Quick answer: what is a private key in crypto?
A private key is secret cryptographic information that allows a blockchain account to authorise transactions. In simple terms, it is part of the mechanism that proves you are allowed to control a particular account. If somebody obtains the private key for an account, they may be able to sign transactions from that account without needing your wallet password.
That is why private keys should never be shared, pasted into random websites or sent to support agents. A wallet app is simply the interface that helps you manage the keys and sign transactions safely.
If you are completely new to self-custody, start with our What Is a Crypto Wallet? guide first.
On this page
Public keys, addresses and private keys
Crypto wallets involve several pieces of information that sound similar but have very different security rules.
- Public address: the address you can share so other people or applications know where to send assets.
- Public key: cryptographic information derived from a private key and used as part of the account system.
- Private key: the secret value that enables signatures and proves control of the account.
The practical rule is straightforward: public addresses are designed to be shared; private keys are not.
What does a private key actually do?
Blockchains do not normally ask a central company to verify every transaction. Instead, cryptography allows a wallet to create a digital signature. The network can check that signature against the relevant public information without the private key itself being revealed.
When you press Send, Swap, Approve or Sign in a wallet, the wallet may use the private key to authorise the action. A properly designed wallet keeps the key secret while producing the signature needed by the network.
This is one reason hardware wallets are useful: they can keep sensitive signing operations isolated from the everyday computer or phone.
Private key versus seed phrase
A seed phrase and a private key are related, but they are not the same thing. In many wallet systems, the recovery phrase is used to derive multiple accounts, and each derived account has its own private key.
MetaMask explains that a Secret Recovery Phrase can restore the entire wallet and the accounts derived from it, while an individual private key imports only that particular account. This distinction matters when backing up manually imported accounts because they may not be recreated simply by restoring a different recovery phrase.
For the full recovery-phrase side of the topic, see our dedicated Seed Phrase Security guide in this security pillar.
Private key versus wallet password
A wallet password usually protects the local application. It may encrypt wallet data on that device and prevent somebody casually opening the app. It does not replace the underlying cryptographic keys.
If an attacker gets the actual private key, changing the wallet application’s password does not change that blockchain key. The attacker may simply import the private key into another compatible wallet.
This is why a “strong password” is important but not sufficient if you also expose the key itself.
Where do private keys come from?
Wallet software generates keys using cryptographic randomness. Modern wallet systems then often derive multiple accounts from a recovery phrase using standardised methods. You usually do not need to manually create or calculate a private key yourself.
In normal use, the safer approach is to let a reputable wallet handle key creation and signing rather than copying keys around between tools.
Why exporting a private key increases risk
Most users can use a wallet for years without ever looking at a raw private key. Exporting it creates an extra moment when the secret appears on-screen or reaches the clipboard.
Once exported, it can be exposed through screenshots, clipboard-monitoring malware, remote-access software, screen sharing, browser extensions, cloud notes or accidental pasting.
Only export a private key when you have a clear reason and understand the destination. If a website tells you that importing a private key is required merely to “connect” a wallet, that should be treated as a major warning sign.
Never send a private key to support
Legitimate support should not need your private key. Ethereum’s security guidance warns that no legitimate service, support agent or website should ask for recovery phrases or private keys.
Common scam scripts include:
- “We need the key to verify ownership.”
- “Your wallet is out of sync.”
- “Paste the private key so we can recover the missing token.”
- “Your account needs migration.”
- “Support needs temporary access.”
The wording may sound technical, but giving away the key gives away control.
How hardware wallets protect private keys
A hardware wallet is designed to keep private keys inside a dedicated device and perform signing there. The private key should not need to be copied into the browser or exposed to the computer during normal use.
This does not make every transaction safe automatically. A user can still approve a malicious transaction with a hardware wallet. The benefit is that malware on the computer has a much harder time simply extracting the raw private key.
For setup guidance, see our Hardware Wallet Setup Guide.
Hot wallets and private-key exposure
Hot wallets run on internet-connected devices, which makes them convenient for active use. The trade-off is that the device and software environment become part of the security boundary.
Malware, fake extensions, compromised browser profiles and malicious software can all increase risk. Keeping the operating system and wallet software updated, installing fewer browser extensions and separating higher-value storage from everyday trading activity can reduce exposure.
Should you write down a private key?
For wallets primarily restored through a recovery phrase, manually writing down every derived private key is normally unnecessary and can create extra sensitive copies. Imported accounts can be different: if an account was imported into a wallet using a standalone private key, make sure you understand how that account will be recovered.
The key question is not “how many backups can I make?” but “what exact information is required to recover this account, and how can I back that up without creating unnecessary attack surfaces?”
What is a signing request?
A private key does not only authorise simple token transfers. Wallets also sign messages and smart-contract interactions. Some signatures are harmless authentication messages; others can grant permissions or trigger actions with financial consequences.
Never reduce wallet security to “I did not reveal my private key, so I am safe.” A malicious approval or signature can still create risk even when the raw key remains secret.
Our on-chain fundamentals guide explains transaction approvals, gas and related concepts.
Can a private key be changed?
You generally cannot rotate a blockchain account’s private key while keeping the exact same account address. If a private key is exposed, the practical response is normally to create a new secure account or wallet and move the assets you still control.
Do not keep using a compromised key because the wallet password has been changed. The blockchain account remains tied to the same secret.
What to do if a private key is exposed
- Use a trusted device and create a fresh wallet or account with new keys.
- Securely back up the new recovery information.
- Move remaining assets from the exposed account as soon as practical.
- Review token approvals and positions that may require separate action.
- Investigate how the key was exposed: phishing, malware, remote access, cloud storage or another route.
- Stop using the compromised account for future funds.
MetaMask’s wallet migration guidance recommends moving assets to a fresh wallet when a recovery phrase is suspected to be compromised or unauthorised transactions appear.
Private key security checklist
- I never share private keys with support agents or strangers.
- I do not paste keys into websites to “verify” or “sync” a wallet.
- I understand which accounts are derived from my recovery phrase and which were manually imported.
- I avoid exporting raw private keys unless there is a specific reason.
- I do not keep screenshots or unencrypted cloud copies of private keys.
- I use a hardware wallet or separate higher-value storage where appropriate.
- I read transaction and signature prompts before approving them.
- I would migrate assets rather than continue using a key I believe has been exposed.
Frequently asked questions
Can someone steal crypto with only a private key?
If the private key controls the relevant account, possession of that key can allow an attacker to sign transactions from it. Treat an exposed key as compromised.
Is my wallet address dangerous to share?
A public address is designed to be shared for receiving assets. Sharing it can still reduce privacy because blockchain activity may be visible, but it does not reveal the private key.
Does changing my wallet password change the private key?
Normally no. A local wallet password and the blockchain private key serve different purposes.
Can I recover a private key from the public address?
No practical method exists to derive a secure private key from its public address using normal computing. Modern blockchain security relies on that one-way cryptographic relationship being infeasible to reverse.
Should I give a private key to a tax or portfolio app?
No. Portfolio and tax services should generally only need public addresses or read-only integrations. A private key gives signing authority and should not be supplied for simple tracking.
Final thoughts
Private keys are the hidden authority behind self-custody. You rarely need to see them, and that is a good thing. The safest routine is to let reputable wallet software or hardware manage the key, minimise exports, never share it and pay as much attention to what you sign as to where the key is stored.
For broader protection against phishing, fake support and malicious applications, continue with our Crypto Security Guide and How to Avoid Crypto Scams & Phishing.
This article is educational and does not replace wallet-provider documentation. Always confirm the recovery and key-management model used by your specific wallet.
Related Crypto Security Guides
Continue through the Simply Blockchain security library with the guides most relevant to this topic.
