How Bitcoin Wallets Work
A wallet does not actually hold your Bitcoin. It holds the keys that prove the Bitcoin is yours. Once that one idea clicks, every security decision on this page gets easier - so let us start there.
The first thing to unlearn
If you are picturing a wallet that holds your Bitcoin the way your leather wallet holds cash, the first step is to let that picture go. A Bitcoin wallet does not "contain" coins the way a folder contains files. The Bitcoin itself lives on the blockchain - a giant shared record of who owns what, kept on thousands of computers at once. What your wallet actually holds is the private key: the secret that proves a specific chunk of Bitcoin on that record is yours to spend.
A better analogy: your wallet is like a keyring. The Bitcoin lives in a lockbox (the blockchain). Anyone can see the lockbox. Only the person with the right key can open it.
This distinction matters because it changes how you think about security. You are not protecting "your Bitcoin." You are protecting your key. If someone copies your key, they can move your Bitcoin. If you lose your key, nobody - not the wallet company, not the Bitcoin network, nobody - can help you get it back.
The three things a wallet manages
Private key, public address, and seed phrase. Everything else is interface.
Private key
Think of this as an impossibly long password - technically a 256-bit number - that lets you spend the Bitcoin tied to it. Your wallet creates it for you the moment you set up, so you never have to. Whoever knows this number controls your Bitcoin, full stop, which is why it must never be shared, photographed, or kept on a device that touches the internet.
In practice, you never see or type your private key directly. The wallet handles it behind the scenes. What you interact with is the seed phrase (below).
Public address
Your public address is generated from your private key by a one-way calculation - easy to run forwards, effectively impossible to reverse - so handing out the address never exposes the key behind it. This is the part you share when you want to receive Bitcoin, like giving someone your bank account number. Anyone can send to it; nobody can spend from it. Only the private key can do that.
Modern wallets generate a new address for each transaction for privacy. They all derive from the same private key, so you control all of them.
Seed phrase (recovery phrase)
When you create a wallet it hands you 12 or 24 plain English words. Those words are your private key, just written in a form a human can copy down. If your device breaks, gets lost, or is stolen, typing these words into a new device brings your entire wallet back.
This is the most important thing you will ever write down. Store it offline - on paper, on metal. Never type it into a website. Never photograph it. Never store it in a notes app. If someone gets your seed phrase, they have your Bitcoin.
"Not your keys, not your coins"
Every wallet comes down to one question: who actually holds the private key, you or somebody else?
Custodial (exchange holds the key)
When you "hold" Bitcoin on Coinbase, River, or any exchange, they hold the private key. You have an IOU - a claim on Bitcoin, not Bitcoin itself. This is convenient, but it means you are trusting the exchange not to lose it, get hacked, freeze your account, or go bankrupt (FTX, Celsius, Mt. Gox).
Analogy: keeping cash in a bank. Convenient, but the bank could fail.
Non-custodial (you hold the key)
A non-custodial wallet means you - and only you - have the private key. No company can freeze your funds, lose them in a hack, or prevent you from transacting. The trade-off: you are solely responsible for backup and security. Lose your seed phrase, lose your Bitcoin.
This is the recommended approach for any meaningful amount of Bitcoin.
Types of non-custodial wallets
From most convenient to most secure.
Software wallets (hot wallets)
Apps that run on your phone or laptop, with your private key kept right there on the device. They are free, they are convenient, and for smaller amounts they are perfectly reasonable. "Hot" just means the key lives on something connected to the internet.
Our picks: Sparrow (A-) for desktop power users. BlueWallet (C+) for mobile. Phoenix (B-) for Lightning payments.
Risk: Your keys live on a device that connects to the internet. If the device is compromised by malware, your keys are exposed.
Hardware wallets (cold wallets)
A small dedicated device that keeps your private key offline and approves payments without ever handing the key to your computer. "Cold" means the key stays off the internet entirely. They cost $70-$170 and are the gold standard once you are protecting a meaningful amount.
Our picks: Coldcard (B+) for the most security - it is air-gapped, so it never plugs into a computer at all. Trezor (B) for open-source firmware and an easier learning curve. Ledger (D) is the famous one, but its firmware is closed-source - you are trusting the company's word about what it does - and it has a data breach in its past.
Risk: The device itself is not the risk - it can be replaced. The risk is losing your seed phrase backup.
Multisig wallets
These need more than one key to approve a payment - say two keys out of three (written 2-of-3) - with each key kept on a separate device in a separate place. The payoff: one stolen or lost key no longer means lost Bitcoin, because no single key is enough on its own.
Our picks: Sparrow (A-) supports multisig setup. Unchained (B) provides guided multisig with a key agent.
Risk: Complexity. Setup errors can lock you out. Not recommended unless you have the technical comfort and the amount justifies it.
What most people should do
Under $1,000: A software wallet is fine. Use BlueWallet on your phone. Write down the seed phrase on paper. Store the paper somewhere safe.
$1,000 - $50,000: Get a hardware wallet. A Trezor Safe 3 or Coldcard costs $70-$170 and dramatically improves your security. Stamp your seed phrase on metal. Store it in a separate location from the device. We rank every device we tested in our Bitcoin wallet reviews.
Over $50,000: Consider multisig. Store keys in different geographic locations. Have a plan for what happens if you die. This is real money - protect it like real money.
At every level: use a DCA strategy on an exchange like River or Swan, then periodically withdraw to your own wallet. Do not let Bitcoin accumulate on exchanges.
Related
Go deeper on Bitcoin security and storage
Newsletter
Bitcoin insights, no noise.
Bitcoin explained without the hype. Updates when they matter.