<p>From <a href="https://en.bitcoin.it/wiki/Wallet_encryption" rel="nofollow noreferrer">Bitcoin Wiki</a>:</p>
<blockquote>
<p>Wallet encryption uses AES-256-CBC to encrypt only the private keys
that are held in a wallet. The keys are encrypted with a master key
which is entirely random. This master key is then encrypted with
AES-256-CBC with a key derived from the passphrase using SHA-512 and
OpenSSL's EVP_BytesToKey and a dynamic number of rounds determined by
the speed of the machine which does the initial encryption (and is
updated based on the speed of a computer which does a subsequent
passphrase change).</p>
</blockquote>
<p>This means that it doesn't encrypt metadata or pubkeys.
If you want to achieve a greater degree of security and privacy, I recommend to further encrypt the wallet file.</p>

CC BY-SA 4.0
2020-08-11T16:47:30.607Z
Great answer, thanks! Questions on rounds: if the dynamic number of rounds is based on the machine's capabilities, how does Bitcoin QT know the number of rounds needed to decrypt when opening the same wallet on a different machine? Are the number of rounds stored in the wallet file? If so, are they unencrypted?
f1lt3r
CC BY-SA 4.0
2020-08-11T09:46:02.330Z
2020-08-11T09:46:02.330Z
Riccardo Masutti
<p>I understand that the Bitcoin QT wallet is already encrypted to some extent when I use a password. Is it best-practice to further encrypt the wallet file for long term storage?</p>

<wallet><security><encryption><bitcoin-qt-setup>
Should I Encrypt my Wallet for Cold Storage?
f1lt3r
# Should I Encrypt my Wallet for Cold Storage?

(Asked by: username_0 on 2020-08-10)

I understand that the Bitcoin QT wallet is already encrypted to some extent when I use a password. Is it best-practice to further encrypt the wallet file for long term storage?

**Tags:** wallet, security, encryption, bitcoin-qt-setup


---

## 1 answers

### Answer by username_1 on 2020-08-11. Score: 2

From [Bitcoin Wiki](https://en.bitcoin.it/wiki/Wallet_encryption):

> Wallet encryption uses AES-256-CBC to encrypt only the private keys
> that are held in a wallet. The keys are encrypted with a master key
> which is entirely random. This master key is then encrypted with
> AES-256-CBC with a key derived from the passphrase using SHA-512 and
> OpenSSL's EVP\_BytesToKey and a dynamic number of rounds determined by
> the speed of the machine which does the initial encryption (and is
> updated based on the speed of a computer which does a subsequent
> passphrase change).

This means that it doesn't encrypt metadata or pubkeys.
If you want to achieve a greater degree of security and privacy, I recommend to further encrypt the wallet file.

> **Comments:**
> **username_0**: Great answer, thanks! Questions on rounds: if the dynamic number of rounds is based on the machine's capabilities, how does Bitcoin QT know the number of rounds needed to decrypt when opening the same wallet on a different machine? Are the number of rounds stored in the wallet file? If so, are they unencrypted?  

---

