What Are Private Keys?

A private key is a secret 256-bit number that proves you control a specific piece of cryptocurrency and authorizes you to spend it. Your wallet uses that number to produce a digital signature on every transaction you send, and the network verifies the signature before accepting the payment.

Whoever holds the private key holds the funds. There is no account, no login, no identity check, and no support desk with the power to override the math.

Most people never see one. Modern wallets hide private keys behind a recovery phrase and generate thousands of them quietly in the background, which is how five separate objects, private keys, seed phrases, public keys, wallet addresses, and extended public keys, ended up being used as though they were the same thing. They are not, and the differences decide which ones you can hand to a stranger.

Key Takeaways

• A private key is a randomly generated 256-bit number. Everything else in your wallet, including your public keys and your Bitcoin addresses, is derived from it.
• Key derivation runs one way. A public key comes from a private key in milliseconds, and no practical method exists to reverse the calculation.
• A recovery phrase sits one level above your private keys. Under the BIP-39 and BIP-32 standards, twelve or twenty-four words generate a master seed that can produce an effectively unlimited tree of private keys.
• A private key, a wallet password, and a BIP-39 passphrase are three different things with three different consequences when lost.
• An extended public key (xpub) cannot spend your funds, but it exposes every address in a branch of your wallet, so it should be treated as private.
• Bitcoin has never been broken by someone guessing a private key. Every large theft traced to key material has come from weak random number generation, malware, or a person being tricked.
• Chainalysis data shows personal wallet compromises rising from 7.3% of all stolen crypto value in 2022 to 44% in 2024, which makes individual key security the dominant loss vector rather than protocol failure.
• Tools and services advertising that they can find or recover a lost private key are, with narrow technical exceptions, either fraudulent or malware.

What Is a Private Key?

A private key is a number. Not a password, not a file, not a certificate. A number, 256 bits long, which is 32 bytes of data.

Written in decimal, a Bitcoin private key can be any integer from 1 up to slightly below this value:

115,792,089,237,316,195,423,570,985,008,687,907,852,837,564,279,074,904,382,605,163,141,518,161,494,337

That upper bound is the order of the secp256k1 elliptic curve, the specific curve Bitcoin uses, defined in the Standards for Efficient Cryptography Group’s SEC 2 specification. Keys outside the range are invalid, and wallet software checks for this, though the chance of randomly landing outside it is small enough to ignore.

The formats you see in wallets are all display conventions wrapped around that one number. Hexadecimal, wallet import format, and a twelve-word phrase are different clothes on the same value.

Two consequences follow from the fact that a private key is only a number.

First, nobody issues them. There is no registry, no application, and no approval. Generating a Bitcoin account means picking a large random number, which is why anyone anywhere with a device can create one. That property is what makes Bitcoin permissionless.

Second, the number is the asset. Bitcoin is a bearer instrument. Possession of the key is possession of the value, in the same way possession of a banknote is possession of the money. Copy a private key and you have not copied the coins, you have created a second person who can spend them.

What Does a Private Key Look Like?

Here is one real private key shown in the formats a wallet might display. This particular key has been published in Bitcoin documentation and code libraries for over a decade and is used here purely as an illustration. Never send funds to any address derived from it.

Wallet import format is not a different key. It is the same 256-bit number encoded in Base58Check, with three things bolted on: a network prefix byte (0x80 for mainnet, 0xEF for testnet), an optional compression flag byte, and a four-byte checksum derived from a double SHA-256 hash.

That checksum is the practical reason WIF exists. Mistype one character in a raw hex key and you get a different, perfectly valid key that controls an empty wallet. Mistype one character in a WIF string and the checksum fails, so the software rejects it and tells you something is wrong. Base58 also removes the four characters most often confused by eye: zero, capital O, capital I, and lowercase l.

A key starting with 6P will not import anywhere without its password. People occasionally find an old paper wallet, try to sweep it, and conclude the funds are gone when the key is simply encrypted.

How Private Keys Are Generated

Your wallet asks the operating system for random data, takes 256 bits of it, and checks that the resulting number falls inside the valid range. That is the whole process.

Everything rests on the quality of the randomness. A cryptographically secure pseudorandom number generator draws on unpredictable physical sources such as hardware timing jitter, thermal noise, and interrupt timings. A hardware wallet usually adds a dedicated true random number generator inside its secure element.

The size of the number space is what makes this work. With 256 bits there are roughly 1.16 × 10^77 possible keys, a figure with no useful comparison in the physical world. The probability that two wallets independently generate the same key is not zero in the mathematical sense, but it is far enough below every other risk you face that it never needs considering.

That protection holds only if the randomness is real. When the random number generator is broken, the key space collapses from 2^256 to whatever the generator can actually produce, and every key it ever made becomes reachable by brute force. This is the failure mode behind essentially every headline about “cracked” Bitcoin wallets, and it is covered in detail further down.

Two practices remain genuinely dangerous as a result.

• Brain wallets: Deriving a key by hashing a memorized passphrase. Attackers have precomputed enormous dictionaries of hashed phrases, including whole books and song lyrics, and sweep the resulting addresses automatically. Any passphrase a human can remember is a passphrase a machine can guess.
• Homemade randomness: Dice rolls done correctly are secure, but almost everything else people improvise, including timestamps, keyboard mashing, and general-purpose programming language random functions, is not.

Let the wallet do it. Key generation is one of the few areas where the standard tooling is strictly better than anything you will build.

What Is a Seed Phrase?

A seed phrase, also called a recovery phrase or mnemonic phrase, is a list of twelve or twenty-four ordinary words that encodes the master secret for an entire wallet. It sits one level above your private keys in the wallet’s structure, which is why restoring a phrase brings back every address you have ever used rather than a single one.

The standard behind it is BIP-39, published in 2013 and now near-universal across Bitcoin and other chains. The mechanism explains several things that otherwise look like bugs.

1. The wallet generates 128 bits of entropy for a twelve-word phrase, or 256 bits for twenty-four words.
2. It appends a checksum, four bits for twelve words and eight bits for twenty-four, taken from the SHA-256 hash of that entropy.
3. The combined bits are split into groups of eleven. Each group of eleven bits indexes one word from a fixed list of 2,048 words. Eleven bits gives exactly 2,048 possibilities, which is why the word list is that length.
4. The resulting words, in order, are your phrase.

The English word list is deliberately designed for handwriting. No two words share the same first four letters, so recording only the first four characters of each word is enough to reconstruct the phrase, and a misread word is more likely to fail than to silently resolve to a different valid one.

The phrase then passes through a key stretching function called PBKDF2, using HMAC-SHA512 over 2,048 iterations, to produce a 512-bit master seed. The salt for that function is the string “mnemonic” plus an optional user-supplied passphrase, which is the detail that makes the passphrase feature so powerful and so easy to misuse.

A wrong word almost always fails the checksum, so the wallet refuses the phrase outright instead of silently opening a different one. In the rare case where a mistake still passes the check, you will be looking at a completely different, empty wallet. Word order carries meaning for the same reason, since each position maps to a specific group of bits.

One Seed Phrase, Many Private Keys

The master seed feeds into BIP-32, the hierarchical deterministic wallet standard. The seed produces a master private key and a master chain code, and from that pair the wallet can derive child keys, and from each child, further children, without limit.

The full chain runs like this:

Recovery phrase → master seed → extended private key → individual private keys → public keys → addresses

Every step after the phrase is deterministic. The same phrase entered into any compatible wallet, anywhere, will regenerate the identical tree of keys. Nothing is stored on a server, and nothing about your wallet exists anywhere except as a computation from those words.

This is why a single private key and a recovery phrase are not interchangeable in a loss scenario. A private key gives control over the funds locked to its own public key and nothing else. A recovery phrase gives control over everything the wallet ever derived, and everything it ever will.

What a Derivation Path Is

Because one seed can produce an unlimited tree, wallets need an agreed convention for which branch to look at. BIP-44 established the structure, written as a path:

m / purpose' / coin_type' / account' / change / address_index

Later proposals assigned a purpose number to each address type:

The coin_type field is 0 for Bitcoin and 60 for Ethereum, which is how one phrase can control assets on multiple chains.

The practical relevance is that two wallets can read the same correct phrase and show you different balances if they default to different paths. Restoring a twelve-word phrase into a new app and finding nothing there is far more often a path mismatch than a theft, and diagnosing and fixing that is a matter of pointing the software at the right branch.

What Is a Public Key?

A public key is a point on the secp256k1 curve, calculated by multiplying the curve’s fixed generator point by your private key. The operation is written as K = k × G, where k is your private key.

Elliptic curve multiplication is a trapdoor function. Computing K from k takes microseconds. Recovering k from K would require solving the elliptic curve discrete logarithm problem, for which no efficient method is known after decades of academic attack.

Public keys come in two encodings:

• Compressed, 33 bytes, beginning with 02 or 03. This is the modern default and stores only the x coordinate plus a byte indicating which of the two possible y values applies.
• Uncompressed, 65 bytes, beginning with 04. This stores both coordinates in full and appears mainly in older wallets and legacy key material.

The public key’s job is verification. When your wallet signs a transaction, the network uses the public key to confirm the signature could only have been produced by the matching private key, without ever learning what that private key is. Bitcoin uses ECDSA for most transaction types and Schnorr signatures, introduced in BIP-340, for Taproot spends.

A public key is not an address. The address is a further transformation of it, hashed and then encoded into the formats you paste into a wallet.

What Is an Extended Public Key?

BIP-32 defines two extended keys at every level of the wallet tree.

An extended private key, displayed as a string beginning xprv, contains a private key plus a chain code. Together those allow derivation of every private key below it. An xprv for your account level is functionally equivalent to your recovery phrase for that account, and it must be protected identically.

An extended public key, beginning xpub, contains a public key plus the same chain code. It can derive every public key and every address below it, and it cannot produce a single signature.

That combination makes xpubs genuinely useful. Merchants generate a fresh address per customer from an xpub sitting on a web server, with no spending capability anywhere near the internet. Portfolio trackers and watch-only wallets monitor balances the same way. Accountants reconcile transaction history without touching funds.

It also makes them a surveillance object. Hand someone your xpub and they can enumerate every address in that branch, past and future, look up all of them in a block explorer, and read your complete balance and transaction history indefinitely. They cannot take anything. They can watch everything.

There is a sharper failure case that surprises even experienced users. Under non-hardened derivation, an xpub combined with any single child private key from that branch is mathematically sufficient to reconstruct the parent extended private key, and therefore every key in the branch. Hardened derivation, marked by the apostrophe in paths such as m/84'/0'/0', exists specifically to block this, which is why account-level path components are hardened by convention.

You may also encounter ypub, zpub, and vpub. These encode the same information with a different version prefix that tells the wallet which address type to generate, and mixing them up produces the empty-wallet symptom described earlier.

How It All Connects

Every object in your wallet occupies a fixed position in one chain, and its position determines what it can do.

Read down the table and the security model becomes a single rule. Anything that can regenerate a private key must stay secret. Anything that can only be derived from a private key is safe from theft, though it may still cost you privacy.

What Can You Safely Share?

Two entries deserve a note.

A transaction ID gives away no control at all, so sharing it to prove a payment or chase a confirmation is normal and safe. It does reveal the addresses and amounts involved to anyone who looks it up, which is a privacy consideration rather than a security one.

An xpub is the item most often mishandled, because the word “public” in its name suggests it belongs in the same category as your receiving address. Support staff, tax tools, and portfolio apps all have legitimate reasons to request one. Anyone asking for it through an unsolicited message does not.

How Passwords, PINs, and Passphrases Differ from Keys

Four terms get used loosely, and the consequences of confusing them are not symmetric.

The first three are access controls. They live on a device or on a file, they can be reset by restoring from your recovery information, and an attacker who gets one without also getting your phrase has gained nothing on-chain.

The BIP-39 passphrase is a different category entirely. It enters the PBKDF2 salt when the phrase is converted to a seed, so adding it produces a completely different wallet from the same twelve words, with different keys and different addresses. There is no error message for a wrong passphrase, because every passphrase produces a technically valid wallet. Enter the wrong one and you will see an empty balance and no explanation.

This is why it is sometimes described as plausible deniability: the same phrase can hold a decoy wallet with no passphrase and a real wallet behind one. It is also why more people lose funds to passphrases than are protected by them.

In the Bitcoin.com Wallet, each individual crypto wallet inside the app receives its own separate twelve-word recovery phrase, so an account holding Bitcoin, Ethereum, and Polygon wallets has three phrases to record. The optional Cloud Backup encrypts all of that recovery information into a single file stored in your own Google Drive or iCloud account, decrypted by a master password you choose. Bitcoin.com stores neither the master password nor the recovery phrases, so recovery without one of them is not possible for anyone, including us.

Some wallet interfaces use the word “passphrase” to mean the twelve-word recovery phrase. Elsewhere in the industry, “passphrase” means the BIP-39 extra word. Check which one an app means before typing anything into a field with that label.

How Private Keys Get Stolen

Attacks on key material overwhelmingly target people and devices, not cryptography.

The scale of that shift is measurable. Chainalysis found that personal wallet compromises accounted for 7.3% of all stolen crypto value in 2022, rising to 44% by 2024. In 2025 the share would have been roughly 37% had the single Bybit incident not distorted the annual total. Individual key security is now where most crypto is actually lost.

The common thread is that none of these break the key. They collect it, and the broader fraud landscape is built around persuading people to hand it over.

Can a Private Key Be Cracked?

Not by guessing.

Suppose you commanded hardware capable of testing one trillion keys per second, and you ran one trillion such machines in parallel. That gives 10^24 keys tested per second. Against 1.16 × 10^77 possible keys, exhausting the space would take on the order of 10^45 years. The universe is roughly 1.4 × 10^10 years old. Adding more machines does not meaningfully change the outcome, because the space grows exponentially with key length while hardware grows linearly.

Every real theft attributed to “cracked” keys has been an entropy failure instead, where the wallet software never used the full key space in the first place.

The clearest documented case is Milk Sad, catalogued as CVE-2023-39910. Libbitcoin Explorer versions 3.0.0 through 3.6.0 generated wallet seeds using the Mersenne Twister pseudorandom number generator seeded with 32 bits of system time. That reduced the effective key space from 2^256 to 2^32, roughly 4.3 billion possibilities, which consumer hardware can exhaust in days. Attackers did exactly that, with the main coordinated sweep of affected wallets taking place on July 12, 2023. The researchers’ full disclosure documents the discovery and the related flaw in a browser wallet extension, tracked as CVE-2023-31290, which shared the same root cause.

The name comes from the first two words of the first phrase the broken generator produced. Every affected wallet was built on unbreakable cryptography, and every one of them was emptied.

Quantum computing is the one theoretical route to the private key itself, since Shor’s algorithm could in principle solve the discrete logarithm problem that protects public keys. No machine capable of this exists, estimates of the resources required continue to move, and the National Institute of Standards and Technology has standardized replacement signature schemes while recommending that organizations complete migration by 2035. Bitcoin has not adopted one, and proposals for how it might are working through the improvement process. Against every classical computer that exists or is projected to exist, a properly generated private key is safe.

Why Private Key Finder Tools Do Not Work

Search for a lost key and you will find software promising to scan, recover, or brute-force private keys, often alongside databases claiming to list keys with balances.

The arithmetic above settles the question. Software that could find a funded private key by searching would have broken Bitcoin, and Bitcoin would be worthless rather than the target of an advertisement. Nothing being sold has that capability.

What these products actually do falls into a few patterns:

• Malware delivery: The downloaded tool scans your device for existing wallet files, seed phrase photos, and browser extension data, then exfiltrates them.
• Phrase harvesting: A web form invites you to enter your partial or full phrase “to check it”, and the funds move within minutes.
• Advance fee fraud: A service takes an upfront payment to begin recovery, produces progress reports, and requests further payments for fees, taxes, or unlocking charges.
• Theatre: A scanner runs visibly for hours, generating random keys and finding nothing, because that is all it can do.

A narrow category of legitimate technical recovery does exist. Extracting data from a physically damaged hardware wallet, repairing a phrase with one or two missing words where the checksum constrains the search, or brute-forcing an encryption password whose structure you partly remember are all real engineering problems with real solutions. Those services describe precisely what they can and cannot do, and never ask for a complete phrase.

Anyone who contacts you first, offering to recover funds you have already lost, is running the second scam against victims of the first.

If Your Keys or Recovery Phrase Are Exposed

Exposure means the wallet is compromised permanently. Changing a PIN or reinstalling an app achieves nothing, because the attacker can rebuild the wallet on their own device from the phrase alone.

Four steps, in order:

1. Generate a new wallet on a clean device. If the original device may carry malware, do not use it. Write down the new phrase offline before proceeding.
2. Move the funds immediately. Send everything to an address from the new wallet. Automated bots monitor compromised addresses and can sweep incoming balances within seconds of arrival.
3. Revoke any outstanding token approvals associated with the old addresses, so that contracts cannot pull assets later.
4. Retire the old phrase entirely. It can never be made safe again. Do not reuse it, and do not leave dust behind that you might one day try to recover.

If the funds are large enough that a sweeping bot would beat you to a manual transfer, cold storage is the right destination for whatever you rescue.

A note on the custodial case. If you bought crypto on an exchange and never withdrew it, you hold no private key at all. The platform holds it, your login is an access credential to their system rather than to the blockchain, and a compromised account is a support problem instead of a cryptographic one. The tradeoffs between holding your own keys and letting a platform hold them shape which of these scenarios you can ever be in.

Conclusion

A private key is a very large random number, and every other piece of your wallet is either derived from it or protects it. Public keys and addresses flow downward from the key and can be shared. Recovery phrases and extended private keys sit above it and control everything beneath. Extended public keys occupy the middle position, harmless to your balance and dangerous to your privacy.

The cryptography has held since 2009. What fails is the handling: broken random number generators, phrases photographed onto phones that sync to the cloud, and people persuaded to type twelve words into a form. Knowing which object you are holding, and which category it falls into, prevents most of that. For amounts you could not afford to lose, multi-signature arrangements and MPC key splitting remove the single point of failure that one phrase creates, which is the main reason to weigh security features when choosing a wallet.