> For the complete documentation index, see [llms.txt](https://help.enterprise.ledger.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.enterprise.ledger.com/help-center-v2/administration/onboarding/master-seed-recovery.md). # Recovering the master seed How the three Shared Owners recover the master seed of a hosted Workspace on a Ledger Nano S Plus, and how the master seed is derived from their recovery phrases. This page explains how the master seed of a hosted Workspace is derived. It also gives the procedure that recovers it outside the Hardware Security Module (HSM). **Role: Shared Owners.** > **Warning:** The recovered master seed controls the keys of every Account in the Workspace. Outside the HSM, the Rules and approval steps of the Workspace do not apply. Anyone who holds the recovered master seed can move the funds. ## When this applies * Recovery is a disaster procedure. It puts the master seed on a device outside the HSM, so that you can move the funds to other addresses. * It applies to a hosted Workspace only. An on-premises Workspace has no Shared Owners. See [**Workspace onboarding**](/help-center-v2/administration/onboarding.md). * It needs the 24-word recovery phrases of all three Shared Owner devices. With two phrases, the master seed cannot be recovered. ## How the master seed is derived The derivation uses the open standards [BIP39](https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki) and [BIP32](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki). 1. Each Shared Owner device has a 24-word recovery phrase that follows BIP39. The derivation uses no BIP39 passphrase. 2. From each phrase, BIP39 gives a 512-bit seed, and BIP32 gives a master key. 3. From each master key, BIP32 derives the key at the path `m/5655636'/4932953'`. This 512-bit key is the shard of that Shared Owner. 4. The HSM combines the three shards with an XOR operation. The result is the master seed. 5. The master seed is the BIP32 seed of the root key of the Workspace. The keys and addresses of every Account derive from this root key. During [Workspace onboarding](/help-center-v2/administration/onboarding.md), each Shared Owner device sends its shard to the HSM over an encrypted channel. The HSM does the XOR operation. The master seed never leaves the HSM. The derivation is one way. You cannot encode the master seed back into a 24-word recovery phrase. ## Recover on a Ledger Nano S Plus This is the method that Ledger recommends. The Nano S Plus computes the master seed offline, and keeps it in its secure environment. ### What you need * A Ledger Nano S Plus with firmware version 1.0.4 or later. * A computer with the Ledger Wallet app, to update the firmware. See [Ledger Wallet](https://www.ledger.com/ledger-live). * The recovery page: [web.enterprise.ledger.com/recover](https://web.enterprise.ledger.com/recover). * The 24-word recovery phrases of the three Shared Owners. ### Before you begin * Decide which Shared Owner starts the recovery. * The first Shared Owner sets the PIN of the Nano S Plus. The PIN has 4 to 8 digits. * If the recovery takes several sessions, the first Shared Owner gives the PIN to the two other Shared Owners. You can change the PIN at any time. * The Nano S Plus must have no PIN and no seed when the recovery starts. ### Prepare the Nano S Plus If the Nano S Plus is new, start at step 6. 1. Connect the Nano S Plus to the computer with its USB-C cable. 2. Enter the PIN. 3. Press both buttons briefly. 4. Go to **Settings** > **Security** > **Reset device**. 5. Confirm the reset. As an alternative to steps 2 to 5, enter a wrong PIN three times in a row. 6. Use Ledger Wallet to update the firmware to version 1.0.4 or later. 7. When the update is complete, disconnect the device. To start the Nano S Plus in recovery mode, do these steps: 1. Connect the USB end of the cable to the computer. 2. Press and hold the left button of the Nano S Plus. 3. Connect the USB-C end of the cable to the Nano S Plus. 4. Keep the button pressed until the boot menu shows. 5. Select **Recovery mode**, the second entry in the menu. 6. Press both buttons to confirm. ### Recover with the three Shared Owners together Use this procedure when the three Shared Owners are at the same place at the same time. **Start the recovery:** 1. Go to [web.enterprise.ledger.com/recover](https://web.enterprise.ledger.com/recover). 2. Select **Recover the master seed**. 3. Select **I’ve read the recovery process**. 4. Select **Start recovery**. 5. Start the Nano S Plus in recovery mode. 6. On the recovery page, select **My device is ready**. **The first Shared Owner:** 1. On the Nano S Plus, press both buttons on the **Start** screen of the recovery. 2. Press both buttons to create a PIN. 3. Use the right and left buttons to enter a PIN of 4 to 8 digits. 4. Select the check mark. Then press both buttons. 5. Enter the PIN again. 6. Select the check mark. Then press both buttons. 7. Press both buttons to start the entry of your 24 words. 8. For each word, select the correct word. Then press both buttons. 9. When the 24 words are entered, press both buttons to go to the next Shared Owner. **The second and the third Shared Owners**, one after the other: 1. Press both buttons to start the entry of your recovery phrase. 2. For each word, select the correct word. Then press both buttons. 3. When the 24 words are entered, press both buttons to go to the next Shared Owner. **Finish the recovery:** 1. On the Nano S Plus, press both buttons on the **Done** screen of the recovery. 2. On the recovery page, select **I’ve completed all the steps**. ### Recover in several sessions Use this procedure only when the three Shared Owners cannot meet. The device travels between the Shared Owners, with its PIN. **The first Shared Owner:** 1. Do the steps in [Start the recovery](#recover-with-the-three-shared-owners-together). 2. Do the steps for the first Shared Owner, up to the end of the 24 words. 3. Disconnect the Nano S Plus. 4. Send the Nano S Plus to the next Shared Owner. **Each of the two other Shared Owners**, one after the other: 1. Go to [web.enterprise.ledger.com/recover](https://web.enterprise.ledger.com/recover). 2. Select **Recover a share**. 3. Select **I’ve read the recovery process**. 4. Select **Start recovery**. 5. Start the Nano S Plus in recovery mode. 6. On the recovery page, select **My device is ready**. 7. On the Nano S Plus, press both buttons on the **Start** screen of the recovery. 8. Use the right and left buttons to enter the PIN from the first Shared Owner. 9. Select the check mark. Then press both buttons. 10. On the recovery page, select **My device is ready** again. 11. Press and hold both buttons to select the **continue** screen of the recovery. 12. Press both buttons to start the entry of your recovery phrase. The device shows **Enter phrase 2** for the second Shared Owner, and **Enter phrase 3** for the third. 13. For each word, select the correct word. Then press both buttons. 14. When the processing screen closes, disconnect the device. 15. On the recovery page, select **I’ve completed all the steps**. The second Shared Owner then sends the Nano S Plus to the third Shared Owner. After the third phrase, the third Shared Owner presses both buttons on the **Done** screen of the recovery. ### Result The Nano S Plus holds the master seed of your Workspace. Use it with Ledger Wallet to reach the funds of your Accounts, and transfer them to other addresses. ## Recompute the master seed on a computer Ledger does not recommend this method. You can recompute the master seed and the root key from the three recovery phrases with a computer: * With Ledger's [open-source master seed recovery tool](https://github.com/LedgerHQ/vault_seed_recovery). It asks for the three recovery phrases, and gives the master seed and the root key. * With open-source BIP39 and BIP32 libraries, such as bip-utils, and the derivation on this page. If you recompute the master seed on a computer, do it offline, on an air-gapped computer. Do not connect that computer to a network again until the funds are moved to new addresses that you control. ## What can go wrong * **A recovery phrase is missing.** The master seed needs all three shards. Two phrases are not enough. * **A word is wrong.** A different phrase gives a different shard, and so a different master seed. Check each word against the recovery phrase of the Shared Owner. * **You try to restore the master seed from a 24-word phrase.** The master seed has no 24-word form. Recover it on a Nano S Plus, or recompute it from the three phrases. ## Related * [**Workspace onboarding**](/help-center-v2/administration/onboarding.md) * [**The security model**](/help-center-v2/concepts/the-security-model.md) * [**Your security device**](/help-center-v2/start-here/get-started/your-device.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://help.enterprise.ledger.com/help-center-v2/administration/onboarding/master-seed-recovery.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.