Who holds the keys?
Your bitcoin is recorded on the network. A wallet helps you use the keys that authorise spending. A receiving address and a secret key do different jobs.
- A custodial account
- A service controls the keys. Your login gives you access to its account system. You depend on its security, withdrawal rules and availability. Account recovery follows the provider's process.
- A self-custody wallet
- You control the keys and take responsibility for protecting them. If your keys and usable backups are lost, there may be no help desk that can restore access.
The saying “not your keys, not your coins” points to this difference in control. It does not make either setup free of risk.
What does a wallet device protect?
A hardware wallet separates signing from everyday browsing.
A dedicated device is designed to keep signing keys separate from your computer. Check the recipient and amount on the device itself before approving. It cannot protect you from every scam or from a poor backup plan.
A software wallet depends on the device running it.
An application on a phone or computer can keep keys under your control, but a compromised device puts them at risk. Check the source of the app and keep the device and software up to date. An app can also be custodial: its appearance does not tell you who holds the keys.
How should you protect a recovery phrase?
A seed phrase, also called a recovery phrase, is a backup used by many wallets to restore the keys. Treat it as access to your wallet, rather than a password support can reset.
Follow the instructions for your exact wallet. Some setups also need a separate passphrase or additional recovery information.
Record it privately.
Keep the words in their exact order. Do not photograph them or save them in email, cloud notes or a chat.
Plan for theft and damage.
Protect an offline backup from theft, fire and water. Think through how a trusted person could recover access if you cannot, without exposing the backup now.
Check without destroying access.
Use the wallet's documented backup-check process. Never send a phrase to someone for checking or enter it into a website. Do not erase a working wallet just to test a backup.
What should you check before relying on a wallet?
- You know whether you or a service controls the keys.
- You have checked the device or app's source independently.
- You understand recovery, including any extra passphrase.
- Your offline backup is readable and protected from loss and damage.
- You can distinguish a receiving address from a recovery phrase.
- You check the network, address and amount before approving a payment.
A receiving address can be shared to receive payment. Sharing it can still reveal information about your activity.
Primary guidance: Bitcoin.org on securing your wallet.