Private Keys

In Keys & Addresses we met the private key in passing: the secret that unlocks your coins. It's worth a closer look, because everything else (your public key, your addresses, your signatures, your whole wallet) is built on top of this one number.

Just a (Very Big) Number

A private key is, very literally, a number: a randomly chosen 256-bit value. Valid keys run from 1 up to just below the order of the secp256k1 curve, about 1.158 × 10⁷⁷, roughly the number of atoms in the observable universe. You can write that same number in binary, decimal, or (most commonly) hexadecimal (64 hex characters), but underneath it's all the same value.

Why so enormous? Because that staggering range is exactly what makes your key un-guessable. Even with every computer on Earth grinding away, randomly landing on a key that already holds coins is, for all practical purposes, impossible.

Where It Comes From: Entropy

A private key is only as safe as the randomness used to create it. That randomness is called entropy, and it has to come from a strong, unpredictable source: a cryptographically secure random number generator, hashing genuinely random data, or even flipping a coin 256 times (one flip per bit). Good wallets do this for you, correctly.

The cardinal sin is inventing your own. "Brain wallets" (keys made from a passphrase, a song lyric, or a favourite quote) feel clever, but humans are hopeless at randomness, and attackers have pre-computed millions of the obvious ones. Brain wallets get emptied in seconds. Let your wallet generate the key; never make one up.

The Same Key, Many Outfits

Because a private key is just a number, it can be dressed up in a few different formats:

• Raw hexadecimal: the bare 64-character form.
• Decimal: the same value written as one (enormous) ordinary number.
• WIF (Wallet Import Format): the one you're most likely to bump into: a Base58Check encoding that adds a checksum (so a typo gets caught) and a flag noting whether the matching public key is compressed.

You'll rarely handle any of these directly, since your wallet imports and exports them, but it's worth knowing they're all the same secret wearing different clothes.

From Key to Signature

Your private key never travels, and it never needs to. From it, your wallet derives the matching public key with one-way elliptic-curve math; and to spend, it produces a signature over the transaction. Anyone can check that signature against your public key, proving the coins are yours, but no one can run the process backward to recover the key. For the full private key → public key → address chain, see Keys & Addresses.

One Seed, Every Key

Here's what makes private keys manageable: you almost never deal with them one at a time. Your recovery phrase (a BIP39 seed) feeds a hierarchical deterministic (HD) wallet, which generates every private key you'll ever use, in a repeatable order. Back up the seed once, and every key, past and future, is recoverable. That's why we call the seed the master key.

Whoever Holds It, Owns It

All of which leads to the unforgiving rule of self-custody: whoever knows the private key controls the coins, completely and irreversibly. So the key, and the seed it comes from, is never typed into a website, never stored as a photo or a cloud file, and never shared with a "support agent." Guard it like cash that can't be cancelled, because that's exactly what it is.