Hierarchical Deterministic Wallet (HD Wallet)

A hierarchical deterministic (HD) wallet is a cryptocurrency wallet that creates all of its keys from one starting value, called a master seed, and arranges them in a tree. From the seed, the wallet can produce an almost unlimited number of private keys and matching addresses in a fixed, repeatable way. Because the process is deterministic, anyone who has the seed can regenerate exactly the same keys in the same order, so backing up the seed once protects every address the wallet will ever use.

The design was set out for Bitcoin in 2012 in Bitcoin Improvement Proposal 32 (BIP 32) and is now used by most software and hardware wallets across many blockchains. It is a refinement of the simpler deterministic wallet. In practice, the seed is usually shown to the user as a list of 12 or 24 words, the seed phrase, following a later standard, BIP 39.

Imagine a master key that can be used to cut any number of other keys, each for a different door, and always cuts them in the same order. If the house burns down, the owner does not need copies of every key, only the master key. With it, they can recreate the whole set exactly.

An HD wallet works the same way. A new receiving address can be made for every payment, which helps privacy, and separate branches can hold different accounts or coins. Yet the whole collection can be restored from one written-down list of words. The flip side is that anyone who finds those words can rebuild every key too.

1. Seed creation. The wallet generates a large random number. Under BIP 39, it is encoded as a list of words and, optionally, combined with an extra passphrase.
2. Master key. The seed is processed with a cryptographic hash function to produce a master private key and a chain code, a value used to derive children.
3. Child keys. Each key can produce numbered child keys, which can produce their own children, forming a tree. Every child has its own public key and addresses.
4. Paths. The position of a key in the tree is written as a path, such as m/44'/0'/0'/0/0. Standards like BIP 44 assign branches to purpose, coin type, account, change and address index, so different wallets can find the same funds.

An HD wallet can export an extended public key, often called an xpub, from a branch of the tree. The xpub can generate all the public keys and addresses on that branch, but not the private keys. This lets a merchant's website create a fresh address for every customer without holding any key that could spend funds, or lets an accountant monitor balances through a watch-only wallet.

BIP 32 distinguishes normal and "hardened" derivation. With normal derivation, if an attacker obtains the xpub and any single child private key on that branch, they can work out the parent private key and so every key below it. Hardened derivation, marked with an apostrophe in the path, breaks that link, which is why account-level branches are normally hardened.

• One backup. A single seed phrase restores all accounts and addresses, even after years of use.
• Privacy. A new wallet address can be used for every transaction, making it harder to link payments.
• Organization. Separate branches can hold accounts for different purposes or different cryptocurrencies.
• Interoperability. Because the standards are shared, the same seed can usually be restored in another compatible wallet.

• Single point of failure. Anyone who obtains the seed phrase controls everything in the wallet, so it must be stored offline and securely, ideally with methods described under cold storage.
• Loss. If the seed and every device are lost, funds cannot be recovered; no company can reset it.
• Path mismatches. Wallets that use different derivation paths may not show the same funds when a seed is restored, which can alarm users into thinking coins are lost.
• xpub exposure. Sharing an extended public key reveals the whole history and balance of that branch, and combined with a leaked child key it can compromise funds.
• Phishing. Fake wallet apps and support scams commonly try to trick users into typing in their seed phrase.

To spread risk, some users combine HD wallets with a multi-sig wallet setup, in which several independent seeds must sign a transaction, or split backups across locations. Holding coins in an HD wallet that the user controls is a form of self custody, as opposed to leaving them with an exchange.

• BIP 32: Hierarchical Deterministic Wallets