Keystore File
Encrypted JSON file containing a private key.
A keystore file is an encrypted file that stores a cryptocurrency private key, commonly in a structured JSON format. A password and key-derivation process are used to decrypt the key when signing is required. The file protects key material at rest, but both the file and its password must remain recoverable and confidential.
Ethereum Web3 Secret Storage files typically contain version information, an identifier, an address, encrypted key data, and parameters describing the cipher, key-derivation function, and integrity check. Implementations use these fields to derive an encryption key from the password and verify successful decryption. The visible address is not secret and does not allow signing.
Keystore files matter because raw private keys are difficult to store or transfer safely. An encrypted file can support wallet import, node operation, validator signing, backups, and controlled migration between machines. Encryption reduces the harm of file theft when the password and cryptographic parameters are strong, but it does not eliminate risk.
An attacker who obtains the file can perform offline password guessing without triggering an account lockout. Short, reused, or predictable passwords are dangerous. Old files may use weak derivation settings that make guessing cheaper. Malware can capture the decrypted key or password while legitimate software opens it, so endpoint security and trusted applications remain essential.
Back up the file and password through separate secure channels. Storing both in the same unencrypted folder defeats the design. Record the wallet format, software, network context, and recovery procedure without exposing secrets. Test restoration on a controlled system and verify the expected address before moving significant assets.
Never upload a keystore to a website or send it to supposed support. Verify import software and maintain an untouched backup before conversion. For teams, prefer managed signing, hardware security modules, or multisig where one file would control valuable assets. A keystore is a portable encrypted container, not automatic cold storage, a seed phrase, or protection against malicious signing after it is unlocked.
Organizations should track keystore copies, authorized hosts, format version, and last recovery test without placing passwords in the inventory. When retiring a key, first verify that assets and every contract role have moved, then securely remove accessible copies according to documented retention and incident requirements.
Frequently asked questions
- Ethereum clients, validator tools, wallets, and deployment systems use keystore files to import or export an encrypted private key. The JSON normally records encryption parameters, ciphertext, and a public identifier such as the address. Compatibility varies by format and implementation. Test imports with trusted software and verify the derived address before depending on a migrated file.
- Use a long, unique, randomly generated password that is not reused anywhere else. Store it separately from the keystore through an appropriate password manager or controlled offline process. Encryption strength also depends on the file's key-derivation settings and implementation. A strong password cannot protect a file after malware captures it during unlocking or signing.
- A correctly encrypted keystore cannot normally be unlocked without its password. If the same account can be recovered through a seed phrase, hardware wallet, another secure key copy, or an active authorized system, create a new controlled backup or migrate assets. Do not send the file to strangers offering recovery. Preserve it unchanged while assessing legitimate recovery options.