What is a private key?

A private key is secret cryptographic material used by a signing algorithm to produce digital signatures. On a blockchain, a valid signature can satisfy a key-based authorization condition without sending the private key to the network.

A private key is not the crypto asset itself and it is not stored “inside” a coin. Assets or balances are represented by the network’s ledger and rules. The key supplies evidence needed to authorize an action under those rules. This distinction matters because accounts controlled by smart-contract logic, multiple keys or other recovery mechanisms do not always reduce to one address and one private key.

How a private key becomes signing authority

In an elliptic-curve system, key generation begins by selecting a private value in the valid range using an appropriate random-generation process, then deriving the corresponding public point. SEC 1 describes both elliptic-curve key-pair generation and public-key validation. Weak randomness, unsafe reuse of a per-signature secret where the scheme requires a fresh value, or implementation errors can undermine the mathematical design. SEC 1: Elliptic Curve Cryptography

NIST FIPS 186-5 describes digital signatures as three related processes: generating key pairs, generating signatures and verifying signatures. The private key is used in signature generation; the public key is used in verification. A verifier should not need the private key, and a legitimate service does not need it merely to verify that a signature is valid. NIST FIPS 186-5

For a typical key-controlled blockchain transaction, wallet software:

1. constructs the data that the network expects to be signed;
2. uses the private key in the selected signature algorithm;
3. returns a signature while keeping the key in its storage or signing environment; and
4. broadcasts the signed transaction, which network participants validate under protocol rules.

The precise data being signed is network- and transaction-type-specific. A signature valid for one serialization, chain or authorization domain should not be assumed valid everywhere.

Private key, public key, address and account

• Private key: secret input used to generate signatures.
• Public key: corresponding material used to verify signatures.
• Address: a network-specific identifier that may be derived from a public key, script or deployment rule.
• Account: the network state or authorization arrangement associated with an address.

Ethereum externally owned accounts (EOAs) are controlled through private keys, and their addresses are derived from public keys. Contract accounts have addresses but no private keys of their own; code controls their behavior. Ethereum validator keys also serve a different protocol role from EOA keys. These distinctions prevent “an address is a private key’s account” from becoming a universal rule. Ethereum accounts

Bitcoin uses output-specific spending conditions. Depending on the output type, a spend may require a signature, one of several signatures, or satisfaction of a script. The private key does not move an abstract balance on its own; it helps produce evidence accepted by a particular spending condition.

One wallet can manage many private keys

Wallet software is an interface and key-management system, not a single key. Older “loose-key” wallets generated unrelated keys that each needed to be backed up. Hierarchical deterministic (HD) wallets can derive a tree of keys from root material, which reduces the need to back up each derived key separately. Bitcoin Developer Guide: wallets

In BIP-32, a seed produces a master extended private key, which combines a private key and chain code. Child extended keys are then derived along paths. Hardened and non-hardened derivation have different properties: an extended public key can derive non-hardened public children, but not hardened children. An extended private key can expose an entire branch, so it is not interchangeable with one leaf private key. BIP-32: Hierarchical Deterministic Wallets

Private key, seed phrase, passphrase and wallet password

These secrets operate at different layers:

• A private key signs for one key pair.
• A seed phrase used by a BIP-39-compatible wallet is an ordered word sequence processed into a seed; that seed may later generate many keys.
• A BIP-39 passphrase is an additional input to seed generation. Every passphrase produces a seed, but only the intended phrase-and-passphrase combination restores the intended key tree.
• A wallet password or PIN normally controls local access to an application, device or encrypted key file. It is not automatically a blockchain signing key or BIP-39 passphrase.

Changing an app password may re-encrypt local storage while leaving the underlying keys unchanged. If a private key or recovery secret has already been copied, changing only the app password does not invalidate that copy. Conversely, losing an app password does not always mean the underlying key is lost if another supported recovery route exists. Implementations differ, so these outcomes must be checked against the wallet’s design rather than inferred from the word “password.” BIP-39

Compromise, backup and replacement

NIST key-management guidance treats generation, storage, backup, recovery, use, revocation and destruction as distinct parts of a key lifecycle. Blockchain protocols vary in how they handle a compromised signing key. Some key-controlled arrangements have no central reset function: moving assets or changing authorization may require a valid transaction while the original authorization is still available. Smart-contract accounts or managed custody systems may implement different recovery and replacement rules. NIST SP 800-57 Part 1 Rev. 5

Keeping the key undisclosed is necessary but does not make every signature appropriate. Malicious software can change transaction data, deceptive interfaces can request broader permissions than expected, and a signer can authorize an unwanted instruction without exporting the key. Key confidentiality and informed signing are separate controls.

Private keys and recovery phrases should not be entered into a page or message merely because someone claims to provide support or ownership verification. A normal signature-verification flow can verify a signature without asking the signer to reveal the secret key.

FAQ

Can a wallet provider reset a lost private key?

There is no universal private-key reset. In a conventional self-custody arrangement, recovery depends on an existing backup or a recovery mechanism already built into the wallet or account. Custodial and smart-contract-based arrangements can work differently.

Does exporting one private key back up the whole wallet?

Not necessarily. An HD wallet may manage many keys, and one leaf key does not reconstruct the seed, other branches, derivation settings or account metadata. The backup method must match the wallet architecture.

Related concepts

For a longer comparison, read Private keys vs public keys.

Read about public keys, seed phrases, blockchain addresses and crypto wallets, or return to the Crypto Glossary.

Sources

• NIST FIPS 186-5: Digital Signature Standard — key-pair, signature-generation and verification processes.
• NIST SP 800-57 Part 1 Rev. 5 — key types, protection requirements and lifecycle management.
• SEC 1 Version 2.0 — elliptic-curve key-pair generation and signature operations.
• Ethereum: accounts — EOAs, contract accounts, key pairs and addresses.
• BIP-32 — HD key trees, extended keys and hardened derivation.
• BIP-39 — mnemonic-to-seed processing and optional passphrases.
• Bitcoin Developer Guide: wallets — wallet architectures, signing keys and deterministic derivation.