# Keys & Addresses

Every wallet is built on a pair of cryptographic keys. Understanding the difference is the single most important concept in crypto security.

## Private key: control

The **private key** is the secret. Whoever holds it can spend the funds — full stop. There is no "reset password," no support line, no override. This is why a hardware wallet exists: to generate the private key inside a sealed device and make sure it **never leaves**, never appears on your screen, and never touches an internet-connected computer.

You will almost never see your raw private keys, and that's by design. What you back up instead is your [recovery phrase](/docs/learn/recovery-phrase) — a human-readable form of the master secret that all your keys are derived from.

## Public key and address: where funds arrive

From the private key, the device mathematically derives a **public key**, and from that, an **address** — a short string like `bc1q...` (Bitcoin) or `0x...` (Ethereum). The math only runs one way: you can produce an address from a private key, but you can't work backward from an address to the private key.

Bitcoin offers several address formats — `1…`, `3…`, `bc1q…`, `bc1p…` — all derived from the same phrase. [Bitcoin Address Types](/docs/learn/address-types) explains the difference and which to use.

An address is **safe to share**. It's how someone sends you funds — think of it like an email address for money. You can hand it out, post it, or scan it as a QR code without putting your funds at risk.

## How receiving works

1. Your wallet shows you a receive address (and a QR code).
2. You give that address to the sender.
3. They broadcast a transaction to that address.
4. The funds now belong to whoever controls the matching private key — you.

There's one catch that crypto beginners get burned by: **malware can swap the address your computer displays.** If a sender pastes a tampered address, the money goes to the attacker.

## On your KeepKey

- The private keys are generated and locked inside the device — see [What Is a Crypto Wallet?](/docs/learn/what-is-a-wallet).
- When you receive, KeepKey shows the address **on its own screen** so you can confirm your computer isn't lying. Always check it there — see [Verifying Transactions](/docs/desktop/verify-on-device).
- Walk through your first receive in [Send & Receive](/docs/desktop/send-receive).