This guide explains Bitcoin Core gethdkeys RPC in plain English. It shows what the command does, what its result means and what it cannot prove.
TL;DR
- What it is: Bitcoin Core 28.0 introduced gethdkeys to list the BIP32 keys used by descriptors in the current wallet. By default it returns extended public keys, whether each has private material and the descriptors that reference it.
- Why it matters: gethdkeys gives operators a valuable descriptor-to-key inventory, but its output is security-sensitive. Safe audits minimise fields and exposure, avoid private export and verify mappings without turning diagnostics into a wallet backup leak.
- Current position: Require a second reviewer and explicit rollback or expiry, and pause payments, signing or network-dependent services until post-change evidence is complete.
What this means in simple English
An RPC is a command sent to one Bitcoin Core node. It can ask that node for information or request a local action. A successful reply describes that node; it does not automatically prove what happened across the Bitcoin network.
Beginners can focus on the input, the result and the limit of that result. Operators should test the command on the exact Bitcoin Core version they run before relying on it.
Simple example
Think of a mempool as one node’s waiting room for valid transactions that have not yet entered a block. Different nodes can have different waiting rooms, and the contents can change from one second to the next.
Key terms in plain English
- BIP:
- Bitcoin Improvement Proposal: a document describing a proposed rule, standard or process. Its status must be checked separately.
- Bitcoin Core:
- Widely used software that validates Bitcoin and can provide wallet, network and operator tools.
- RPC:
- A command that software sends to a node to request information or a local action.
- Node:
- A computer running Bitcoin software that checks data and communicates with other peers.
Default inventory
With no options, the RPC lists all wallet HD keys and descriptor mappings, not just keys currently generating new addresses.
Active filter
active_only true limits entries to active descriptors. Use both filtered and full inventories during audits so retired or inactive policies are not mistaken for absent keys.
Public result
Each object includes an xpub, has_private flag and descriptor objects with descriptor text and active state. Treat the complete mapping as sensitive wallet topology.
Private option
private true can add xprv values when available and requires an unlocked encrypted wallet. Avoid this option unless a narrowly approved recovery operation genuinely needs it.
Access control
Expose the wallet RPC only to an authenticated local management plane. Redact xpubs, descriptors and all xprvs from logs, tickets, screenshots and monitoring.
Cross-check
Compare returned descriptors with listdescriptors, confirm expected origins and active states and test derived receive/change addresses without exporting private material.
Audit workflow
Record wallet and network identity, run public output locally, hash a redacted inventory, investigate unknown keys, never persist raw private output and lock the wallet immediately. Build a revision-pinned evidence pack on an isolated node, wallet or protocol harness. Record source commit, binary hash, network, chain identity, configuration and dependencies.
Frequently asked questions
What is Bitcoin Core gethdkeys RPC?
Bitcoin Core 28.0 introduced gethdkeys to list the BIP32 keys used by descriptors in the current wallet. By default it returns extended public keys, whether each has private material and the descriptors that reference it.
Is Bitcoin Core gethdkeys RPC active or supported today?
Require a second reviewer and explicit rollback or expiry, and pause payments, signing or network-dependent services until post-change evidence is complete.
Why does Bitcoin Core gethdkeys RPC matter?
gethdkeys gives operators a valuable descriptor-to-key inventory, but its output is security-sensitive. Safe audits minimise fields and exposure, avoid private export and verify mappings without turning diagnostics into a wallet backup leak.
Do beginners need to use the technical details?
No. The command is mainly for people who operate Bitcoin Core or software connected to it. Other readers can use the article to understand what an operator or service is measuring.
Conclusion
gethdkeys gives operators a valuable descriptor-to-key inventory, but its output is security-sensitive. Safe audits minimise fields and exposure, avoid private export and verify mappings without turning diagnostics into a wallet backup leak.
Primary sources
Check the current specification status and the documentation for the exact implementation you operate before moving production funds or changing a mining node.
