imtoken
Seed Phrase & Private Keys
Learn why seed phrases and private keys must stay under the user’s control and how to create a safer offline backup.
Why a seed phrase is a high-privilege credential
With Why a seed phrase is a high-privilege credential, one common mistake is treating interface text as the final on-chain truth. A seed phrase can usually recreate wallet control on another device, so exposure can compromise the account. Keep it offline, do not send it to support, avoid long-term photo storage, and verify the word order and legibility after creating the backup.
A wallet account is anchored by an on-chain address, signing authority and locally controlled key material. The app helps present state, but control ultimately depends on the keys and the ability to sign. Before changing devices, verify the backup rather than relying on local app data alone. These questions are best resolved through public on-chain records, trusted sources and the wallet’s local information rather than explanations from an unknown person.
Importing a wallet restores control of an existing account on a new device; it does not move assets on-chain. Confirm the device and software source first, and avoid exposing seed phrases or private keys on shared computers, remote desktops or recorded sessions. A useful final test is to ask four questions: which network am I on, who am I interacting with, what permission am I granting, and what on-chain result should I expect?
Make the checks repeatable
- Verify the network, address or contract source relevant to why a seed phrase is a high-privilege credential.
- Confirm that the request matches the intended action instead of relying on a familiar label.
- Keep public identifiers such as transaction hashes for verification while keeping private credentials under your own control.
A private key is never a support verification tool
For A private key is never a support verification tool, start with information that can be independently verified. A private key directly represents signing authority and should never be treated as a routine identity check. If a webpage, chat window, remote-support tool or supposed sync service asks for it, stop and independently verify the source.
Fake support commonly arrives through unsolicited messages, remote-control requests, recovery-phrase demands or instructions to install unknown software. A legitimate security process does not require sending seed phrases, private keys or verification codes to anyone. Verify contact through an independent official entry point. When the page does not match what you expected, canceling is usually safer than pushing through. Then verify the transaction hash, contract address or explorer record independently.
Phishing pages often rely on lookalike domains, search ads, direct messages or fake promotions. Use a trusted entry point and verify the domain. A familiar logo, polished design or urgent warning does not make a site legitimate. Seed phrases, private keys and verification codes are never required as troubleshooting material and should not be shared with anyone.
Practical checks
- Verify the network, address or contract source relevant to a private key is never a support verification tool.
- Confirm that the request matches the intended action instead of relying on a familiar label.
- Keep public identifiers such as transaction hashes for verification while keeping private credentials under your own control.
What a good offline backup requires
You do not need every protocol detail to handle What a good offline backup requires well, but you do need to know which facts determine the outcome. A backup exists so account control can be restored after device loss or app-data failure. A useful backup should stay offline, readable, correctly ordered and stored in a controlled place while avoiding a single point of failure or unnecessary digital copies.
Device security includes system updates, screen locks, application provenance, malware protection and physical access control. A wallet cannot replace device-level protection. If the device shows suspicious popups, unknown software or remote-control activity, stop sensitive actions first. The same button label can produce very different results on a different network, contract or permission context, which is why labels alone are not enough.
Public Wi-Fi and shared computers increase exposure to session theft, malicious software and account compromise. For wallet login, signing or backup work, prefer devices and networks you control and avoid leaving sensitive sessions on shared machines. A useful final test is to ask four questions: which network am I on, who am I interacting with, what permission am I granting, and what on-chain result should I expect?
What is easy to miss
- Verify the network, address or contract source relevant to what a good offline backup requires.
- Confirm that the request matches the intended action instead of relying on a familiar label.
- Keep public identifiers such as transaction hashes for verification while keeping private credentials under your own control.
What to prioritize after suspected exposure
In practice, What to prioritize after suspected exposure connects to several steps before and after the action itself. A private key directly represents signing authority and should never be treated as a routine identity check. If a webpage, chat window, remote-support tool or supposed sync service asks for it, stop and independently verify the source.
Before sending, verify the destination address, network, asset, amount and gas. For higher-value transfers, a small test can reduce operational mistakes. If the page unexpectedly asks to switch networks, add an approval or sign something unrelated, cancel and review before continuing. These questions are best resolved through public on-chain records, trusted sources and the wallet’s local information rather than explanations from an unknown person.
Transaction history should distinguish submitted, included in a block and further-confirmed states. A delayed interface update does not necessarily mean failure; the transaction hash and execution result on the correct network are the primary verification points. Seed phrases, private keys and verification codes are never required as troubleshooting material and should not be shared with anyone.
Before you confirm
- Verify the network, address or contract source relevant to what to prioritize after suspected exposure.
- Confirm that the request matches the intended action instead of relying on a familiar label.
- Keep public identifiers such as transaction hashes for verification while keeping private credentials under your own control.
Security statement
Seed phrases and private keys remain under the user’s control. Official personnel will not ask for them or for verification codes; on-chain transactions generally cannot be reversed by a wallet alone; third-party DApps and smart contracts may carry risk.
imtoken
Ready to get started?
The download entry always goes through the dedicated download page. Keep verifying networks, addresses and request details before acting.