Keys & Addresses

Every wallet is built on a pair of cryptographic keys. Understanding the difference is the single most important concept in crypto security.

Private key: control

The private key is the secret. Whoever holds it can spend the funds — full stop. There is no “reset password,” no support line, no override. This is why a hardware wallet exists: to generate the private key inside a sealed device and make sure it never leaves, never appears on your screen, and never touches an internet-connected computer.

You will almost never see your raw private keys, and that’s by design. What you back up instead is your recovery phrase — a human-readable form of the master secret that all your keys are derived from.

Public key and address: where funds arrive

From the private key, the device mathematically derives a public key, and from that, an address — a short string like bc1q... (Bitcoin) or 0x... (Ethereum). The math only runs one way: you can produce an address from a private key, but you can’t work backward from an address to the private key.

An address is safe to share. It’s how someone sends you funds — think of it like an email address for money. You can hand it out, post it, or scan it as a QR code without putting your funds at risk.

How receiving works

1. Your wallet shows you a receive address (and a QR code).
2. You give that address to the sender.
3. They broadcast a transaction to that address.
4. The funds now belong to whoever controls the matching private key — you.

There’s one catch that crypto beginners get burned by: malware can swap the address your computer displays. If a sender pastes a tampered address, the money goes to the attacker.

On your KeepKey

• The private keys are generated and locked inside the device — see What Is a Crypto Wallet?.
• When you receive, KeepKey shows the address on its own screen so you can confirm your computer isn’t lying. Always check it there — see Verifying Transactions.
• Walk through your first receive in Send & Receive.