Bitcoin Forum

I am wondering about the security steps in regards to Paper Wallets and official Desktop Wallets for a coin etc.

When I read about Paper Wallets it is always recommended that you generate the key from an airtight machine without internet connection, basically the method seem to be to have a single dedicated new machine running on some obscure OS that has never been connected to the internet and then destroy it with C4 explosives after the keys has been generated.

For example this is the instructions from the Paper Wallet list thread:
About use of applications: DO NOT generate wallets nor addresses when conected to the Internet. Download the app, review the code, check the file's hashsum to verify it's the original file and only work with it in an air-gapped machine (use Live-DVD OS to help all the process) and never touch the net while doing it. Before sending funds to an address, it is recommended that you first check for compatibility of addresses generated by those apps by importing some of their private keys into the official (and most popular unofficial too) client. This can be done most of the time through the debug console using the "importprivkey" command. If you are able to successfully import keys, the tested generator/app is compatible.

https://bitcointalk.org/index.php?topic=1164163.0

From these security precautions, am I understanding it right that there is a bigger security risk of generating Paper Wallets vs using regular offical coin Desktop Wallets so that higher security measures are neccessary to create the paper wallet safely? Because when using Desktop Wallets and stuff you often need to be connected to the internet and your keys and seeds are often displayed openly during setup and you are often even asked to type them into the machine to verify. Also sometimes you are required to download and store a backup file of the wallet.

In other words, if someone uses an offical Desktop Wallet for a coin and decided to create a Paper Wallet on the same machine instead, connected to the internet as usual, would they be at a higher security risk vs using the offical Desktop Wallet? Or would the risk even be lower still, connected to the internet and everything, because they never have to type something into the computer that a keylogger can pick up?

I don't think it's an EXTRA security risk (depending on which software you use to generate the paper wallet)... However, in my personal opinion, paper wallets are used for long term storage of bigger amounts... A paper wallet needs to be safer than a desktop wallet, that's why you should take extra precautions when generating it.

If you were using an online machine to generate a paper wallet, you could just have used a desktop wallet instead...

If we are talking about the same amount stored though? Do the Paper wallet need to be safer than the desktop wallet in that case?

And because you never type anything in to the computer when creating a paper wallet, and many dektop wallets actually make you type in your seed which is your password when you send coins, does that mean the paper wallet is safer even when always connected to the internet?

If that is the case, creating the paper wallet with the internet off on the same computer that you normally have your coins in a desktop wallet should be like 10X more secure vs using a desktop wallet? Or should you always setup your desktop wallets also in offline mode? (I have never seen any instructions though when initializing a desktop wallet that you should turn out the internet so if that is much safer I dont understand why there would be no such instructions during the setup, I have always thought you need to be connected to the internet to setup desktop wallets? There is something that needs to be sent to a server an initialize your key in the system? It can't all be done offline?)

I feel like I am missing something here.

Also a practical question. When you create your paper wallet you get a public and a private key. Can you do searches on your public key or put in some program like cointracker to keep track of your balance in your paper wallet, or is that also a risk? Should you just send money into the paper wallet adress and hope it is there, or how do you check it actually arrived since there is no gui on it?

I'm going to try to formulate an answer here... altough there seem to be a lot of questions mingled together... Remember, i can only give you my personal opinion, what works for me doesn't necessarily work for you:

- if you store the same amount of BTC, and not looking for extra security, i would defenatly go for a desktop wallet... Easyer to use, and already pretty safe out-of-the box (most of the time)
- i have no idear if it's an extra security issue if an HD wallet forces you to repeat the seed... I guess on an infected PC, it might be completely unsecure... you're right
- personally, i don't boot using an usb bootable os when generating a paper wallet... I just download bitaddress's sourcecode, turn off my internet, generate a paper wallet, put the wallet on an USB stick and then reboot my pc before i turn the internet back on
- i think most desktop wallet will allow you to generate your wallet while you're offline... I'm sure about core and electrum, but i don't think other wallet would turn out to be a problem... However, if you want to start syncing the blocks (or block headers in case of electrum), it's obvious you'll need to be online. It is possible for you to only keep the xprv (or private keys in case of a non HD wallet) on an offline pc, while importing the xpub (or addresses) on an online PC... This way you actually implemented a cold storage technique ;)


Most paper wallet generators give you a private key and an address... I don't see any security issues when looking up your balance using your address by using a block explorer. The only thing that might happen is that you lose a bit of anonimity (your ip could potentially be tracked). The only moment your private key should be scanned (or typed into) an online pc is when you sweep your paper wallet tough!!!!
I would also recommand not to enter your public key on an onine PC, only your address.

Without all technical aspects, and the many different forms it actually goes like this:

private key =(hashing function)=> public key =(hashing function)=> address
So, if the first hashing function ever gets compromised, it should (theorecitally) be possible to re-calculate your private key starting from your public key... IF a hacker wants to calculate your private key while he only has your address, he has to reverse-engineer 2 different hashing algo's...

Thank you! Sounds easy enough and using something like https://walletgenerator.net sounds actually more convinient to store different coins than trying to install and set up a dozen of different desktop wallets for each coin. Now I have so few coins so maybe it is a bit overkill, but my thinking is that even a very few coins could be worth a fortune in 10 years. But booting up ubuntu from an usb is even safer then? (Or should you use a CD instead?) I even heard someone say that you should pull out your hard drives while you do this to minimize infection risk. Don't know where the lines goes from security to paranoia though :P

Is storing the paper wallet on an USB not risky though? What if the usb malfunction or something?

If you're really paranoid, you could indeed make a tails usbstick and boot from an airgapped machine without harddisks... But personally, i do think that's overkill ;)
As for storing your paper wallet on an usbstick: i also print it out on an offline printer and laminate this paper.

I would suggest to bip38 encrypt your paper wallet, if you pick a strong password, it would be very hard for anyone to steal your coins ;)

How do you mean you "lament" your paper and how is this done and why? (sorry not native english)

How do you bip38 encrypt a wallet? I looked in https://walletgenerator.net/ but I could not see such an option on the single wallet? I only saw it on the paper wallet section, but there you don't get to input any random words to generate the private key, but instead just press a button that give key, that does not feel nearly as safe?

Btw, is bip38 when you also put a password on your paper wallet, and does that work with all coins that can have a paper wallet?

Also do you undertand what they mean with this?

"Step 5. Keep your private key secret

The private key is literally the keys to your coins, if someone was to obtain it, they could withdraw the funds currently in the wallet, and any funds that might be deposited in that wallet.

Please test spending a small amount before receiving any large payments."

What do they mean by spend a small amount? Once I create a paper wallet and send funds to it I cant spend it until I have extracted the private key, which I should only do once I actually do want to spend the funds again? Do they actually mean to SEND a small amount to the address before sending a bigger amount to the address?

put plastic around the paper, so it's water-proof (i hope lament was the correct term, i'm not a native speaker myself ;))

i always use https://www.bitaddress.org , this paper wallet generator allows you to use bip38 encryption


Well, i would advise against spending part of the unconfirmed outputs that are controlled by the private key on your paper wallet... Either sweep it completely, or don't touch it at all.. Maybe they mean that you should generate a test-paper wallet, put a small amount on it, then sweep it, then generate a NEW paper wallet to actually use...

Hmm not sure, as long as you send a small amount and you can see that amount actually reached the address it should be all good to send more to it? It must be what they meant?

By the way, when I want to sweep (if that is what restoring my coins is) the paper wallet and it has a bip48 on it, where do I put in the bip48? I have restored a regular paper wallet before, but I never saw any option to put in a bip48 password?

If you mean loading the wallet and then using a block explorer to see if the output is added to the address' balance, that would be OK. However, this procedure will not guarantee that you'll be able to spend outputs. If you do this, you might end up with a loaded paper wallet and no knowledge on how to spend your outputs...

However, if you load the wallet, then try to spend some of the outputs (but not all), in order to test your paper wallet, you have 2 risks:
1) you will have entered the private key onto some sort of wallet software, this is not good
2) as soon as you create a transaction to spend outputs from your paper wallet, you will have broadcasted your public key, this is not good

That is why you can create 2 paper wallets, load one with a minimal amount, try to sweep it... If everything goes well, load the rest of the funds onto the second paper wallet whose private key has never touched an online machine.

As for your second question: it seems most wallets do not support bip38 encrypted private keys. However, you can use the offline sourcecode of bitaddress.org (the wallet details-tab) to decrypt an encrypted key, then sweep the decrypted key.

Hmmm I get a little confused by this "If you mean loading the wallet and then using a block explorer to see if the output is added to the address' balance, that would be OK. However, this procedure will not guarantee that you'll be able to spend outputs. If you do this, you might end up with a loaded paper wallet and no knowledge on how to spend your outputs..."

If I send coins to the adress I have, and I can see they land on the adress, why would I not be guaranteed to be able to spend that money later? And what do you mean by "you might end up with a loaded paper wallet and no knowledge on how to spend your outputs"?

Also why does it help create two wallets and only test one of them? How do I know the second one will work if the first one does?

By the way, with "sweeping" do you mean importing the private address to a wallet?

It's more of a procedure thing... If you create one paper wallet, load it with a very small amount, try sweeping it, you are sure that you have all software and all techniques to sweep a paper wallet... If you have never tested out the procedure before, you might get stuck trying to decrypt a bip38 encrypted private key, or you might be stuck trying to figure out which QR code to scan,... If you did a testrun, you'll be 100% sure everything works as planned.
BTW: bitcoin is about freedom... If you don't want to do a trial run, nobody is forcing you to do one... It's completely up to you...


No... Sweeping = using an automated process programmed by your wallet vendor to create a transaction using all unspent outputs from your paper wallet to create a new transaction whose outputs can be spent by the keys that are managed by your wallet.

Importing = actually starting to manage the outputs to a certain address whose private keys you imported into a wallet.

The difference is that when you sweep a paper wallet, the wallet gets "emptied" (for the lack of a better word). If you import a wallet, it gets imported (it's still funded, but now it gets managed by the wallet in  which you imported the private key)

Oh ok, I have done it with a BTC paper wallet in the past and I wont use bip38. I did it on https://blockchain.info/ and it was very easy to just import adress and then put in the private key and done. (Is this what is called sweeping because I still did not get that fully?)

But yes, how do I do this with other coins besides btc? On https://walletgenerator.net/ you can create paper wallets for tons of different coins. Say for example I create one for Doge coin or DigiByte, where do I go then to put in the private key to unlock the wallet?

I'd strongly encourage anybody to use bip38 encryption... If you don't use encryption, anybody who finds your paper wallet will be able to sweep it



I would advise against using online wallets... Since you're experimenting with paper wallets, i can only assume you care about the security of your wallets, and in my honest opinion, online wallets are the most insecure type of wallets that exist.



I know dogecoin has an electrum clone that is an SPV HD wallet with a sweeping function. I don't have initmate knowledge about digibyte, but as a rule of thumb, allmost all coins that are based on the bitcoin codebase can run a "core" version in deamon mode and have an importprivkey command (either from the command line or inside the QT wallet)

If the paper wallet and the desktop wallet will be compared . I will prefer the desktop wallet because the paper wallet is not secured especially on public areas like market and other public areas. Compared to the desktop wallet it is electronic and it is so hard to be stolen, so for me desktop wallet is more advisable.

What if I create a paperwallet for a random coin. How do I know I will be able to sweep it anywhere? Does there not have to exist a dedicated site with a sweep function to be able to redeem the private key on the paper wallet?

Still not sure what sweep actually mean? I assume it means to transfer my funds from the paper wallet to another wallet.

I agree, having a desktop wallet is much better than having a paper wallet because you can load the desktop wallet at any time if there is a computer nearby with an active Internet connection. Paper Wallets are usually for people that prefer to keep their money safe by burying it in something or hiding it somewhere though in most cases if someone finds the Paper Wallet then the money is good as gone.

Desktop wallets work best with a password, of course.

I think that a Paper Wallet is much easier to secure because it does not have to be online in order for it to be used. If I wanted to get Bitcoins then I would just try to load up the paper wallet and get the cash, that’s pretty much all there is with a Paper Wallet. A desktop wallet requires electricity.

I would suggest something like a trezor so that it has the security of a hardware wallet, but you can actively see your balances without having to physically connect it each time. The recovery is also super easy if you break it or lose it.

The paper wallet is safer and also the gambang is used directly, and does not have to open any site site to transact. If I want to get Bitcoin, I will only be able to load paper wallets and earn money in cash, that's all there with Paper Wallet . The desktop wallet needs electricity to open it

sweep simply means spend. when you sweep a private key the wallet software goes to your wallet file and chooses a new address and then sends (spends) the funds from the swept private key to that address.

if there aren't anything weird about altcoins' private keys and how they make transactions, then it is not a hard or strange thing to import/sweep paper wallet into regular wallets. most of them have the function already and if not you can always ask a programmer to make you some small code to do it based on their source code.

The only reason why people create paper wallets offline is because nobody can log your session while you doing it or even retrieve a cache copy of your session if you do it offline. If you are going to store say, 4000 bitcoins on a wallet, would you not spend $100 to $200 on a old second hand computer and printer to create paper wallets and then sleep easy knowing that nobody will ever be able to access your private key with those coins.

You can destroy the old equipment after you created several 1000's of addresses/private keys and it would have been money well spend. < Most secure method to create paper wallets >

Desktop wallets are online and have to avoid Malware and Spyware and keyloggers and all those nasty things out there.

Yes but you have to be able to trust yourself with the little piece of paper...potentially in a security deposit box or something like that.   That's good if you plan on not using the coins and just holding them for the long haul.

I've never actually used paper wallets before

But how do I know there is actually a way to sweep the coins I am creating the wallet for in the future? For example a big coin like Monero I can't find anywhere to sweep the coin

I haven't experimented with monero, but looking at their paper wallet generator i found here: https://moneroaddress.org/ it seems they generate a seed witch can be used to restore to a new wallet using simplewallet...

Paper wallet is definitely safer as it is completely offline.

Desktop wallets are only as safe as your desktop. If you run antivirous checks every now and then, and keep your system clean then you shouldn't worry about storying your bitcoins on a desktop wallet. There is always the risk of losing money from a hard disk failure even though it's very rare.

I suggesting using cryptosteel, you can store your private key with waterproof. Paper wallets aren't fireproof, waterproof or anything proof really for that matter.

Ok thank you. Monero is one of the bigger coins though. How about smaller coins that you have on your paper wallet? It would suck big time to put y our savings on a paper wallet, and then find out there is no way to get them out :/ Or will there always be a way as long as the coin is actually worth something?

If the clone is based on the bitcoin codebase (like most altcoins are), you can probably download their reference client and it'll probably have a way to import a private key... Only in the highly unlikely event that a dev cloned bitcoin (or cloned a bitcoin clone) AND removed the functionality to import private keys, you can potentially have a problem... Unless there are other wallet clients that have been generated that also allow you to sweep or import a private key.

It's hard to give a one-size-fits-all answer to this question tough... There might be coins out there that were written from scratch and only have wallets without the option to import private keys... I can't imagine a coin like that at this moment, but theoretically it could be possible... I highly doubt there would be a trusted paper wallet generator for such a coin tough :)

Hi,
     I believe paper wallets are the way to go for long term storage for large quantities of BTC..for me that would be 2BTC and up especially at the price BTC is valued at now. Cold storage is the key!

    I  understand what is required and the risks involved with Malware..hackers and keyloggers...so this is what I did.

    Bought a new laptop, new printer, usb chip and new camera.

    These devices will never be connected to the internet. I downloaded the wallet program and also bought it too via https://www.bitaddress.org/

    Installed both on my new PC and created a paper wallet with the BIP38 encrypt..Printed multiple copies and took pictures which I stored onto the USB chip.
    I also tested the wallet to make sure the private and public key match by using the two separate wallet programs. I would not want to place into a paper wallet that somehow send your coins into oblivion or that you cannot retrieve.

    So now I have paper and software images of my wallets private and public keys. Since water is one thing to be concerned about I laminated the wallets and also placed it in this plastic mold.
    What you see is the Q square of the private key which is encrypted but is water proof. I can literally place in my acquarium! I tested and it can be scanned with no proble,
        
        https://ibb.co/jbbVkv (https://ibb.co/jbbVkv)
        https://ibb.co/hi2syF (https://ibb.co/hi2syF)

   That being done...I safely store the paperwallets and USB chips in a safe deposit box in water proof zip lock bags.

    As far as monitoring your bitcoin public address balance..there are apps out there that do this. And as for hiding your IP address, I use a VPN software where I can show I am coming rom INDIA and thus hide my true ID and not leave any kind of IP original footprint. For instance whenever I goto any forum I make sure I do not use my real IP address. If there are any hackers out there they can see who owns Bitcoins and thus see your real IP. This can give them a possible target. So when it comes to digital cryptocurrency take all precautions. Goodluck!

i think beside of desktop wallet, i will use android phone wallet because if i am out from home and i need to buy something like to refill my phone card, i only use my android phone to buy in local store and i can pay with the wallet on my android phone. using desktop wallet is just for saving my most of bitcoin so in my android phone, i only send some amount that i think its enough for my to buy something later.

Both wallet are good, Actually Im using three wallets like paper wallet , desktop wallet and online wallet. I split my balance into three and fill my wallet with bitcoins. Paper wallet is for the long hold of bitcoin. I used my desktop wallet when Im transacting in my home and Im using online wallet when Im in other places that I cant access my both wallet. But every that Im using is good its just depending on how you will use it.

I am not so sure about it. Ok we get it to the point that paper wallets can be promised wothout the Internet very independent of the Internet use. However paper wallet should always have a medium for communication so it does means that your key  can still be visible to other devices

Seems like too many things could go wrong with a paper wallet. What do people think about making a wallet with a passphrase seed offline then moving coins to it and then deleting the wallet. So you just have passphrase. I dont see how you can be hacked this way? I kind of cold storage for dummies.

Something people dont talk about enough in security is splitting your money into as many places as practically possible. Some one some wallets on phone with different providers. Some on desktop. Even some on a few exchanges. I mean they cant all be compromised. I personally would never want my coins in one wallet even if i had the best security or paper offline system in place.

Yes the seed will bring your wallet back. I personally like the BIP encrypted wallet. Even if a person finds it they will not be able to crack the code.

I think a lot of the security needs depend on your internet browsing habits and the overall way you go about using your computer/laptop.

If you are the type to download and use cracked apps, browse sketchy websites, click on "meet hot chicks now,"  etc.   Then you definitely need some sort of cold storage/paperwallet.

For the average joe, that solely uses their computer for work and shopping at amazon.com or going to espn.com and things like that...paper wallet is definitely an added layer of security, but not an absolute necessity IMO, unless you are holding what you feel is a substantial amount of money.  It also make more effort that it's worth to you.

For instance, if you had $100 bill in your wallet, and that was all the money you had to your name, you are far more likely to keep your wallet in front pocket and within arms reach.   If it isn't worth your time to even look for your wallet if you lost it with $100, then paper wallets may be more steps than you are willing to take.   So it's really case by case.

A paper wallet is always more secure than a desktop wallet and the reason you should be offline when you do it is because the same security threats that can steal bitcoins off ur desktop wallet could do so with ur paper wallet if you are connected to the internet.

However assuming your computer was risk free when you first connected to the internet your paper wallet would be just as safe as when you are offline.

People take more precautions with a paper wallet precisely because they want the most secure wallet possible and that is the only reason for creating them because they aren't very useful in that form.

I not know Paper Wallet can good than Desktop Wallet or not?
I hold my BTC with a method, I use a desktop wallet for create an address and send some BTC I want hold long-term. When done, I will backup private key this address, backup it to paper, Trezor or a hard device can use long time and security, look like as could storage 8)

A single drop of water in the right place on that paper and the data is unusable.  I woulnd't be afraid to use cloud storage or whatever, but if it makes you more secure, then get a cheap couple of USB drives and operate your wallets from them.

In my humble opinion, I don't see any upside to having a paper wallet versus using a hardware wallet. I emphatically agree that one should never keep more than spending money in a hot wallet, or coins that you plan on trading on an exchange, but paper can very easily deteriorate or get lost or destroyed. That's why I'm a firm believer in hardware cold storage wallets.