HD wallets

A hierarchical deterministic wallet, or HD wallet, creates every key and address from one seed. Hierarchical means the keys sit in a tree, with each key able to make its own children. Deterministic means the same seed always gives the same keys, in the same order. The method is defined in BIP 32, and most modern wallets use it.

Back up the seed once, and you can recover every private key and address the wallet will ever make. That is the main benefit over older wallets, which generated keys one by one and needed a new backup each time.

Why use one seed for many keys?

HD wallets solve three practical problems.

• One backup. Older wallets held a separate private key for each address, so every new payment meant a new backup. An HD wallet needs only its seed.
• Organization. The tree gives each account, and each part of an account, its own branch. Your receiving addresses can be kept apart from your change, for example.
• Public keys without private keys. A parent public key can make the public keys of its normal children on another machine. A shop server can take new payments without holding any secret.

The seed itself is described in mnemonic seed. This page covers what the seed becomes.

How is the master key made?

The seed goes into HMAC-SHA512, with the fixed key Bitcoin seed. The 64-byte output splits into two halves of 32 bytes. The left half is the master private key. The right half is the chain code, an extra 32 bytes of secret that the children depend on too.

The example uses the seed from BIP 32's first test vector, 000102030405060708090a0b0c0d0e0f, which is public. Its master private key is e8f32e723decf4051aefac8e2c93c9c5b214313817cdb01a1494b917c8436b35, and its chain code is 873dff81c02f525623fd1fe5167eac3a55a049de3d314bb42ee227ffed37d508.

The master public key comes from the private key on the elliptic curve. It is 0339a36013301597daef41fbe593a02cc513d0b55527ec2df1050e2e8ff49c85c2 in compressed form. The master private key and chain code together make the master extended key.

How are child keys made?

Each child comes from its parent's extended key and an index number. The parent's private key, or public key for a normal child, goes into HMAC-SHA512 with the parent's chain code. The index is a 32-bit number, so a key has 4,294,967,296 possible children. The two ranges are:

• Normal children, with indexes 0 to 2,147,483,647. A parent public key can make these.
• Hardened children, with indexes 2,147,483,648 to 4,294,967,295. Only the parent private key can make these. Written in paths, a hardened index has an apostrophe, so index 2,147,483,648 is 0'.

The child's private key is the HMAC's left half added to the parent's private key, modulo the curve order. The right half becomes the child's chain code. Extended keys walks through the arithmetic in full.

For the first hardened child of test vector 1, the path is m/0'. Its private key is edb2e14f9ee77d26dd93b4ecede8d16ed408ce149b6cd80b0715a2d911a0afea, and its public key is 035a784662a4a20a65bf6aab9ae98a6c068a81c52e4b032c0fb5400c706cfccc56. Each child's values depend on the parent alone, so the same seed always gives the same tree.

What does the tree look like?

The tree starts at the master key m. Its children are the accounts. Each account splits into a receiving branch and a change branch, and the branches hold the keys that are used for addresses.

Wallets follow standard shapes for this tree, so one seed works in other wallets too. The derivation paths page lists the common ones, such as m/84'/0'/0'/0/0, and explains each level.

Can a wallet make public keys without private keys?

Yes, for normal children only. The parent extended public key holds the parent public key and the chain code. Those are enough to compute each normal child's public key, with no private key involved. The result matches the private key the wallet will later use.

The example is test vector 1 again. Take the public key of m/0', which is 035a784662a4a20a65bf6aab9ae98a6c068a81c52e4b032c0fb5400c706cfccc56, and derive its child at index 1 from that public key alone. The result is 03501e454bf00751f24b1b489aa925215d66af2234e3891c3b21a52bedb3cd711c. The private key for m/0'/1 gives the same public key, so a server that holds only the xpub can build receiving addresses for the wallet.

This is why hardware wallets can keep private keys on the device, and send only the xpub to a laptop or a shop server. Hardened children cannot be made this way, which is why the account level is usually hardened.

Are the keys in an HD wallet linked?

From the outside, no. The public keys and addresses look unrelated. A chain observer cannot tell that two addresses come from the same seed, because the chain code is secret and never goes on the chain. Each address behaves like a separate key that was generated on its own.

Inside the wallet, the links are strong. Anyone who knows the seed or the extended private key can rebuild every branch.

What must you protect in an HD wallet?

Three things are secret, and each one has a different cost if it leaks.

• The seed or the extended private key. Anyone who has it controls every key below it. Treat it as the whole wallet.
• The extended public key. It cannot spend coins, but it lets anyone find every address in the wallet and follow its balance on the chain. Share it only with a service you trust with that privacy.
• A normal child private key, together with the parent xpub. This combination is the weak point. The child key is the parent key plus a value anyone can compute from the xpub, so the parent private key can be recovered by subtracting that value. That exposes the parent, and every normal child under it.

Hardened children limit the damage. Because the account key is hardened, a leaked receiving branch xpub and one of its child keys expose that branch, but never the account key above it.

Where did HD wallets come from?

The idea grew from several people. BIP 32 credits Gregory Maxwell with the original idea, and Alan Reiner with implementing the scheme in Armory. Pieter Wuille wrote the BIP.

What should you remember about HD wallets?

• One seed gives a tree of keys, so one backup covers the whole wallet.
• The master key is HMAC-SHA512 of the seed, split into a private key and a chain code.
• Normal children can be derived from a public key. Hardened children need the private key.
• Keep the extended private key and any child private key secret, and treat the xpub as private information.

Next, read mnemonic seed to see how the words become this seed, then extended keys for the child arithmetic.