By - A private key is a very large random number. It is not stored by anyone who can return it to you.
- Your public address is derived from the key. The relationship only runs one way.
- “Not your keys, not your coins” is a statement about who can sign, not about where a file sits.
A private key is the single piece of information that controls crypto. Not a password protecting an account somewhere, and not a login. The key is the thing itself, and understanding that difference explains almost every irreversible loss in the industry.
A bank password protects access to a record the bank maintains. Forget it and the bank restores access, because the record was never the password. A private key has no such record behind it.
What is a private key, in plain English?
A number. A very large, randomly generated number, typically 256 bits, which is why it is usually written as 64 hexadecimal characters or encoded as a twelve or twenty-four word seed phrase.
Its size is the security. The space of possible 256-bit keys is large enough that guessing one is not a practical activity, regardless of computing budget. That is the entire defence, and it is sufficient.
From the private key, a public key is derived mathematically, and from that, your address. The derivation runs one direction. Anyone can go from key to address; nobody can go from address back to key. If you are new to the underlying system, our explainer on how blockchain technology works covers the layer beneath this.
What does the private key actually do?
It signs. When you send crypto, you are not transmitting a coin. You are broadcasting a message saying the balance at this address should move, and attaching a cryptographic signature proving you hold the key for that address.
Every node checks the signature against the public address. If it verifies, the transaction is valid. The network never sees your key and does not need to. This is the mechanism described in Ethereum developer documentation and it works identically across most chains.
Why can it not be reset?
Because there is nobody to reset it. No institution holds a copy. The key was generated on your device from randomness, and the network only ever saw signatures produced with it.
This is what people mean by self-custody, and it is a genuine trade. You gain an asset nobody can freeze, seize or reverse. You accept that a mistake is permanent, because the property that stops a government freezing your funds is the same property that stops anyone recovering them for you.
What does custody actually mean here?
Whoever holds the key controls the asset. That is the whole definition, and it cuts through most marketing.
On an exchange, the exchange holds the key. Your balance is a database entry representing a claim against them. That is not necessarily bad, and it is how most people should start, but it is a credit relationship rather than ownership. Practical handling is covered in our guide to securing wallets and keys.
In a self-custody wallet, you hold the key. Nobody can freeze the balance, and nobody can help you if the seed phrase is gone.
How should you actually handle one?
Assume any device connected to the internet will eventually be compromised, and plan for that rather than against it.
Write the seed phrase on paper or steel, never in a photo, a notes app, an email, or a password manager that syncs to a cloud. Store at least two copies in physically separate locations, because a single copy makes fire and theft equivalent to a total loss.
And never enter a seed phrase into a website. No legitimate service asks for it. Chainalysis tracks the losses from that pattern annually, and it remains the single most effective attack in crypto, because it does not require breaking any cryptography at all.
What is a seed phrase, and how does it relate?
A seed phrase is the private key made human-readable. Twelve or twenty-four words drawn from a standard list of 2,048, encoding the same underlying number in a form you can write down without transcription errors.
One seed generates an entire tree of keys, which is why a single phrase restores a wallet holding dozens of assets across multiple chains. The wallet software derives each address deterministically from that one root. Lose the phrase and every branch goes with it.
This is also why a seed phrase is more dangerous than any single key. It is not access to one balance. It is access to everything that wallet has ever generated, including addresses you have forgotten about.
What actually goes wrong in practice?
Almost never the cryptography. Nobody brute-forces a 256-bit key, and nobody will.
What goes wrong is human. A phrase photographed and synced to a cloud backup. A phrase typed into a convincing replica of a wallet website. A single paper copy destroyed in a flood. A phrase shared with someone claiming to be support, because real support never asks and scammers always do.
The pattern in every case is that the attacker obtains the key rather than defeating it. That is the threat model worth defending against, and it is entirely procedural.
What's your reaction?
[…] in this industry, and it has nothing to do with the strength of any cryptography. Our explainer on what a private key is covers why holding the key is what actually constitutes […]