Smart Split
The method behind One Step Ahead. Encrypts your data, splits the key into 3 parts, and ensures any 2 out of 3 are enough to recover everything. Simple by design. Auditable by anyone.
The Core Idea
One secret. Three fragments. Any two recover everything. No single fragment is ever enough.
Encrypt
Your data is encrypted using AES-256-GCM with a unique 66-character random key generated for that operation only. The key never exists in full in any single output.
Split
The key is divided into three equal portions. Each fragment receives the full encrypted data plus two of the three key portions. Any single fragment is incomplete.
Recover
Present any two fragments. The app identifies which key portions are present, reconstructs the full key, and decrypts your data. Order does not matter.
How the Split Works
A 66-character random key is generated for every encryption operation. This key is divided into three equal 22-character portions — Leading, Middle, and Trailing.
Three fragments are produced. Each fragment contains the full encrypted payload plus two of the three portions:
- Fragment ALeading + Middle
- Fragment BMiddle + Trailing
- Fragment CLeading + Trailing
Any two fragments together contain all three portions. The full key can always be reconstructed. No single fragment ever holds enough to decrypt alone.
Security Properties
What Smart Split guarantees — and what it does not. We believe in stating both clearly.
✓ What Smart Split protects against
- Loss or destruction of a single fragment
- Unauthorized access to a single fragment
- Accidental deletion of one fragment
- Data corruption — detected via integrity verification
- Vendor lock-in — reconstruction is fully documented and open
✗ What Smart Split does not protect against
- An attacker who obtains two or more fragments
- Malware present at the moment of encryption
- Coercion or forced disclosure of multiple fragments
- Loss of all three fragments
How It Compares to Other Approaches
Smart Split was designed with specific goals. Understanding those goals explains the design choices.
Smart Split vs Shamir Secret Sharing (SSS)
SSS is a well-established mathematical approach to secret sharing with strong theoretical properties. Smart Split is not SSS and does not claim to be. SSS was deliberately not used for one primary reason: cross-platform interoperability.
Smart Split runs identically across iOS, macOS, PHP, Python, and JavaScript — string slicing and SHA-256 leave no room for interpretation. SSS implementations across different languages require precise agreement on polynomial coefficients, byte ordering, and encoding choices. Any ambiguity creates incompatibility risk. For a system where independent reconstruction is a core design goal, that ambiguity is itself a single point of failure.
In practice, both systems protect a single fragment against brute force through computational infeasibility. The key difference is theoretical — SSS provides an information-theoretic guarantee that a single share reveals zero about the secret mathematically. Smart Split's single-fragment security is computational. This tradeoff is openly documented in the White Paper.
Smart Split vs Cloud Backup
Cloud backups centralise your data on a third-party server — creating exactly the single point of failure Smart Split is designed to eliminate. A breach, account lockout, or service shutdown can expose or permanently cut off access. Smart Split keeps everything on your devices, under your control, with no external dependency.
Smart Split vs a Single Encrypted File
A single encrypted file is only as safe as the device or location that holds it. One fire, one theft, one corrupted drive — and it is gone. Smart Split distributes the risk across three independent locations so no single event can cause total loss.
Open and Auditable
Smart Split is designed so that anyone can reconstruct data without the app. The full method is published in the White Paper — the key derivation, the split logic, the encryption parameters, everything.
This means One Step Ahead is never a single point of failure for your recovery. If the app disappears, a developer can build a recovery tool from the public spec in any language. That is a deliberate design goal, not an afterthought.
The use of SHA-256, AES-256-GCM, and string slicing — rather than more exotic primitives — was a conscious choice. Every component is well understood, independently verifiable, and implementable without specialised cryptographic libraries.
See Smart Split in Action
Download One Step Ahead free and protect your first secret in under two minutes.