Private-key security is the set of practices used to protect the secret cryptographic key that allows a user to control crypto assets and create digital signatures.

A private key is not simply a password. It is a cryptographic secret associated with a corresponding public key. In many blockchains, a transaction is authorized when its signature can be correctly verified using the corresponding public key.

The central security principle is that a private key must not be disclosed to third parties. If an attacker obtains a copy of the key, they may be able to create valid signatures and, depending on the protocol, transfer assets without the owner's additional approval.

Key protection measures

  • keeping keys in a trusted environment;
  • using a hardware wallet for significant holdings;
  • avoiding plaintext copies in cloud storage, email, or messaging applications;
  • protecting physical backups from unauthorized access;
  • verifying transaction details before signing.

Loss and compromise are different events. If a private key is lost, the owner may lose the ability to authorize transactions. If it is compromised, an attacker may gain control. Therefore wallet backup and protection against disclosure must be addressed together.

Private-key security is fundamental to self-custody and is closely connected to seed-phrase security when wallet keys are derived from a seed using a derivation path.