How a Bitcoin wallet really works — and how to keep yours safe

A Bitcoin wallet doesn't hold coins: it holds the private keys that control coins recorded on the blockchain. This guide explains private keys, public keys and addresses, what a seed phrase really is, how hot and cold wallets differ, and five habits that keep coins safe.

Category: Security and Scam Prevention · Published 2026-10-28

Editorial review complete · technical review pending · sources under review

What does this mean?Editorial review covers clarity and neutrality. Technical, security, and source reviews indicate whether an article's material claims were checked against relevant authoritative material. A source link being available does not by itself mean every claim has been verified. A reviewed status means the article's material claims were examined; it does not mean the article is exhaustive or that future protocol, market, or software changes cannot make it outdated.

A wallet holds keys, not coins

Here's the first surprise: your bitcoin isn't in your wallet. Every coin is recorded on the blockchain, a shared public ledger. What your wallet actually stores is a set of private keys that prove you control certain coins and let you spend them.1 Think of the blockchain as a bank vault that everyone can see into, and your wallet as the key to your box inside it.

Public key vs private key vs address

Two keys do the work. Your private key is a secret number only you should ever know. In an ordinary single-key wallet, whoever holds it controls the coins, full stop. From it, math derives a public key and then a shareable address, such as the bc1... string you give people to receive funds.23 You can share an address freely; you must never share the private key or the recovery phrase behind it. That asymmetry, easy to receive and practically impossible to spend without the secret, is what makes Bitcoin work.2

One caution: payments to an address are public, which is why the Bitcoin whitepaper recommends a new key pair for each transaction and many wallets offer a fresh address every time you receive.4

The seed phrase is the master backup

Most modern wallets show you a seed phrase, also called a recovery phrase, when you first set up. Under the common BIP-39 standard it is a list of ordinary words: usually 12 or 24, though 15, 18 and 21 are also allowed, and not every wallet uses BIP-39 at all.5 The phrase is not the coins themselves. It is the master backup from which a compatible wallet can regenerate every private key and address it uses, together with any optional passphrase you added.56

Write it on paper or metal, keep copies in more than one safe place, and never type it into a website or photograph it.6 Anyone with those words can usually recreate your keys and spend your coins. If you lose the words and every device that holds the keys, the coins are out of reach for good. No company can reset it for you, and that's the point.

Hot wallets vs cold wallets

A hot wallet is a phone or desktop app that keeps its keys on an internet-connected device: convenient for small, everyday amounts, but exposed to any malware that reaches that device.1 A cold wallet keeps the keys away from the internet. A hardware wallet holds them on a separate device and signs transactions without letting them out, and an offline computer can do the same job.1 Many people use both, as bitcoin.org suggests: a little hot for spending, like cash in a pocket, and the bulk cold for holding.6

If you mine, nothing changes: a pool, solo or shared, needs only an address to pay you, never a private key or a recovery phrase, so an address from a cold wallet works as well as any other.2

The five rules that actually matter

  • Back up your seed phrase offline: paper or metal, never a screenshot or cloud note.
  • Never share your private key or seed. No genuine company, support agent, exchange or pool needs it; Ledger, a hardware-wallet maker, states plainly that its support will never ask for the recovery phrase.7
  • Prefer holding your own keys for savings, once you are confident with backups; when an exchange holds them, you rely on its security and honesty.6
  • Verify the receive address on the device screen before trusting it.
  • Test with a small amount first when using a new wallet.

Get these right and you've mastered the most important skill in Bitcoin. How to protect a Bitcoin recovery phrase goes deeper on backups, and how Bitcoin transactions work shows what your keys actually sign.

FAQ

Does my wallet store my bitcoin?

No. Your coins are recorded on the blockchain. Your wallet stores the private keys that let you prove control and spend them. That's why a backed-up seed phrase, plus any passphrase you set, can restore your funds in a new compatible wallet.

What is a seed phrase?

A list of words, usually 12 or 24, that your wallet generates at setup. The common BIP-39 standard also allows 15, 18 and 21 words, and some wallets use other formats. It can regenerate your keys, so it is effectively your master backup. Store it offline and never share it: anyone with it can usually spend your coins.

What's the difference between a hot and cold wallet?

A hot wallet keeps its keys on an internet-connected phone or computer, which is convenient for small amounts. A cold wallet, such as a hardware wallet, keeps the keys offline, which gives stronger protection and suits savings you rarely move.

Is it safe to share my Bitcoin address?

Yes. Your address is meant to be shared to receive funds, and it cannot be used to spend them. Payments to it are public on the blockchain, though, so a fresh address for each payment is better for privacy. Never share your private key or seed phrase, which are what actually control the coins.

Key takeaways

  • A Bitcoin wallet stores private keys, not coins; the coins are recorded on the blockchain.
  • An address is derived from a public key, which is derived from the private key, and only the private key can authorise spending.
  • A seed phrase is the master backup that can regenerate a wallet's keys, so anyone who has it can usually spend the coins.
  • Hot wallets keep keys on internet-connected devices for convenience, while cold storage keeps them offline for savings.
  • No genuine company, support agent or pool needs your private key or seed phrase; a request for either is a theft attempt.

Sources

  1. Bitcoin Developer Guide, Wallets: wallet programs create public keys to receive and use the matching private keys to spend; wallet files are at their core a collection of private keys; full-service wallets keep keys on an Internet-connected device, while offline and hardware (signing-only) wallets keep them off it — Bitcoin Project (developer.bitcoin.org)
  2. Bitcoin Developer Guide, Transactions: ECDSA key pairs on the secp256k1 curve, the public key hashed into an address that can be passed on through any medium, and the signature made with the private key that authorises spending — Bitcoin Project (developer.bitcoin.org)
  3. BIP-173, Base32 address format (Bech32): native SegWit addresses use the human-readable part 'bc' on mainnet, so they begin bc1 — Bitcoin Improvement Proposals (GitHub)
  4. Bitcoin: A Peer-to-Peer Electronic Cash System (the Bitcoin whitepaper), section 10 (Privacy): a new key pair should be used for each transaction so payments are not linked to a common owner — bitcoin.org
  5. BIP-39, mnemonic code for generating deterministic keys: recovery phrases of 12, 15, 18, 21 or 24 words, the optional passphrase, and the seed they produce — Bitcoin Improvement Proposals (GitHub)
  6. Securing your wallet: the risk of letting a third party hold your keys, small amounts for everyday use, deterministic wallets restored from one recovery-phrase backup, backups in more than one place, and offline wallets (cold storage) for savings — bitcoin.org
  7. Phishing campaigns status: a hardware-wallet maker's own warning that its support will never ask for the 24-word recovery phrase, and that the words belong only on the device — Ledger

Related educational reading