BIP 38 encrypted private keys explained: understand 6P records, scrypt, EC-multiply mode, password risk, test vectors and safe recovery.
This guide explains BIP 38 Passphrase-protected private key in plain English. It covers the problem behind the BIP, why it matters and whether the proposal is part of Bitcoin today.
BIP 38 Passphrase-protected private key: A BIP 38 string is a 58-character Base58Check record beginning with 6P. Prefix and flag bytes identify non-EC-multiply or EC-multiply form and compressed-key handling.
A node operator is checking BIP 38 Passphrase-protected private key. AES-256 encrypts two halves of the private key after XOR processing, and the result is encoded with the format prefix and flags.
A BIP 38 string is a 58-character Base58Check record beginning with 6P. Prefix and flag bytes identify non-EC-multiply or EC-multiply form and compressed-key handling. Salt, encrypted halves and address-derived check data follow. The string is encrypted private-key material, not a wallet seed or an ordinary address.
For an existing private key, scrypt derives key material from the passphrase and a four-byte address hash. AES-256 encrypts two halves of the private key after XOR processing, and the result is encoded with the format prefix and flags. Decryption must recreate and compare the address hash to reject a wrong passphrase or wrong compression interpretation.
The owner creates an intermediate code from a passphrase-derived factor. A printer combines it with independently chosen seed material to produce an address and encrypted key without learning the final private key. Optional lot and sequence values organise batches. Confirmation codes let the owner verify that a generated address depends on the intended passphrase.
scrypt slows guessing but does not rescue a short, reused or predictable passphrase. Unicode normalisation is part of interoperability: visually identical text can have different bytes if software handles it incorrectly. Recovery notes should state the exact characters and language method without placing the passphrase beside the encrypted record.
A 32-bit hash of the resulting address is stored in plaintext as salt and a decryption check. It permits correlation with a likely address and can collide by chance. Software must derive the complete address and compare the defined bytes while treating a hash match as a check, not proof of ownership or balance.
Paper degrades, QR print quality fails and single encrypted keys do not provide deterministic change-address recovery. Importing a key into an online wallet exposes it at decryption time, while sweeping requires fee and destination verification. Modern descriptor and hardware-wallet backups often give clearer recovery and audit properties.
Validate both encryption modes with official test vectors on offline, maintained software. Confirm compressed and uncompressed address cases, wrong passphrases, Unicode samples and confirmation codes. Then sweep a disposable test key into a new wallet rather than reusing it.
BIP 38 Passphrase-protected private key: A BIP 38 string is a 58-character Base58Check record beginning with 6P.
A BIP 38 string is a 58-character Base58Check record beginning with 6P.
For an existing private key, scrypt derives key material from the passphrase and a four-byte address hash.
The owner creates an intermediate code from a passphrase-derived factor. A printer combines it with independently chosen seed material to produce an address and encrypted key without learning the final private key.
BIP 38 remains a defined encrypted-key format, but it concentrates recovery in one passphrase, one record and correct legacy software. Treat every 6P string as sensitive, test recovery before funding and prefer maintained deterministic custody for new deployments.
Check the current specification status and the documentation for the exact implementation you operate before moving production funds or changing a mining node.
BIP 128 guide to Draft timelock-recovery plan storage, presigned transaction pairs, relative delay, checksums, monitoring, cancellation and reorg safety.
BIP 433 guide to Draft keyless Pay to Anchor outputs, CPFP fee bumping, standardness, ephemeral dust, TRUC anti-pinning and wallet safety.
What is BIP-110? Learn what Bitcoin’s reduced-data soft-fork proposal restricted, why it was controversial and why it later closed.
Join the ASIC Mining Discussion
Members can read and join the discussion
Log in to read comments from other miners. Create a free account if you would like to ask a question or share your experience.
Membership helps us protect the discussion from spam and keep answers useful.