Private key

You generate a Bitcoin private key by drawing 256 random bits from a secure source, then checking that the number falls between 1 and n-1. The result is 32 bytes, or 64 hex digits. Anyone who learns the key can spend the coins locked to its matching public key. The public key, the address and every signature you make all come from this one number.

Your private key is the root of the keys section. Keep it secret, and read the rest of this page before you handle one.

What does a private key look like?

Most tools show a private key as 64 hexadecimal digits, which is 32 bytes. This example key is for illustration only:

dbf34ebb797c7b62960c0c7d1784c3209d5de7abf307df4a07dac9c76f22ee72

Do not use it with real coins. Hex is only a way to write the number. The number 255 is ff in hexadecimal and 11111111 in binary, and it is the same value in every form. A private key stored as decimal is still the same key.

How do you generate a private key?

Generation has two steps. First, draw 256 random bits from a source built for secrets. Second, check that the number is in the valid range, covered below. The randomness matters most. Avoid the general random function in most languages, which is fast but predictable. On Linux and macOS, /dev/urandom is a secure source. Python's secrets module and Node.js's crypto.randomBytes are secure too.

This short Python example picks a number from 1 to n-1, the valid range, so it needs no separate check. N is n, the order of the curve, explained below.

import secrets

N = 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364141

key = secrets.randbelow(N - 1) + 1   # a uniform number from 1 to N-1
print(f"{key:064x}")                 # the private key as 64 hex digits

Generate keys on your own computer, never on a website, because a site can keep a copy. Keys you make yourself suit learning and testing. For real money, most people are better off with a wallet, which makes and backs up keys for them.

What range of numbers is valid?

A valid private key is any whole number from 1 to n-1. In decimal, n-1 is 115792089237316195423570985008687907852837564279074904382605163141518161494336. In hexadecimal it is FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364140. Zero is not valid, and neither is anything at or above n.

n-1 sits just below 2^256. The 256-bit numbers from n up to 2^256 - 1 are not valid keys. Only about one random 256-bit number in 2^128 lands there, so the case is rare. A careful generator still rejects such a number and draws again, which the code above does by picking from the range directly.

Bitcoin uses the secp256k1 curve, and the Bitcoin Wiki's private key page gives the same range.

Why is randomness so important?

Keys are only as safe as their randomness. If an attacker can predict the output of your generator, they can rebuild your key without ever touching your computer. A predictable generator is fine for a game. It is a disaster for money.

The 2023 Milk Sad disclosure shows what goes wrong. The bx seed command in the libbitcoin Explorer tool seeded a predictable number generator, a Mersenne Twister, with the system clock. That left a starting value of only about 32 bits, so attackers could try every likely one. The disclosure estimates that over $900,000 worth of cryptocurrency was moved.

How big is the key space?

The number of valid private keys is roughly 2^256, which is about 1.16 × 10^77. That is a number with 78 digits. Even if every computer on Earth tested billions of keys a second, a full search would take far longer than the age of the universe. Two people who generate keys securely will not pick the same one by chance.

How is a private key used?

The private key is the starting point for the public key. Your wallet multiplies the key by a fixed point on the elliptic curve, and the result is the public key. A payment locks coins to that public key, or to its hash.

To spend those coins, the wallet makes a signature with the private key. The signature proves you hold the key without showing it. The network checks the signature against the public key, which is either held in the lock or revealed when you spend. The private key itself never appears on the blockchain.

How do private keys fit with wallets and seed phrases?

Most modern wallets do not store one key. They derive many keys from one seed phrase, which is described on the mnemonic seed page. A wallet that imports a single key often asks for it in WIF format. WIF adds a version byte, an optional compression flag and a checksum to the same 32 bytes.

How do you keep a private key safe?

• Never type it into a website, a chat, or a form.
• Never keep it in a plain text file, a screenshot, or a cloud note.
• Never share it to get help. Share a transaction ID instead.

Anyone who has the private key can spend the coins behind it, whether or not they have access to your wallet app. Guard it as you would the cash itself.