Private Key Derivation in Monero Wallets: Understanding Spend Keys and View Keys

A user creates a Monero wallet and receives a 25-word mnemonic phrase. That seed is not the wallet itself. It is the cryptographic material from which two separate keys—a spend key and a view key—must be derived before any transaction can be signed or any balance can be scanned. Understanding that derivation process explains why a non-custodial Monero wallet never transmits credentials to a server, why both keys are necessary, and why the security model depends entirely on local key reconstruction.

Most users think of a wallet login as an identity verification step performed by a remote service. A Monero wallet operates differently. When a user enters a recovery seed or imports a wallet file protected by a password, the application reconstructs the entire key hierarchy locally—without ever sending the seed, the password, or any derived key to an external party. That reconstruction is the login. It is also the foundation of non-custodial architecture, and it depends on precise cryptographic operations that few users can see but all users rely on.

The mnemonic seed is the root of all keys

A 25-word recovery seed in a Monero wallet represents entropy encoded in human-readable form. Each word is drawn from a standardized word list and mapped to numeric values. When a user enters the seed during login, the wallet converts those words into a 256-bit binary value. That binary value is then used as input to a key derivation function, which generates all subsequent cryptographic material. The seed itself is never stored on the device or transmitted. Only the keys derived from it remain in memory during active use, and then only until the wallet is closed or the session ends.

The distinction between the seed and the keys derived from it is fundamental to security design. If an attacker obtains the seed, they can derive every key associated with that wallet and access all funds. If an attacker obtains only the spend key, they can create transactions but cannot necessarily scan the blockchain to see balances or receiving addresses without the view key. If they obtain the view key alone, they can observe incoming and outgoing transactions but cannot spend funds. This separation allows for different threat models and audit capabilities that a single, unified secret would not permit.

The recovery seed is stored as a sequence of words because binary strings are difficult for humans to write, verify, or memorize. The encoding introduces no new cryptographic properties; it is purely a usability layer. Whether written on paper, memorized, or stored in encrypted form, the seed remains the master secret. Users who lose their seed have no recovery mechanism, which is why a non-custodial Monero wallet does not offer “forgot password” options. There is no server that holds a backup. There is only the local derivation process, which can only be reversed by possessing the original seed or the keys already derived from it.

Spend key derivation and transaction signing

The spend key is the secret required to create a valid Monero transaction. When the mnemonic seed is processed through the key derivation function, it produces a 256-bit scalar known as the spend key. This key never leaves the application’s memory during normal operation; it is not displayed, exported, or transmitted unless the user explicitly chooses to share it for specific reasons such as creating a view-only wallet or importing into another application.

When a user initiates a transaction, the wallet uses the spend key to create a ring signature—a cryptographic proof that the sender authorized the transfer without revealing which specific input was actually spent. Monero’s ring signature design requires the spend key to sign the transaction, but the signature itself does not expose the key. The transaction structure uses stealth addresses and one-time addresses to ensure that each payment produces a distinct receiving destination. The spend key is the mechanism that enables all of this, but it operates behind the scenes.

The relationship between the spend key and the private view key is subtle but important. Both are derived from the seed, but they serve different purposes. The spend key allows transaction creation. The view key allows decryption of transaction metadata and detection of incoming payments. A user who shares only the view key with another party—perhaps an accountant or auditor—allows that party to see all transactions without permitting them to move funds. This is possible precisely because the spend key and view key are separate secrets derived from the same seed.

The security of this system depends on the strength of the underlying elliptic curve cryptography and the quality of the random number generation used when creating the initial seed. If the seed is weak—for example, if it is derived from a predictable source rather than true randomness—an attacker could potentially regenerate the same seed and derive the same keys. This is why a proper Monero wallet implementation uses cryptographically secure randomness when generating the initial 25-word mnemonic phrase. When users import a wallet file or recovery seed, they must ensure it comes from a trusted source, because the derivation process will faithfully reconstruct whatever keys that seed is designed to produce, whether secure or compromised.

View key derivation and transaction scanning

The private view key is derived from the spend key through a secondary cryptographic operation. This relationship is one-way: an attacker who knows the view key cannot compute the spend key. However, anyone who knows the spend key can derive the view key. This asymmetry is intentional. It allows a user to share the view key with external services, wallet applications, or other parties without compromising the ability to spend funds.

The view key’s primary role is to decrypt transaction metadata and identify incoming payments. When a user opens a Monero wallet, the application must scan the blockchain to determine which transactions belong to that wallet and which amounts were received. This scanning process uses the view key to test whether each output on the blockchain is spendable by the wallet. Without the view key, the wallet would have no way to recognize its own transactions; every user would see the entire blockchain but would not know which outputs were their own.

A public view key is derived from the private view key and can be shared freely. Some Monero wallets allow users to export both the public view key and the public address so that others can verify transactions without requiring access to the private view key. In audit scenarios or when setting up a view-only wallet, only the private view key is needed. The private view key is the sensitive secret that should never be shared, whereas the public view key is non-secret and cannot be used to spend funds or decrypt incoming transaction amounts in a way that reveals the sender’s view of the transaction.

The separation of view and spend keys is what enables a view-only wallet. If a user exports their private view key and the public address, another application or another device can import these credentials and monitor incoming transactions without any ability to create outgoing payments. This is useful for watch-only monitoring, real-time balance checks on a security-isolated device, or allowing a third party to track transactions for accounting purposes. None of these use cases would be possible if the view key and spend key were a single unified secret.

How non-custodial login reconstructs keys locally

When a user accesses a Monero wallet through an application like the monero wallet platform, the login process never transmits the recovery seed, the spend key, or the view key to any server. Instead, the application performs all key derivation locally on the user’s device. The sequence is as follows: the user enters their mnemonic phrase or imports a wallet file protected by a password. The application converts the mnemonic phrase into its binary representation or derives a key from the password using a key derivation function. That binary value is then fed into the elliptic curve key derivation algorithm to produce the spend key. The spend key is then used to derive the view key. Both keys remain in the application’s memory and are used locally to scan transactions and sign outgoing payments.

This local derivation is the defining feature of a non-custodial wallet. Because the keys are never transmitted, no server ever has the ability to freeze assets, impose withdrawal restrictions, or force a password reset. There is no “account” in the traditional sense. There is only the cryptographic relationship between the seed and the derived keys, computed locally each time the user logs in. If the user loses their wallet file and cannot recover the seed, access to the funds is permanently lost. There is no account recovery team, no backup held in escrow, and no way to reset credentials. This is the security trade-off: total control and privacy in exchange for total responsibility for backup and seed security.

The login process is stateless from the server’s perspective. When the user opens the wallet application, no authentication request is sent to a remote service. No credentials are checked. The only network communication that occurs is blockchain synchronization—downloading block headers and scanning them for transactions belonging to the user’s address. If the user chooses to connect to a remote node, that node sees the addresses being scanned but has no information about the user’s identity or which wallet they control. If the user operates a local node on their own hardware, even that metadata is retained locally.

The security of this architecture depends critically on the client-side device. If a user’s device is compromised by malware, an attacker could capture keystrokes, screenshot the seed during entry, or observe the keys in memory. The local derivation process protects against remote attackers and network eavesdropping, but it cannot protect against a compromised device. Users must therefore ensure that the device on which they access their wallet is secure, that they do not enter sensitive information in front of shoulder surfers or cameras, and that they do not store the recovery seed in unencrypted form on internet-connected systems.

The irreversibility of key derivation and its security implications

Monero’s key derivation uses a one-way cryptographic function. Given the spend key, one can derive the view key. Given the view key, one cannot derive the spend key. Given the seed, one can derive both keys. But given only the derived keys, one cannot reverse the process to obtain the original seed. This is not a limitation of current technology; it is a fundamental mathematical property of the elliptic curve operations used. This irreversibility is essential to security.

The implication is that if a user’s device stores the derived keys but not the seed, and the derived keys are leaked, the attacker can spend all funds immediately but cannot derive anything else or reconstruct the seed. If the seed is leaked, the attacker can derive all keys and has complete control over the wallet. This creates a clear security hierarchy: the seed must be protected absolutely; the spend key must be protected during its use; the view key can be more freely shared because it has limited power. In practice, the spend key should be protected as closely as the seed, because compromising the spend key allows fund theft even though the full wallet hierarchy cannot be rebuilt.

The security model of a non-custodial Monero wallet therefore places responsibility on the user at two levels. First, the user must protect the mnemonic phrase as if it were cash. Second, the user must protect the device on which they derive keys and sign transactions. These are not theoretical concerns. Users who have stored seeds in cloud accounts, photographed seeds and sent them in messages, or entered seeds into phishing websites have lost all funds. The cryptography cannot protect against user error at the point of key entry.

Node connections and the view key’s role in blockchain scanning

After keys are derived locally, a Monero wallet must connect to the blockchain to determine which transactions belong to the user and what balance is available. This step requires the view key. The wallet has two main options: connect to a remote node operated by someone else, or run a local full node. The choice determines what information is leaked and who can observe it.

When connecting to a remote node, the wallet sends scanning requests to the node to identify which outputs on the blockchain belong to the user’s address. The node operator can observe the addresses being scanned and can infer, with varying confidence, which wallet the user controls. However, the node operator never sees the spend key or the private view key. The wallet performs the necessary cryptographic operations locally using the private view key to decrypt outputs; the node simply stores the blockchain and responds to queries. This is an acceptable privacy trade-off for users who do not wish to operate a local node, but it should not be confused with complete anonymity.

A local node on the user’s own hardware does not suffer from this information leakage. The wallet and node communicate on the same device, and no blockchain queries are transmitted to remote parties. However, operating a local node requires significant disk space (typically 150+ gigabytes), network bandwidth, and processing power. It also requires the user to keep the device online for synchronization to be current. For most users, a properly configured remote node is a reasonable compromise between privacy and practicality.

The view key is the mechanism that makes remote nodes possible without compromising spending security. The node cannot sign transactions, create new keys, or perform any action that would require the spend key. It can only respond to queries about whether specific outputs are spendable by the user. This delegation of scanning tasks to a remote party is why Monero’s privacy model involves both keys. A single unified secret would not allow this separation of concerns.

Password-protected wallet files and encryption of stored keys

A Monero wallet file is an encrypted container holding the spend key, view key, and other metadata necessary to recover the wallet. When a user sets a password to protect the wallet file, that password is converted into a key using a key derivation function such as argon2. The derived key is then used to encrypt the wallet file contents using a symmetric cipher such as AES-256. The result is a file that can be stored on disk without exposing the keys, as long as the password is strong.

When the user opens a password-protected wallet file, the application prompts for the password, derives the same encryption key using the same parameters, and decrypts the wallet file. This reveals the stored spend and view keys. The password itself is never sent anywhere; it is used only to encrypt and decrypt the local file. If a user forgets the password, there is no recovery mechanism. The encrypted wallet file becomes inaccessible. This is why users should back up not only the mnemonic phrase but also the wallet file and password in secure locations, because losing any of these three items leaves the wallet unrecoverable.

The security of a password-protected wallet file depends on password strength. A weak password can be brute-forced by an attacker who obtains the encrypted file. For this reason, Monero wallet implementations typically enforce relatively strict password requirements. Users should choose passwords that are long, random, and not derived from personal information. A password manager can help generate and store strong passwords securely. The password file itself should be stored separately from the wallet file—if both are on the same device and the device is compromised, the attacker can decrypt the file and access the keys.

Why no password recovery exists in non-custodial wallets

A traditional online service can send a password reset link to a user’s email because the service controls the account and maintains a separate authentication channel. A non-custodial Monero wallet has no such mechanism. There is no account to reset, no email to verify, and no server that could verify ownership. The password and seed are the only ways to access the wallet, and neither can be recovered if lost.

This absence of password recovery is not a limitation of the wallet software. It is a logical consequence of non-custodial architecture. If a service could recover access to a wallet without the original password or seed, it would mean the service holds a backup copy of the keys or can derive them through some other mechanism. That would require the service to be custodial—to hold the user’s secrets on its servers. The moment a third party holds a copy of the keys, the wallet is no longer non-custodial, and the user faces the risks of centralized custody: account lockout, regulatory seizure, hacking, and loss of direct control.

The design choice to offer no password recovery enforces user responsibility and is integral to privacy. Users must treat their recovery seed and password with the same care they would use for physical cash or valuable documents. Losing them carries real consequences. This is uncomfortable for some users, which is why some services market themselves as offering “easier” password recovery. Those services are necessarily custodial or semi-custodial, meaning they hold some capability to access user funds without the user’s active cryptographic participation. A true non-custodial Monero wallet cannot offer this without becoming custodial.