Private Key

Wallet Updated Feb 2026

What is a Private Key?

A private key is a secret cryptographic number that controls a blockchain address. Whoever holds the private key can spend the funds associated with that address. It’s the digital equivalent of the key to your safe — except there’s no lockpicker or locksmith who can help you if you lose it.

Private keys are generated using elliptic curve cryptography (specifically the secp256k1 curve), the same cryptographic system used by Bitcoin, Ethereum, and most other blockchains.

A private key looks like this (do NOT use this example):

0x4c0883a69102937d6231471b5dbb6204fe5129617082792ae468d01a3f362318

Or as a 64-character hex string without the 0x prefix. It’s paired with a public key (and by extension, a blockchain address) through a one-way mathematical function.

How Private Keys Work

The Key Pair

Every blockchain address is derived from a key pair:

Private Key (secret) → [ECDSA math] → Public Key (shareable) → [Hash] → Address (shareable)

Private Key: 256-bit random number. MUST be kept secret.
Public Key: Derived from the private key via elliptic curve multiplication. Safe to share.
Address: A hash of the public key. This is what you share to receive funds.

The relationship is one-way: you can derive a public key from a private key, but you cannot derive a private key from a public key. This is the foundation of asymmetric cryptography.

Signing Transactions

When you send a transaction, your wallet uses your private key to create a digital signature:

Your wallet creates a transaction (to, from, amount, gas)
The private key signs the transaction data
The network verifies the signature against your public key
If valid, the transaction is accepted

The signature proves you own the funds without revealing your private key. It’s like signing a check — the signature proves authorization, but doesn’t reveal how you write it.

Where Private Keys Are Stored

In Software Wallets (Hot Wallets)

Stored encrypted on your device (phone or computer)
Protected by a PIN or password
Decrypted in memory when signing transactions
Risk: Malware, keyloggers, clipboard hijackers can steal the key

In Hardware Wallets (Cold Wallets)

Stored on a secure chip that never exposes the private key
Transactions are signed inside the device
The key never leaves the hardware, even when connected to a computer
Even if your computer is infected, the key is safe

In Exchanges (Custodial)

The exchange holds your private keys
You don’t actually own the crypto — you have an IOU
Risk: Exchange could be hacked (Mt. Gox, FTX), freeze your account, or go bankrupt

“Not your keys, not your coins” — if you don’t hold the private key, you don’t truly own the cryptocurrency.

Private Key Security

Generating a Secure Key

A private key is only as secure as its randomness. If the random number generator (RNG) is predictable, the key can be guessed.

Good wallets: Use cryptographically secure RNG (CSPRNG) — e.g., browser crypto.getRandomValues()
Bad wallets: Use Math.random() or timestamps — predictable and exploitable

The 256-bit key space (2^256 possible keys) is astronomically large — larger than the number of atoms in the observable universe. Brute-forcing a properly generated key is physically impossible.

Key Compromise Scenarios

Attack	How It Works	Prevention
Keylogger	Malware records keystrokes when you type/import keys	Use hardware wallet, never type keys on computer
Clipboard hijacker	Malware swaps addresses you copy-paste	Verify address before confirming
Phishing	Fake website tricks you into entering seed phrase	Never enter seed phrase anywhere
Brain wallet	Key derived from a password/phrase (crackable)	Use random keys, never brain wallets
Side channel	Timing/power analysis extracts key	Use hardware wallet (secure chip)
RNG exploit	Weak randomness makes key predictable	Use reputable wallets with audited RNG

Private Key Formats

Hexadecimal (Raw)

4c0883a69102937d6231471b5dbb6204fe5129617082792ae468d01a3f362318

WIF (Wallet Import Format) — Bitcoin

5Kb8kLf9zgWQnogidDA76MzPL6TsZZY36hWXMssSzNydYXYB9KF

Derivation from Seed Phrase

Most modern wallets don’t show raw private keys. Instead, they derive them from your seed phrase using HD wallet standards (BIP-32/44). Each address has its own private key, all generated from the master seed.

Keystore File (Encrypted)

Some wallets (like older MyEtherWallet) use encrypted JSON files containing the private key, protected by a password:

{
  "address": "008aeeda4d805471df9b2a5b0f38a0c3bcba786b",
  "crypto": {
    "cipher": "aes-128-ctr",
    "ciphertext": "5318b4d5bcd28de64ee5559e671352e9...",
    "kdf": "scrypt",
    "kdfparams": { "n": 262144, "dklen": 32, ... }
  }
}

What Happens If Your Key Is Compromised

If someone obtains your private key:

They can immediately transfer all your funds
Transactions are irreversible — you can’t recall them
There’s no fraud department to call — this is the trade-off of self-custody
The attacker can also sign messages as you (social engineering risk)

This is why hardware wallets are essential for storing significant value. They keep your private keys on a secure chip that never connects to the internet.

Frequently Asked Questions

Q: Can someone guess my private key? A: No. The probability is effectively zero. 2^256 is a number so large that even if every computer on Earth tried trillions of keys per second, it would take longer than the age of the universe.

Q: What’s the difference between a private key and a seed phrase? A: A seed phrase generates many private keys (one per address). A private key controls one specific address. See our seed phrase guide for details.

Q: Can I change my private key? A: You can generate a new address with a new key, but you can’t change the key of an existing address. To “change keys,” create a new wallet and transfer your funds.