Private key

A private key is a whole number, chosen at random from a range so large that nobody will ever pick the same one twice.

That’s all it is. There’s no file format, no account and no password inside it. The number lets you make signatures that spend coins, so whoever knows it owns the coins. Everything else in this group, from the public key to the prl1 address, is computed from it.

Try it

Generate a key, or type one in, and follow it down to an address.

How big is the range?

A valid key is any whole number from 1 up to, but not including, a constant called n:

n is the number of points on the secp256k1 curve’s group, the same constant Bitcoin uses:

That’s 78 digits, about $1.16 \times 10^{77}$. It is a tiny bit less than $2^{256}$, so every key fits in 32 bytes.

Size

32 bytes

256 bits

Smallest

1

0 is rejected

Largest

n − 1

…5e8cd0364140 in hex

Size

32 bytes

Type

Unsigned integer

Format

Big-endian

Range

1 to n − 1

Note the byte order. Pearl stores most numbers little-endian, smallest byte first. Keys are the exception: like Bitcoin, they are written biggest byte first, the way you’d write the number by hand.

How does a Pearl wallet pick a key?

Not one by one. A Pearl wallet draws randomness once, when you create it, and derives every key from that.

1. 128 random bits

   Oyster calls hdkeychain.GenerateSeed(RecommendedSeedLen), which Pearl sets to 16 bytes, read from the computer’s secure random number generator.

2. 12 words

   Those bits become a 12-word mnemonic, your backup.

3. A seed, then a tree

   The words become a 64-byte seed, and the seed becomes a tree of keys, one per address.

So the random part is the 128 bits behind the 12 words. Every private key in the wallet is a deterministic function of them, which is why the words are all you need to restore. The mnemonic page and derivation paths show the arithmetic.

What does a private key look like?

The same number can be written several ways. Here is one key, the example from the Bitcoin wiki’s WIF page. It is public, so never use it.

What is WIF?

Size

51 or 52 characters

Type

Base58Check text

Format

version ‖ key ‖ [01] ‖ checksum

WIF (Wallet Import Format) is how you move a single key between programs. It adds a version byte in front, an optional 0x01 “compressed” flag behind, and a 4-byte checksum, then writes the lot in Base58Check.

Mainnet compressed keys start with K or L, uncompressed ones with 5. Test networks give c (or 9). Pearl wallets always use compressed keys.

Where does Pearl use a private key?

• Signing spends. Every Pearl spend is signed with a 64-byte Schnorr signature. For a normal Taproot address, the key that signs is not d itself but the tweaked key d + t (with d negated first if needed). The Taproot tweak page works this out for key 1: the signing key ends in …30e8 instead of …0001.
• Exporting and importing. Oyster’s dumpprivkey writes a key as WIF, and importprivkey reads one. The exported key is the internal, untweaked one.
• Signing messages. Two different schemes exist, described below.

How do you keep it safe?

• Never type it into a website. No legitimate Pearl service needs your private key, a WIF or your 12 words.
• Back up the words, not the keys. One 12-word backup covers every key the wallet will ever make.
• Remember the famous keys are public. Private key 1, the wiki key above and the BIP-39 test phrase are on this page because everyone knows them. Coins sent to them are gone the moment a bot notices.

const n = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141n;
function randomPrivateKey() {
  for (;;) {
    const bytes = crypto.getRandomValues(new Uint8Array(32));
    const d = BigInt('0x' + [...bytes].map((b) => b.toString(16).padStart(2, '0')).join(''));
    if (d >= 1n && d < n) return bytes;   // fails about once in 2^128 tries
  }
}