user109003: I use a 24 word seed for my private key. I split the 24 words into 16 words in three pieces of paper, so one needs to have at least two pieces of paper to recover the wallet. However my question is, if someone gets one piece of paper, can they easily brute force the remaining 8 words?

user47827: Andreas Antonpoulos answers this question here. He calls this reduction from 256 bit entropy to 80 bit entropy a "catastrophic reduction in security". He estimates that it would take a cluster of machines up to a decade to brute force the remaining 8 words. It is certainly not an effective long term wealth storage solution. Perhaps it could work as a short term solution whilst you prepared a more robust solution. But most certainly, use at your own risk.

user109015: Other answers correctly state that leaking 16 words of a 24 word key significantly compromises security. I would add that you have an alternative option which wouldn't compromise security.
Using Shamir's Secret Sharing, you can encode your key on three separate pieces of paper such that:

You need at least two pieces of paper to recover the original key
If someone gets just one piece of paper, they can't learn anything (not even with unlimited resources) about your key from it

It looks like there's at least one easy to use command line implementation of the algorithm for encoding strings, sss-cli. Note that I have not verified its implementation.

user-1: Ideally you shouldn't share any words and brute forcing with one paper in your case may take time but still possible. Also if someone gets one paper he can try social engineering to get another. Below links might help in understanding things involved in brute forcing.
https://medium.com/@johncantrell97/how-i-checked-over-1-trillion-mnemonics-in-30-hours-to-win-a-bitcoin-635fe051a752
https://twitter.com/JohnCantrell97/status/1274024510786883584
TLDR:
With 8 known words there are 2⁴⁰ (~1.1 trillion) possible mnemonics
To test a single mnemonic we have to generate a seed from the mnemonic, master private key from the seed, and an address from the master private key
Usage of GPU for brute forcing
Tx fee is normally high during such attacks
Open source code that was used:
BIP39-Solver-CPU: This is the CPU benchmark tool he wrote in Rust to get an idea of how long it will take do solve on a CPU for certain number of unknown words.
https://github.com/johncantrell97/bip39-solver-cpu
BIP39-Solver-GPU: This is the actual GPU version he ran on each worker GPU to solve this problem.
https://github.com/johncantrell97/bip39-solver-gpu
BIP39-Solver-Server: This is the actual server he ran that handled distributing the work to all the workers.
https://github.com/johncantrell97/bip39-solver-server
It would take the same system that brute forced the last 4 words of his mnemonic 837 quintillion millennium to brute force all possible 12 word mnemonics.

109003: <p>I use a 24 word seed for my private key. I split the 24 words into 16 words in three pieces of paper, so one needs to have at least two pieces of paper to recover the wallet. However my question is, if someone gets one piece of paper, can they easily brute force the remaining 8 words?</p>
 47827: <p>Andreas Antonpoulos answers this question <a href="https://www.youtube.com/watch?v=p5nSibpfHYE" rel="noreferrer">here</a>. He calls this reduction from 256 bit entropy to 80 bit entropy a &quot;catastrophic reduction in security&quot;. He estimates that it would take a cluster of machines up to a decade to brute force the remaining 8 words. It is certainly not an effective long term wealth storage solution. Perhaps it could work as a short term solution whilst you prepared a more robust solution. But most certainly, use at your own risk.</p>
 109015: <p>Other answers correctly state that leaking 16 words of a 24 word key significantly compromises security. I would add that you have an alternative option which wouldn't compromise security.</p>
<p>Using <a href="https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing" rel="nofollow noreferrer">Shamir's Secret Sharing</a>, you can encode your key on three separate pieces of paper such that:</p>
<ul>
<li>You need at least two pieces of paper to recover the original key</li>
<li>If someone gets just one piece of paper, they can't learn <em>anything</em> (not even with unlimited resources) about your key from it</li>
</ul>
<p>It looks like there's at least one easy to use command line implementation of the algorithm for encoding strings, <a href="https://github.com/dsprenkels/sss-cli" rel="nofollow noreferrer">sss-cli</a>. Note that I have not verified its implementation.</p>
 -1: <p>Ideally you shouldn't share any words and brute forcing with one paper in your case may take time but still possible. Also if someone gets one paper he can try social engineering to get another. Below links might help in understanding things involved in brute forcing.</p>
<p><a href="https://medium.com/@johncantrell97/how-i-checked-over-1-trillion-mnemonics-in-30-hours-to-win-a-bitcoin-635fe051a752" rel="nofollow noreferrer">https://medium.com/@johncantrell97/how-i-checked-over-1-trillion-mnemonics-in-30-hours-to-win-a-bitcoin-635fe051a752</a></p>
<p><a href="https://twitter.com/JohnCantrell97/status/1274024510786883584" rel="nofollow noreferrer">https://twitter.com/JohnCantrell97/status/1274024510786883584</a></p>
<p>TLDR:</p>
<p>With 8 known words there are 2⁴⁰ (~1.1 trillion) possible mnemonics</p>
<p>To test a single mnemonic we have to generate a seed from the mnemonic, master private key from the seed, and an address from the master private key</p>
<p>Usage of GPU for brute forcing</p>
<p>Tx fee is normally high during such attacks</p>
<p>Open source code that was used:</p>
<p>BIP39-Solver-CPU: This is the CPU benchmark tool he wrote in Rust to get an idea of how long it will take do solve on a CPU for certain number of unknown words.</p>
<p><a href="https://github.com/johncantrell97/bip39-solver-cpu" rel="nofollow noreferrer">https://github.com/johncantrell97/bip39-solver-cpu</a></p>
<p>BIP39-Solver-GPU: This is the actual GPU version he ran on each worker GPU to solve this problem.</p>
<p><a href="https://github.com/johncantrell97/bip39-solver-gpu" rel="nofollow noreferrer">https://github.com/johncantrell97/bip39-solver-gpu</a></p>
<p>BIP39-Solver-Server: This is the actual server he ran that handled distributing the work to all the workers.</p>
<p><a href="https://github.com/johncantrell97/bip39-solver-server" rel="nofollow noreferrer">https://github.com/johncantrell97/bip39-solver-server</a></p>
<p>It would take the same system that brute forced the last 4 words of his mnemonic 837 quintillion millennium to brute force all possible 12 word mnemonics.</p>
