Split a secret into N shares of which any K can rebuild it — one byte at a time over GF(2⁸), the same field AES uses.
For each byte of the secret, a random degree-K−1 polynomial P(x) is generated in GF(2⁸) (irreducible polynomial 0x11B, same as AES), with the secret byte as the constant term P(0). Share i stores P(i). Any K shares recover P(0) by Lagrange interpolation; fewer reveal nothing — every possible secret byte is equally likely.
Share format: XX-HEX where XX is the x-coordinate (1–255, hex) and HEX is the concatenated P(x) byte string.
Security notes: randomness comes from crypto.getRandomValues. Keep shares separately, never on the same device. Loss of any N − K + 1 shares makes recovery impossible.