Bitcoin Core dumpprivkey RPC: Private-Key Exposure Guide

This guide explains Bitcoin Core dumpprivkey RPC in plain English. It shows what the command does, what its result means and what it cannot prove.

Address ownership boundary

The required argument is an address for which the wallet holds the private key. Watch-only scripts, multisignature addresses and unsupported address forms may not map to one exportable key. Route to the exact wallet and verify the requested address, network and purpose before any secret is exposed.

Wallet unlock and authorisation

Encrypted wallets may require a tightly bounded unlock under the historical workflow. Separate the approver from the operator where possible, restrict RPC to a protected local channel and ensure no remote support session, screen recording or command echo captures the result. Re-lock promptly and verify the unlock timeout.

Secret-output hazards

The returned key is spend authority. Do not print it in general terminals, paste it into tickets, copy it through chat or store it in shell history, application logs, analytics or monitoring. Use an offline controlled recovery environment and a destination designed for secret ingestion. Evidence should record only fingerprints and success state.

Import is not complete recovery

importprivkey can add the key and trigger a scan, but it does not restore labels, account structure, redeem scripts, multisignature policy or the HD context that generated neighbouring keys. A single exported key also fails to cover future addresses. Prefer verified wallet, descriptor or seed recovery appropriate to the wallet type.

Sweep and rotation

Once a private key has left its original boundary, assume every copy can spend until funds move. If export was necessary, create a reviewed new wallet, sweep under a fee and confirmation plan, monitor the old address and retire insecure copies through the approved secret-destruction process. Do not reuse the exposed key for new deposits.

Audit without disclosure

Record wallet identifier, address fingerprint, reason, approvers, controlled destination and subsequent sweep status. Never log the key itself or derivations that recreate it. Review command histories and backups for accidental copies and treat any uncertain exposure as a security incident rather than a documentation mistake.

Offline drill

On regtest with disposable keys, verify correct and wrong addresses, locked-wallet behaviour, watch-only failure, import and rescan. Show that a recovered key spends the expected output, then practise sweeping and revoking the test environment. Production drills should prove the process without ever revealing a real private key.

Conclusion

dumpprivkey crosses the wallet’s most sensitive boundary by exposing spend authority to the caller. Use it only in a controlled recovery process, prevent copies, recognise incomplete context and move funds away from any key whose secrecy is uncertain.