AllPrivateKeys

Conceptual illustration of the cryptographic private-key search space.

AllPrivateKeys is a third-party website that displays pages derived from possible cryptocurrency private-key values and publishes tools and lists related to weak, leaked, or user-chosen keys. The site describes its purpose as demonstrating the size and mechanics of the Bitcoin key space. Its pages do not constitute a practical search of every Bitcoin private key, and the appearance of an address on such a page does not mean that its private key was discovered.

Safety warning: Never enter a real private key, wallet recovery phrase, seed, or passphrase into this or any other website. Never send funds to an address whose private key has been publicly displayed. A disclosed key must be treated as compromised.

How the key-space display works

Bitcoin uses the secp256k1 elliptic curve. A valid secret key is a non-zero integer smaller than the curve order. Wallet software generates keys from cryptographically secure randomness or derives them from a protected deterministic-wallet seed. The corresponding public key can be calculated from a secret key, but recovering a secret key from a properly generated public key is considered computationally infeasible; BIP 32 describes an expected security level of about 2¹²⁸ elliptic-curve operations for that reverse problem.

Because the mathematical mapping is deterministic, a website can calculate the public key and possible address encodings for any selected integer. It can also divide consecutive integers into numbered pages without storing the entire space. This is an illustration of the mapping, not evidence that keys are being extracted from the blockchain. The possible key space is far too large to enumerate in a way that threatens uniformly random keys.

Weak and exposed keys

Bitcoin's cryptography does not protect a key that was generated predictably, reused from a public example, exposed in source code, or derived from a guessable phrase. Classic brainwallets are especially vulnerable because an attacker can test password guesses offline. A large-scale academic study tested about 300 billion candidate passwords and found that nearly all identified brainwallets had been drained, often within minutes or hours.

Lists described as “leaked” or “compromised” therefore concern failures of key generation or key handling, not a shortcut through the secp256k1 key space. Any public listing may also contain inaccurate labels, copied data, or addresses that received unsolicited small transactions. An address balance does not prove who controls the key, and an address-to-person label requires separate evidence.

Privacy and operational risks

The AllPrivateKeys site offers key-conversion, passphrase, wallet-file, and address-search tools. Using an online tool with an actual secret can disclose that secret to the operator, browser extensions, malware, network observers, analytics systems, logs, or later data breaches. A page claiming that a key or wallet file is “available” should not be treated as proof of authenticity or legal authority to spend funds.

For legitimate wallet recovery or testing:

• follow the documentation of the wallet software that created the backup;
• use testnet or regtest data for demonstrations;
• keep production seeds and private keys out of websites, search engines, source repositories, messages, screenshots, and AI prompts;
• treat any key used in public documentation as permanently unsafe; and
• if a funded key may have been exposed, move the funds with trusted wallet software to a newly generated wallet and retire the compromised key.

See also

• Private key
• Brainwallet
• Bitcoin address
• Cold storage

External link

• AllPrivateKeys — third-party site; do not submit wallet secrets