What is a private key in crypto? A plain-English guide

A private key is the secret that proves you own a crypto address. It is a very large random number, and whoever knows it can sign transactions that move the coins at that address. There is no bank, password reset or help desk behind it: on a public blockchain, a valid signature from the right key is all the network checks.

This guide explains what a private key looks like, how it relates to your public key, address and seed phrase, and how keys are stolen and protected. It is educational and not investment advice.

What a private key actually is

On Bitcoin and Ethereum, a private key is a 256-bit number, chosen at random from a range that is almost as big as 2²⁵⁶ (roughly 10⁷⁷). That is in the same ballpark as the estimated number of atoms in the observable universe, which is why guessing someone else's key is not a realistic attack if it was generated properly.

You rarely see the raw number. Wallets show it, if at all, in encoded forms:

• Hex: 64 characters using 0–9 and a–f. Ethereum wallets usually export keys this way.
• WIF (Wallet Import Format): a Bitcoin format of 51–52 characters that starts with 5, K or L on the main network.

If any website, app or "support agent" asks you to type in either of these, treat it as an attempted theft.

Private key, public key and address

Keys work as a one-way chain:

1. Private key → public key. The wallet multiplies a fixed point on an elliptic curve (secp256k1 for both Bitcoin and Ethereum) by your private key. Going forward is quick; going backwards is not feasible with today's computers.
2. Public key → address. The public key is hashed into a shorter address. Bitcoin uses SHA-256 and RIPEMD-160 and then encodes the result (addresses beginning 1, 3 or bc1). Ethereum takes the last 20 bytes of a Keccak-256 hash, shown as 0x plus 40 hex characters.

How signing works

When you send crypto, your wallet builds a transaction and signs it with the private key. Bitcoin uses ECDSA signatures and, for Taproot addresses, Schnorr signatures; Ethereum uses ECDSA. Every node can check the signature against your public key without learning the private key, and the signature only fits that exact transaction, so it cannot be reused to send different amounts.

This is why hardware wallets are popular: the key stays inside the device, the computer only sees the signed transaction, and you confirm the details on the device's own screen.

Private key vs seed phrase

Early wallets stored a loose pile of separate keys, and each one needed its own backup. Modern wallets are hierarchical deterministic (HD): under the BIP-32 standard, a single master secret can generate an unlimited tree of private keys, and BIP-39 lets that master secret be written down as a 12- or 24-word seed phrase.

In practice:

• A private key controls one address.
• A seed phrase can recreate every key, on every account, in that wallet.
• An exchange login is neither: on an exchange the company holds the keys. Our custodial vs non-custodial wallets guide explains that trade-off.

Losing a single exported private key exposes one address. Losing your seed phrase exposes everything.

Why randomness is everything

The 2²⁵⁶ number only protects you if the key was chosen truly at random. When wallets cut corners, attackers do not need to break the cryptography; they simply search the much smaller space of likely keys:

• "Brain wallets" that turned a memorable sentence into a key have been emptied by bots that hash dictionaries and quotes.
• In 2013 a flaw in Android's random number generator let attackers recover keys from some Bitcoin wallet apps.
• This month, about 1,404 Qubic wallets with weak seeds were drained, and researchers showed that eight eMudhra certificate keys were weak enough to crack in under a second.

Use established, open-source or hardware wallets, and never create keys with "generator" websites.

How private keys get stolen

• Phishing and fake support. Messages, pop-ups or "wallet validation" sites ask for your seed phrase or key. No legitimate service needs it. See how to spot crypto scams.
• Malware and bad extensions. Clipboard hijackers swap addresses, and compromised browser extensions can leak keys, as in the Fearless Wallet case.
• Fake or tampered devices. Buy hardware wallets from the maker and check they are genuine.
• Careless backups. Photos, cloud notes and email drafts of a seed phrase are easy targets.

How to keep yours safe

1. Let a reputable wallet generate the key and seed for you, offline where possible.
2. Write the seed phrase on paper or metal, keep it offline, and consider a second copy in another safe place.
3. Keep large amounts on a hardware wallet; keep only spending money in phone or browser wallets.
4. Verify addresses on the device screen before you sign.
5. If you think a key or seed has been exposed, create a new wallet and move the funds. You cannot "change" a private key the way you change a password.

More tips are in our guide to storing crypto safely.

What happens if you lose it

If you lose a private key and have no seed phrase or other backup, the coins at that address are effectively gone. Nobody, including the wallet maker, can recover them. With a seed phrase, you can restore the whole wallet in any compatible app. On an exchange, you recover your account through the company instead, because it holds the keys.