Private Key
A private key is a unique cryptographic string — a 256-bit number — that grants the right to sign transactions and control funds at the corresponding wallet address. Unlike a seed phrase, a private key is tied to one specific address rather than the whole wallet. Sharing your private key is equivalent to handing over complete control of all funds at that address.
How a Private Key Works
A private key is a 256-bit random number generated when a crypto wallet is created. Through elliptic curve cryptography (ECDSA, secp256k1), the private key is used to derive a public key. From the public key, the wallet address is computed via hashing (Keccak-256 for Ethereum; SHA-256 followed by RIPEMD-160 for Bitcoin). This process is mathematically one-way: you cannot reverse-engineer a private key from an address or public key.
In written form, a private key looks like a 64-character hexadecimal string — for example, a1b2c3d4e5f6... — or in WIF (Wallet Import Format), a 51–52 character string beginning with "5", "K", or "L" for Bitcoin.
Private Key vs Seed Phrase
These represent two different levels of wallet control. A seed phrase (BIP-39) is a master key from which private keys for all wallet addresses are mathematically derived. One MetaMask wallet contains thousands of potential addresses, each with its own private key — all derived from the single seed phrase.
A private key is tied to one specific address. Exporting a private key from MetaMask (Settings → Security → Export Private Key) gives control only over that address, not over the other addresses in the same wallet. Compromising a private key is dangerous: the attacker can sign unlimited transactions from that address as long as funds remain there.
Where Is the Private Key Stored?
In software wallets (MetaMask, Trust Wallet), the private key is stored in encrypted form on the device in a keystore file. The wallet password decrypts the key for each transaction signing. This means physical access to the device combined with knowledge of the password gives full control over the keys.
In hardware wallets (Ledger, Trezor), the private key is stored in a Secure Element chip and never leaves the device. Transactions are signed inside the chip — the computer only receives the signed transaction, never the key itself. This is the only storage method where the key is protected even from malware on the connected computer.
How Attackers Steal Private Keys
Phishing websites ask you to "import" or "verify" your wallet by entering your private key. Malicious browser extensions intercept the key as you type it into a web form. Clipboard hijacking — malware that monitors the clipboard and captures strings that look like private keys or wallet addresses.
Infostealers (RedLine Stealer, Vidar, Raccoon) scan the file system for keystore files, wallet.dat files, and browser extension data. In 2024, infostealers became the primary vector for private key theft among retail crypto users. Some specifically target the MetaMask and Trust Wallet data directories inside Chromium-based browsers.
Key Formats Explained
Hex (hexadecimal) — 64 characters (0–9, a–f). Used in Ethereum and most EVM-compatible networks. This is the format you see when exporting from MetaMask. WIF (Wallet Import Format) — Base58Check-encoded format for Bitcoin, starting with "5" (uncompressed) or "K" / "L" (compressed). This is the format used in Bitcoin Core's wallet.dat file.
Keystore JSON — a password-encrypted file containing the private key. Used in MetaMask and Ethereum wallets. Both the file and the password are required to decrypt: losing either means losing access. Never share your keystore file alongside the password.
Public Key and Wallet Address
The public key is derived from the private key through elliptic curve multiplication. The wallet address is derived from the public key through hashing. Both derivations are one-way: neither the address nor the public key can be used to compute the private key. Sharing your public key or wallet address is safe — it is the equivalent of giving out your bank account number for receiving payments.
Only the private key poses a security risk if disclosed. Someone with your public key can see your balance and transaction history (blockchain is public), but cannot sign transactions or move funds.
Frequently Asked Questions
Can I recover a private key if it is lost?
If you have a seed phrase, yes — the private key for any address can be re-derived from it using BIP-32/BIP-44. If you have neither the key nor the seed phrase, access to that address is permanently lost: brute-forcing a 256-bit number is computationally infeasible.
What is the difference between a private key and a public key?
A public key (and wallet address) can be shared with anyone — it is your account number for receiving funds. A private key is the signature authority for spending those funds. Sharing a public key is safe. Sharing a private key means giving away complete control over funds at that address.
Is it safe to store a private key in a file on my computer?
No. Files are vulnerable to infostealers and ransomware. The safest option is a hardware wallet (Ledger, Trezor) where the key never leaves the device. If no hardware wallet is available, use an encrypted keystore file on an air-gapped offline storage medium.
Can someone guess my private key?
No. The number of possible private keys is 2^256 — more than the number of atoms in the observable universe. Guessing is physically impossible. Risk arises only through improper storage or flawed random number generation in old software.
What should I do if my private key is compromised?
Immediately create a new address and transfer all funds before the attacker does. If funds have already been moved, record the TxID and contact KarCrypto. A compromised key cannot be revoked — you can only race to move funds to safety first.