<p>Normally, when you send money you also generate a new private/public key for the "change" to return. therefore every time you send money your wallet.dat grows a little bit.</p>

<p>The Basic Idea of the deterministic wallet: instead of a database with lots of private/public keys you start with a single private key, from which all future keys can be calculated. </p>

<p>This has many advantages. It is trivial to back up and transferable. it could be used from multiple computers.</p>

<p>afaik, <a href="https://webcoin.ch/">webcoin.ch</a> uses this concept. The current "official" client not.</p>

CC BY-SA 3.0
2011-09-08T05:56:31.997Z
Caveat - the wallet doesn't generate an address every time, it generates them in chunks of 100 and reuses them. So, backing up a wallet once every ~ 50 transactions should be safe.
ripper234
CC BY-SA 3.0
2011-09-08T12:05:37.023Z
exactly, but the pre-generation of keys is not exactly the scope of this question, therefore the explanation "trivial to back up" should be sufficient.
Andreas Petersson
CC BY-SA 3.0
2011-09-15T12:57:43.920Z
It does not generate them in chunks of 100. It maintains a pool of 100 keys, and every time one is used, a new one is added. This will change though with encrypted wallets in 0.4.0, as keys cannot be generated safely when the wallet is locked.
Pieter Wuille
CC BY-SA 3.0
2011-09-07T21:29:04.517Z
2011-09-07T21:29:04.517Z
Andreas Petersson
<p>A deterministic wallet is any wallet for which a given private key can be predictably recovered with just:</p>

<ul>
<li>the original secret seed</li>
<li>the identifier / sequence number of the desired keypair</li>
</ul>

<p>There are two types of deterministic wallets:</p>

<ul>
<li>sequential deterministic wallets</li>
<li>hierarchical deterministic wallets</li>
</ul>

<p>With a sequential deterministic wallet, the seed is a passphrase or sequence of characters that can be repeatedly incremented and hashed to generate new private keys.</p>

<p>For example, if I use the passphrase:</p>

<pre><code>'shepherd mais pack rate enamel horace diva filesize maximum really roar mall'
</code></pre>

<p>...then I can create the first 100 private keys by doing the following:</p>

<pre><code>hex(sha256('shepherd mais pack rate enamel horace diva filesize maximum really roar mall 0'))
hex(sha256('shepherd mais pack rate enamel horace diva filesize maximum really roar mall 1'))
...
</code></pre>

<p>And as long as I am consistent with how I modify the original passphrase, I can easily recover any given passphrase that I wish.</p>

<p>A hierarchical deterministic wallet, on the other hand, starts with a single keypair as the master keypair. The private key of this keypair is the secret seed.</p>

<p>Each keypair has children. And the public key of a given child of a given parent node in the tree is generated by performing elliptic curve multiplication on the parent's public key.</p>

<p>The private key of the child can be recovered by the owner by performing the same multiplicative operation on the parent's private key. This is because m<em>Pubkey/Pubkey = m</em>Privkey/Privkey.</p>

<p>The cool thing about this is that you can give a server a public key and that server can generate new addresses for you without ever having to know your private key.</p>

<p>...</p>

<p>If you're looking for a python implementation of sequential deterministic wallets, I put one together here: <a href="https://github.com/blockstack/pybitcoin" rel="noreferrer">https://github.com/blockstack/pybitcoin</a> (or just do "pip install pybitcoin").</p>

<p>I don't have a working implementation of hierarchical deterministic wallets quite yet, but for that I'd check out <a href="https://github.com/FelixWeis/python-hdwallet" rel="noreferrer">this python implementation</a> or <a href="https://github.com/wink/money-tree" rel="noreferrer">this ruby implementation</a>.</p>

CC BY-SA 3.0
2016-10-07T08:18:29.400Z
@Ryan so this means parent always knows the public and private key of child but reverse is not true.
Prashant Prabhakar Singh
CC BY-SA 3.0
2018-04-21T12:03:06.483Z
Is this function ( deriving a child private key from the master private key) a one way function?
Zacharin
CC BY-SA 3.0
2014-01-27T02:42:37.377Z
2015-12-07T20:59:12.583Z
2015-12-07T20:59:12.583Z
Ryan Shea
<p>Another example using deterministic wallets is the BCCAPI, which is a library for making light-weight secure Bitcoin clients. <a href="http://code.google.com/p/bccapi/" rel="nofollow">http://code.google.com/p/bccapi/</a></p>

CC BY-SA 3.0
2011-09-07T21:42:33.227Z
2011-09-07T21:42:33.227Z
Jan
<p>Primary Bitcoin Improvement Proposals (BIP) associated with deterministic, specifically hierarchical deterministic (HD) wallets to facilitate portability between implementations to avoid vendor lock-in are BIPs 32, 39, 44. BIPs get into the technical details. May want to examine <a href="https://github.com/libbitcoin/libbitcoin/wiki/Altcoin-Version-Mappings" rel="nofollow">libbitcoin</a> for command line interface examples for applying BIPs 32, 39, and 44.</p>

CC BY-SA 3.0
2016-07-16T02:29:43.327Z
2016-07-16T02:29:43.327Z
skaht
<p>You've hit the nail on the head. A deterministic wallet is any system which uses a passphrase or other snippet of data to build a keypair in a repeatable manner. So long as you remember the passphrase, the keypair can be re-generated from it, so storage is no longer a security concern. There are several methods for generating deterministic wallets, but my favorite is Casascius' <a href="https://github.com/casascius/Bitcoin-Address-Utility">Bitcoin-Address generator</a> (C#, Windows, <a href="http://dl.dropbox.com/u/20411213/BtcAddress.zip">binaries here</a>)</p>

CC BY-SA 3.0
2011-09-07T21:27:12.000Z
2011-09-07T21:27:12.000Z
David Perry
<p>It sounds as if it's a process that enables a wallet to be rebuilt from a passphrase, or from several fragments scattered about. Could someone provide a detailed technical explanation?</p>

<security><wallet>
What is a deterministic wallet?
Gary
# What is a deterministic wallet?

(Asked by: username_0 on 2011-09-07)

It sounds as if it's a process that enables a wallet to be rebuilt from a passphrase, or from several fragments scattered about. Could someone provide a detailed technical explanation?

**Tags:** security, wallet


---

## 5 answers

### Answer by username_9 on 2011-09-07. Score: 17 | Accepted answer

You've hit the nail on the head. A deterministic wallet is any system which uses a passphrase or other snippet of data to build a keypair in a repeatable manner. So long as you remember the passphrase, the keypair can be re-generated from it, so storage is no longer a security concern. There are several methods for generating deterministic wallets, but my favorite is Casascius' [Bitcoin-Address generator](https://github.com/casascius/Bitcoin-Address-Utility) (C#, Windows, [binaries here](http://dl.dropbox.com/u/20411213/BtcAddress.zip))


---

### Answer by username_1 on 2011-09-07. Score: 17

Normally, when you send money you also generate a new private/public key for the "change" to return. therefore every time you send money your wallet.dat grows a little bit.

The Basic Idea of the deterministic wallet: instead of a database with lots of private/public keys you start with a single private key, from which all future keys can be calculated.

This has many advantages. It is trivial to back up and transferable. it could be used from multiple computers.

afaik, [webcoin.ch](https://webcoin.ch/) uses this concept. The current "official" client not.

> **Comments:**
> **username_2**: Caveat - the wallet doesn't generate an address every time, it generates them in chunks of 100 and reuses them. So, backing up a wallet once every ~ 50 transactions should be safe.  
> **username_1**: exactly, but the pre-generation of keys is not exactly the scope of this question, therefore the explanation "trivial to back up" should be sufficient.  
> **username_3**: It does not generate them in chunks of 100. It maintains a pool of 100 keys, and every time one is used, a new one is added. This will change though with encrypted wallets in 0.4.0, as keys cannot be generated safely when the wallet is locked.  

---

### Answer by username_4 on 2014-01-27. Score: 14

A deterministic wallet is any wallet for which a given private key can be predictably recovered with just:

the original secret seed
the identifier / sequence number of the desired keypair

There are two types of deterministic wallets:

sequential deterministic wallets
hierarchical deterministic wallets

With a sequential deterministic wallet, the seed is a passphrase or sequence of characters that can be repeatedly incremented and hashed to generate new private keys.
For example, if I use the passphrase:
'shepherd mais pack rate enamel horace diva filesize maximum really roar mall'

...then I can create the first 100 private keys by doing the following:
hex(sha256('shepherd mais pack rate enamel horace diva filesize maximum really roar mall 0'))
hex(sha256('shepherd mais pack rate enamel horace diva filesize maximum really roar mall 1'))
...

And as long as I am consistent with how I modify the original passphrase, I can easily recover any given passphrase that I wish.
A hierarchical deterministic wallet, on the other hand, starts with a single keypair as the master keypair. The private key of this keypair is the secret seed.
Each keypair has children. And the public key of a given child of a given parent node in the tree is generated by performing elliptic curve multiplication on the parent's public key.
The private key of the child can be recovered by the owner by performing the same multiplicative operation on the parent's private key. This is because mPubkey/Pubkey = mPrivkey/Privkey.
The cool thing about this is that you can give a server a public key and that server can generate new addresses for you without ever having to know your private key.
...
If you're looking for a python implementation of sequential deterministic wallets, I put one together here: https://github.com/blockstack/pybitcoin (or just do "pip install pybitcoin").
I don't have a working implementation of hierarchical deterministic wallets quite yet, but for that I'd check out this python implementation or this ruby implementation.

> **Comments:**
> **username_5**: @Ryan so this means parent always knows the public and private key of child but reverse is not true.  
> **username_6**: Is this function ( deriving a child private key from the master private key) a one way function?  

---

### Answer by username_7 on 2011-09-07. Score: 4

Another example using deterministic wallets is the BCCAPI, which is a library for making light-weight secure Bitcoin clients. <http://code.google.com/p/bccapi/>


---

### Answer by username_8 on 2016-07-16. Score: 2

Primary Bitcoin Improvement Proposals (BIP) associated with deterministic, specifically hierarchical deterministic (HD) wallets to facilitate portability between implementations to avoid vendor lock-in are BIPs 32, 39, 44. BIPs get into the technical details. May want to examine [libbitcoin](https://github.com/libbitcoin/libbitcoin/wiki/Altcoin-Version-Mappings) for command line interface examples for applying BIPs 32, 39, and 44.


---

