<p>Essentially, a hardened child key is is computed with <code>hash(parent private key + index)</code>, whereas a non-hardened child key is computed with <code>hash(parent public key + index)</code>.</p>

<p>So what practical consequences does this have?</p>

<p>With an extended public key, you can derive non-hardened child public keys. This is useful in situations where you want to accept payments without immediately being able to spend them. For example, if you had a website selling alpaca socks, your server could use an extended public key to accept payments without losing all of your money if it got hacked. So that's a reason why you might use non-hardened derivation.</p>

<p>With an extended private key, you can also derive hardened keys.</p>

<p>However, non-hardened public keys are weaker when an attacker has 1) the extended public key and 2) one of the non-hardened private keys that was derived from it. In that circumstance, the attacker can work out the private key of the extended public key, and therefore get every key that can be derived from that, hardened and non-hardened.</p>

<p>So what should your app use by default?</p>

<p>You should use non-hardened keys, and disable the ability to export private keys when that would allow an attacker to compromise other keys in the wallet. Even if an attacker gets ahold of one of the private keys, in situations where the attacker doesn't have access to the extended public key, non-hardened is equivalent to hardened security. In my mind, the features of non-hardened keys outweigh the added security of hardened keys.</p>

<p>However, if you don't need the features of non-hardened keys, then you should use hardened keys, because they're more secure.</p>

CC BY-SA 3.0
2017-01-18T09:53:48.637Z
What can hardened keys be used for? What are their limitations.
Baz
CC BY-SA 3.0
2017-01-18T18:58:29.317Z
Hardened keys are useful whenever you don't need the ability to give someone a master public key, and have them know all addresses. For those cases, they have much better security properties than unhardened.
Pieter Wuille
CC BY-SA 3.0
2017-09-06T03:36:08.417Z
@PieterWuille how so? I don't think I get it. I want to make a service which generates bitcoin addresses which people can pay, and that I know I can spend from. With hardened addresses, I need a private key on this service, so if I get hacked, I lose all the money. With non-hardened addresses, there is no sensitive info on my service, so it can be hacked to no damage. I just need to store the private key safely anywhere.
MaiaVictor
CC BY-SA 3.0
2017-09-06T06:16:07.590Z
Yes, that's something you can only do with non-hardened keys.
Pieter Wuille
CC BY-SA 4.0
2020-05-03T03:04:59.543Z
How changing private key to public in the hash function makes derivation non-hardened? Or is it just a convention? There’s 0x00 prepended probably to make it look like a public key?
Jeiwan
CC BY-SA 4.0
2015-05-20T20:54:14.847Z
2020-02-18T18:52:34.413Z
2020-02-18T18:52:34.413Z
Nick ODell
<p>I've read <a href="https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#Child_key_derivation_CKD_functions" rel="noreferrer">BIP32</a>, and I do understand it more or less.</p>

<p>Could someone please explain to me like I'm 5 years old what the difference between a child-key and a hardened child-key is?</p>

<p>I'm trying to add HD wallet generation to a service I'm building. I need to be completely informed about this before I dabble in it. Fret not, I'll be using <a href="http://bitcore.io/" rel="noreferrer">Bitcore</a>, so I won't be dabbling with the crypto directly.</p>

<private-key><bip32-hd-wallets><hardened-derivation>
ELI5: What's the difference between a child-key and a hardened child-key in BIP32
Amin Shah Gilani
# ELI5: What's the difference between a child-key and a hardened child-key in BIP32

(Asked by: username_0 on 2015-05-20)

I've read [BIP32](https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#Child_key_derivation_CKD_functions), and I do understand it more or less.

Could someone please explain to me like I'm 5 years old what the difference between a child-key and a hardened child-key is?

I'm trying to add HD wallet generation to a service I'm building. I need to be completely informed about this before I dabble in it. Fret not, I'll be using [Bitcore](http://bitcore.io/), so I won't be dabbling with the crypto directly.

**Tags:** private-key, bip32-hd-wallets, hardened-derivation


---

## 1 answers

### Answer by username_1 on 2015-05-20. Score: 44 | Accepted answer

Essentially, a hardened child key is is computed with `hash(parent private key + index)`, whereas a non-hardened child key is computed with `hash(parent public key + index)`.

So what practical consequences does this have?

With an extended public key, you can derive non-hardened child public keys. This is useful in situations where you want to accept payments without immediately being able to spend them. For example, if you had a website selling alpaca socks, your server could use an extended public key to accept payments without losing all of your money if it got hacked. So that's a reason why you might use non-hardened derivation.

With an extended private key, you can also derive hardened keys.

However, non-hardened public keys are weaker when an attacker has 1) the extended public key and 2) one of the non-hardened private keys that was derived from it. In that circumstance, the attacker can work out the private key of the extended public key, and therefore get every key that can be derived from that, hardened and non-hardened.

So what should your app use by default?

You should use non-hardened keys, and disable the ability to export private keys when that would allow an attacker to compromise other keys in the wallet. Even if an attacker gets ahold of one of the private keys, in situations where the attacker doesn't have access to the extended public key, non-hardened is equivalent to hardened security. In my mind, the features of non-hardened keys outweigh the added security of hardened keys.

However, if you don't need the features of non-hardened keys, then you should use hardened keys, because they're more secure.

> **Comments:**
> **username_2**: What can hardened keys be used for? What are their limitations.  
> **username_3**: Hardened keys are useful whenever you don't need the ability to give someone a master public key, and have them know all addresses. For those cases, they have much better security properties than unhardened.  
> **username_4**: @PieterWuille how so? I don't think I get it. I want to make a service which generates bitcoin addresses which people can pay, and that I know I can spend from. With hardened addresses, I need a private key on this service, so if I get hacked, I lose all the money. With non-hardened addresses, there is no sensitive info on my service, so it can be hacked to no damage. I just need to store the private key safely anywhere.  
> **username_3**: Yes, that's something you can only do with non-hardened keys.  
> **username_5**: How changing private key to public in the hash function makes derivation non-hardened? Or is it just a convention? There’s 0x00 prepended probably to make it look like a public key?  

---

