What are the parts of a crypto wallet, and who should see each one?

The parts, from secret to public

Each lesson in this module covered one part. Here they are side by side.^1,2,3

Part	What it is	Who may see it
Recovery phrase	12 to 24 words that can rebuild every key^1,6	Nobody else: anyone who has it can drain every asset⁴
Passphrase (optional)	An extra secret that turns the same words into a different wallet¹	Nobody else (Module 8 covers it)¹
Private key	The number that signs transactions³	Nobody else: it is never sent to the network^7,4
Derivation path	Which branch of the key tree each account uses²	Not secret, but needed to find every account again⁸
Extended public key	A key that can make all the public keys below it (except hardened ones)⁹	Only with care, for example an auditor⁹
Address	What others send funds to³	Anyone: ethereum.org compares it to an email address¹⁰
Signature	Your approval of one exact piece of data¹¹	Public once sent: it doesn't reveal the key^7,11

What the sources say about setting up

The official guides and standards cited in this module describe a few habits.^1,4,10

Let the wallet make the phrase. BIP-39 is meant for computer-made randomness, not for sentences people make up.^1,8
Write it down, off-line. ethereum.org says not to store it on a computer, and warns that screenshots can sync to the cloud.^10,4
Note the paths. Mastering Bitcoin says recovery can depend on knowing which paths your wallet used.⁸
Share only addresses, and check them in full. ethereum.org says to make sure an address exactly matches.⁴ MetaMask says to check the middle characters too.¹²
Read before you sign. When you interact with a smart contract, ethereum.org suggests reading the transaction message before signing.⁴
Never type the phrase into a website. No real service, support agent or website will ask for it.⁴

Examples, not rules

This lesson describes what the cited sources say, and shows one made-up company's choices. It is not advice for any real company. An SEC investor bulletin suggests weighing your own convenience and security needs when you choose a wallet.⁵

One key, one point of failure

So far, each Brindlecove account is an ordinary account controlled by one private key.¹³ ethereum.org's warning applies: stolen keys give thieves instant access to all the funds in an account.¹³

That is one reason to look further. Module 8 covers storing a phrase and planning for the worst, and Module 9 covers wallets that need several people to approve.^13,5

Maya's set-up, start to finish (made up)

Maya goes through every part of Brindlecove's new hardware wallet set-up.

Phrase. The hardware wallet makes 24 words on its own screen. Maya writes them down. They never touch a computer.
Paths. She notes that Treasury is m/44'/60'/0'/0/0 and Payments is m/44'/60'/1'/0/0, and which device and app she used.
Addresses. Suppliers get the Payments address. Pellowmark Bank (made up) never needs either address: it only handles Brindlecove's dollars.
Auditors. They get both addresses and set up a watch-only view. They can see every payment, but sign nothing.
Check. She restores the phrase on a second hardware wallet, typing the words on the device itself, and finds the same two addresses once she asks it for account 1.
Signing. She reads every request on the device screen, and refuses anything she can't read.

Her open question for next quarter: should one person, holding one phrase, control the whole treasury? Module 9 follows that story.

Our viewEvery part has a different audience. Many of the mistakes in this module come from showing a part to the wrong one: a phrase typed into a website, or an address copied without checking.

General education built from the publicly available sources listed above. Not financial, legal, tax or investment advice. Naming a company, project or regulator is not an endorsement either way. Last checked 2026-10-22. Terms and disclaimer.