Split BIP39 words by hand I'm thinking about a way to split the bip39 words (by hand) and I would like to have some opinions on it.
The aim is to store the word list in several locations, I came with something inspired by one-time-pads.
Example with a 6 words list: wrist orient foil naive shock predict
Step 1: convert the words with their numeric index
Words (W):
1: wrist   -&gt; 2035
2: orient  -&gt; 1252
3: foil    -&gt; 723
4: naive   -&gt; 1173
5: shock   -&gt; 1586
6: predict -&gt; 1357

Step 2: Prepare two sets, each half filled with random numbers between [0; 2047]
Set 1 (S1):
1:
2:
3:
4: random -&gt; 1050
5: random -&gt; 1779
6: random -&gt; 556

Set 2 (S1):
1: random -&gt; 1889
2: random -&gt; 1074
3: random -&gt; 914
4: 
5: 
6: 

Step 3: fill the missing values of each set in order that S1[i] + S2[i] = W[i]
Set 1 (S1):
1: (2048 + W[1] - S2[1]) % 2048 -&gt; (2048 + (wrist=2035) - 1889) % 2048 -&gt; 146
2: (2048 + W[2] - S2[2]) % 2048 -&gt; (2048 + (orient=1252) - 1074) % 2048 -&gt; 178
3: (2048 + W[3] - S2[3]) % 2048 -&gt; (2048 + (foil=723) - 914) % 2048 -&gt; 1857
4: random -&gt; 1050
5: random -&gt; 1779
6: random -&gt; 556

Set 2 (S2):
1: random -&gt; 1889
2: random -&gt; 1074
3: random -&gt; 914
4: (2048 + W[4] - S1[4]) % 2048 -&gt; (2048 + (naive=1173) - 1050) % 2048 -&gt; 123
5: (2048 + W[5] - S1[5]) % 2048 -&gt; (2048 + (shock=1586) - 1779) % 2048 -&gt; 1855
6: (2048 + W[6] - S1[6]) % 2048 -&gt; (2048 + (predict=1357) - 556) % 2048 -&gt; 801

Step 4: write words of the sets with the values as word index
Set 1 (S1):
1: 146 -&gt; banana
2: 178 -&gt; bike
3: 1857 -&gt; trend
4: random -&gt; 1050 -&gt; lobster
5: random -&gt; 1779 -&gt; tattoo
6: random -&gt; 556 -&gt; earth

Set 2 (S2):
1: random -&gt; 1889 -&gt; ugly
2: random -&gt; 1074 -&gt; mail
3: random -&gt; 914 -&gt; impulse
4: 123 -&gt; aunt
5: 1855 -&gt; treat
6: 801 -&gt; goat

Advantages:

You ends up with two sets that looks like valid bip39 words (except for checksums).
You can do this with 2 or more sets.
One (ore more) leaking set does not compromise the private key at all (as long as at least one is kept secret, words are safe).
In case someone asks (if you are physically threatened) you can give the robber your 1/n part of the key, or plausibly says that you misswritten your words (bad checksum), you cannot find back the key at the moment anyway (other parts are located elsewhere).

To find back the words, you simply have to sum each set:
Words (W):
1: S1[1] + S2[1] -&gt; (146 + 1889) % 2048 -&gt; 2035 -&gt; wrist
2: S1[2] + S2[2] -&gt; (178 + 1074) % 2048  -&gt; 1252 -&gt; orient
3: S1[3] + S2[3] -&gt; (1857 + 914) % 2048  -&gt; 723 -&gt; foil
4: S1[4] + S2[4] -&gt; (1050 + 123) % 2048  -&gt; 1173 -&gt; naive
5: S1[5] + S2[5] -&gt; (1779 + 1855) % 2048  -&gt; 1586 -&gt; shock
6: S1[6] + S2[6] -&gt; (556 + 801) % 2048  -&gt; 1357 -&gt; predict

I'd like to know if someone sees any problem or a better solution for this case.
Best practice is not to split up your seed words.
There are many different clever ways one can store their bitcoin back-ups and the way you described might be one of those ways. It may work for you and that's great, but it isn't an approach that would be generally recommended or accepted.

The aim is to store the word list in several locations

Generally, it is recommended to use multisig if you want to split up any sensitive data that will be used to sign a transaction.
Alternatively, you can add a BIP39 passphrase that could be stored separately from your seed words.