Friends Backup: Recover Your Vault Without Giving Anyone The Keys
Friends backup splits your master key into four shares. Three people you trust can recover the vault — MATA never holds the keys. Here's how it works.
Self-custody has one historic failure mode: lose the keys and nothing comes back. Not a support ticket. Not a "forgot password" link. Not MATA. Friends backup is how you keep that property — nobody else can open your vault — and still survive a house fire, a stolen bag, or a life that outlives you.
Friends backup cryptographically splits your master key into four shares using Shamir's Secret Sharing. Each trusted person holds one share. One share is noise. Two shares are still noise. Three of the four, used together, rebuild the key. MATA never sees the pieces and never holds a spare. This article is the long form of the IAMHUMAN & Your Peers era feature; the click-by-click setup is step 10 of the Freedom Guide.
Why Friends Backup Exists When You Own The Keys
A cloud password manager can reset you because they hold a copy. That is the product. It is also the breach surface, the subpoena surface, and the "we shut down and took your vault with us" surface. Local-first encryption inverts that: the Foundation of Trust vault lives on your devices, sealed with keys derived from your passphrase. There is no reset email, by design. The National Institute of Standards and Technology's authenticator guidance is blunt about the trade — device-bound credentials are stronger precisely because a remote party cannot mint a replacement.
That trade is only livable if recovery is someone else's problem in a cryptographic sense, not a company's. Social recovery — Friends backup — is that design. You still own the vault. You still choose who can help. No holder can act alone. The brand primitives of Trust, Security, and Incentive all land here: you trust specific people, not an institution; the math is the security; the incentive is that your digital life survives the day every phone and laptop you own does not.
Without Friends backup, the honest warning is the one already in account setup: lose the devices and the passphrase and you have no shares configured, and the data is gone. That is the same property that stops us from reading it. Friends backup does not weaken that. It spreads the emergency exit across people you already rely on.
How Friends Backup Splits The Master Key
Friends backup does not upload your vault to a friend. It does not give them a login. It gives them a shard of a secret that is useless until enough shards meet. The algorithm is Shamir's Secret Sharing — a 1979 construction that is still the standard way to split a key so that any k of n pieces rebuild it and any fewer reconstruct nothing.
Four Shares, Three To Rebuild — Shamir's Secret Sharing
MATA's Friends backup uses n = 4 shares and k = 3. Four people you name each receive one share. Any three of them can reconstruct the master key. Two cannot. One cannot. There is no "admin share" sitting on a MATA server to break the threshold. The Electronic Frontier Foundation's surveillance self-defense work keeps repeating the same lesson: recovery that requires a vendor is recovery the vendor (or whoever compels the vendor) can abuse. Threshold shares are how you refuse that.
The share a friend holds is not your passphrase, not your password list, not your bank snapshot. It is a fragment of the key that unlocks those things — and only when combined with two others. If their device is stolen in isolation, the thief gets a blob that does not open your vault.
What A Friends Backup Holder Can Actually See
A Friends backup holder cannot browse your Wallet & Identity screen. They cannot export your passwords. They cannot impersonate your DID. Their job is custody of a shard, the way a co-signer holds a sealed envelope, not a spare house key that works on its own.
That is the part people miss when they hear "give your friends access." Friends backup is not access. It is the option of access, gated by a quorum of people who have to decide together that you need help — or that you are gone and the people you named should inherit. The Federal Trade Commission's consumer privacy guidance is a catalog of what happens when one party holds the whole secret. Quorum is the opposite of that catalog.
Recovery Versus Succession With Friends Backup
Use Friends backup for two different days.
Recovery is you, still here, with no remaining device. House fire. Bag stolen on a trip. Every laptop wiped. Three of your four holders meet (in person, or through whatever ceremony you agreed in advance), reconstruct the key, and you are back in. You still need a new device and a new passkey; the share-quorum replaces the vendor reset, not the hardware.
Succession is the same math after you are not here to type the passphrase. A spouse, a sibling, an adult child — the people who would inherit a safe-deposit box — can rebuild the vault the same way, without anyone having been able to open it while you were alive. That is the clean digital succession the Eras of Digital Freedom roadmap keeps pointing at: inherit the data the way you inherit a locked box, not the way you beg a platform for a dead person's account.
How To Set Up Friends Backup Without Weakening Security
Friends backup is only as strong as the people and the process. The cryptography does not care if you picked four roommates who share a Discord server and a group chat full of screenshots. Pick holders the way you would pick executors.
Who Should Hold Your Friends Backup Shares
Name four people who will still pick up the phone in five years. Mix households. Do not put all four shares in the same family that travels together, or in the same office that floods. Geographic spread is not paranoia — it is how you keep a single disaster from taking three holders at once.
Tell each person what they are holding, in plain language: a recovery share, not a login. Tell them who the other holders are, or at least how to find them, so a reconstruction is not a scavenger hunt. Revisit the list when someone moves, dies, or falls out of your life. A stale Friends backup is a lock with no combination.
This sits next to the rest of Era 2 — device pairing, IAMHUMAN, passwords that sync without a cloud copy. The five eras roadmap is the long arc; Friends backup is the piece that makes self-custody survivable.
What Happens If You Lose Every Device
You do not message MATA. We cannot help, and that is the point. You contact three holders. They combine shares, reconstruct the master key, and you enroll a new device. Your imported passwords and the rest of the vault come back because they were never on our servers waiting to be "restored" — they were on your mesh, and the key is what makes them readable again.
If you also lost the passphrase and never set up Friends backup, there is no third path. Write the passphrase down, lock it up, and configure shares. Paper in a safe plus Friends backup is layered. Either one alone is a single point of failure you chose.
What Friends Backup Does Not Replace
Friends backup does not replace keeping two devices healthy. It does not replace the passphrase. It does not replace retiring a phone you no longer use so a ghost device does not rejoin the mesh with a stale vault map. And it does not make MATA a custodian. If a holder tries to reconstruct without you and without a succession event you intended, they still need two other people to agree. That social friction is a feature.
Start with the vault you already have — identity, passwords, the Digital Freedom basics — then turn on Friends backup before you need it. Step 10 of the Freedom Guide is the setup. The day you are glad it exists will not be a day you feel like reading documentation.