity and a clunkier 2-of-3
process. Since 2-of-3 covers nearly all use cases, optimizing for it
seemed like the right approach.

- Backup Strategy Template: Penlock now suggests a generic, adaptable
backup strategy that helps set up offsite recovery and trust-minimized
inheritance. In short, each share is tied to a different type of
storage: Digital, Social, and (optionally) Legal. This ensures an
attacker would have to run two different types of attacks, and makes
it hard for a party holding one share to obtain a second one. You
can find more details at <https://v1.penlock.io/en/split#strategy>.

- On-Paper Error Correction: Penlock v1 introduces what I believe to
be the first on-paper error correction algorithm. Each BIP39 word is
extended with two pre-computed parity symbols, guaranteeing per-word
unambiguous correction of 1 error and detection of 2. In practice,
it's also possible to fix a word with two errors, though it requires
a little bit of patience.

- Easier Seed Phrase Generation: Penlock also offers BIP39 seed phrase
generation as an extra feature. The whole process has been redesigned
into one of the simplest ways to generate a seed phrase by hand.

Penlock was inspired by Codex32 from Andrew Poelstra and Russell
O'Connor. It's been a two-year quest to adapt their concept for BIP39
seed phrases, iterating toward the best UX I could craft without
compromising security. These improvements often required breaking
compatibility with previous versions, which made me reluctant to
propose a public version until the design stabilized into something
final.

I believe I have finally reached the best formula I can think of,
hence this release. The feedback so far has been very positive,
and I hope you find it interesting too! Please share any feedback or
questions, and let me know what you think!

Best,
Rama Gan

P.S.: Penlock's wheel also happens to be an interesting cryptographic
puzzle—can you reverse-engineer Penlock's secret splitting algorithm
just by looking at it?