What is a private key in crypto?

A private key in plain words

The crypto itself is recorded on the blockchain, the shared record of all transfers on a network, and each address there has its own balance. Your wallet stores the private key private key, which lets you control the balance of your address¹.

Picture a mailbox with a slot in the shared hallway of an apartment building. Everyone knows the box number, and anyone can drop a letter through the slot. Only the person with the key can open the box and take the letters out. An address on the blockchain is like the number of that mailbox, and you can give it to any sender. A private key is like the key to the box, except that no locksmith exists who could make a copy. A spare key exists only if you made one yourself in advance, by writing down your seed phrase or setting up a recovery method your wallet offers.

The wallet creates the key itself by picking a very large number at random¹.

How a private key, an address and a seed phrase are connected

The wallet calculates the address from the private key¹. There is no way back: working out the private key from an address is practically impossible¹. It is a bit like baking bread. Turning dough into bread is easy, and no one can turn the bread back into dough. That is why an address can safely be shown, published and forwarded.

The seed phrase sits above the keys in this chain. From it the wallet can calculate as many keys as it needs, so one seed phrase restores every key in the wallet². How the phrase itself works and how to write it down is covered in what is a seed phrase.

How a private key signs a transfer

When you send crypto, the wallet puts together the transfer and adds a signature calculated with the private key¹. A signature is a number that only this key can create, and any computer on the network can check it without learning the key³. The key itself is never sent to the network; only the transfer and the signature go there.

When the network checks a signature, it asks for no name and does not call the owner. To the network, a valid signature means the owner of the address allowed the transfer, so anyone who has learned your key controls your crypto just as you do¹.

Signatures are also given on websites when you connect your wallet to them. The key stays in the wallet, yet a signed permission can give the site the right to spend your tokens, such as USDT, up to a stated amount⁴. The article staying safe when connecting a crypto wallet explains what to check before signing such a permission.

Who holds the private key, you or the exchange

You can hold the private key yourself or trust it to an exchange or another service that keeps crypto for its customers. In your own wallet, only you have access to the private keys, while on an exchange the exchange manages them⁵. Crypto has a saying for this difference: "Not your keys, not your coins". Your own wallet can be an app or a separate device, and the article hot vs cold crypto wallet explains how they differ in protection against theft.

Does a crypto exchange hold my private key?

Yes, as long as your crypto sits on the exchange, the exchange controls the keys to its addresses, and you have no private key of your own for that crypto⁵. The address you top up your account with belongs to the exchange, and the exchange signs the transfer from its addresses when you request a withdrawal. If the exchange is hacked, shuts down or goes bankrupt, you can lose access to the crypto, and some exchanges mix customers' money together or put it to use, for example by lending it out⁵ ⚖️. To hold the key yourself, withdraw the crypto to your own wallet. The article how to send crypto shows how to do it without mistakes.

Pros and cons of holding the key yourself or leaving it with an exchange

Can several people share a private key?

Yes, some wallets are built so that one signature is not enough for a transfer. A multisignature wallet has several keys and a set number of signatures without which a transfer will not go through, for example two out of three³. It works like a bank safe deposit box that opens with two keys at once, the customer's and the bank's. Being able to sign a transfer and owning the crypto are separate questions, and a dispute over ownership is settled under the law of the country ⚖️.

What to do if a private key is lost or someone has learned it

Can you recover a lost private key for a crypto wallet?

Yes, usually from the seed phrase that the wallet created the key from, or with a recovery method that the wallet offers and that you set up yourself in advance. Nobody else has a copy of the key, and neither the wallet's developers nor the network can recover it for you⁶. With neither the key nor the seed phrase, access to the crypto at that address is lost for good⁵⁷. Do not pay people who promise to "recover your key" or "restore access"; the article phishing and scams describes this kind of fraud.

How is a private key different from a crypto wallet app password?

A password or PIN opens the wallet app on one device, while the private key gives access to the crypto itself on the blockchain. The wallet stores the key on your phone or computer in encrypted form, and the password is needed to decrypt it¹. A forgotten password is no disaster if the seed phrase is on paper. You reinstall the app and restore the wallet from the phrase with a new password⁶. A password will not stop someone who has learned the key or the seed phrase, since they can restore the wallet on their own device with their own password.

Can you change a crypto wallet's private key if someone has learned it?

No, the private key of an ordinary address cannot be changed, because the address is calculated from the key¹. Whoever knows the key can withdraw everything at any moment⁷, so all the crypto, including tokens and NFTs, is moved straight away to a new wallet with a new seed phrase, and the old address is no longer used. The steps for the move are the same as after a seed phrase leak and are described in the article about the seed phrase.

More detail on what a key looks like and how wallets share it between people

In Bitcoin a key consists of 256 binary digits², and in Ethereum it is usually written as a string of 64 characters made of the digits 0 to 9 and the letters a to f¹. Copying such a string by hand without a mistake is hard, so Bitcoin has the WIF format for moving a key between wallets, with a checksum that helps catch a typo².

There is an intermediate step between the key and the address. A public key is calculated from the private key, the network uses it to check signatures, and the address is derived from the public key³. Under the BIP-39 standard the words of a seed phrase turn into a number¹⁰, and under the BIP-32 standard a whole tree of private keys, and therefore of addresses, is derived from that number¹¹.

Besides multisignature, there are wallets built on MPC technology, where the work with the key is spread across several participants or devices¹². On the Ethereum network a wallet can be a smart contract, a program inside the network with its own rules, for example with backup keys that replace a stolen one⁷.

Frequently asked questions