<p>Yes, you should keep your RPC credentials private. RPC credentials give someone control over your node. They will be able to issue all of the commands that you can issue, including sending coins, shutting down the node, disconnecting and connecting peers, etc. The most important part is that if your wallet is not encrypted OR if you have unlocked the wallet, having the RPC credentials allows someone to move your Bitcoin.</p>

<p>The RPC interface can also be used to overwrite files in your filesystem. The <code>backupwallet</code> command will overwrite files with the backup. An attacker could use this to effectively delete files on your machine by overwriting them with copies of your wallet.</p>

<p>However, the RPC interface is typically not exposed to the internet, so even if someone does have your RPC credentials they probably cannot connect to your node to issue commands. Even so, you should keep your credentials private, or as Nate Eldredge suggests, change them before you post the video.</p>

CC BY-SA 4.0
2018-08-23T05:08:34.580Z
You might want to add that the RPC can be used to overwrite files on your filesystem. (so, e.g. "this wallet is an empty testnet wallet" doesn't mean its safe to expose the rpc to the outside world). We have also previously had security vulnerabilities that were only exploitable via RPC.
G. Maxwell
CC BY-SA 4.0
2018-08-23T15:00:23.343Z
Are there still issues if `disablewallet` is enabled?
Jonathan Cross
CC BY-SA 4.0
2018-08-21T00:45:17.777Z
2018-08-23T14:37:06.867Z
2018-08-23T14:37:06.867Z
Ava Chow
<p>I am wondering if there are any security issues with other's knowing my RPC credentials. I'm not familiar with RPC and how it works or anything.  </p>

<p>Reason I'm asking... I make youtube videos. Right now I'm editing one where I am using the Lightning Network. Everything in the video is on the testnet. So I'm not at risk of any real damage being done to me. Most I'll lose is the progress I made setting up the testnet and lightning network on this machine. However, if my RPC credentials don't matter, it would save me a lot of time having to blur them out in my video.</p>

<p>Thank you.</p>

CC BY-SA 4.0
2018-08-21T00:42:14.723Z
Why not simply change your credentials after making the video, but before uploading it?
Nate Eldredge
<json-rpc>
Should I keep my RPC credentials private?
AltcoinXP-Anthony
# Should I keep my RPC credentials private?

(Asked by: username_0 on 2018-08-21)

I am wondering if there are any security issues with other's knowing my RPC credentials. I'm not familiar with RPC and how it works or anything.

Reason I'm asking... I make youtube videos. Right now I'm editing one where I am using the Lightning Network. Everything in the video is on the testnet. So I'm not at risk of any real damage being done to me. Most I'll lose is the progress I made setting up the testnet and lightning network on this machine. However, if my RPC credentials don't matter, it would save me a lot of time having to blur them out in my video.

Thank you.

**Tags:** json-rpc

> **Comments:**
> **username_1**: Why not simply change your credentials after making the video, but before uploading it?  

---

## 1 answers

### Answer by username_2 on 2018-08-21. Score: 3

Yes, you should keep your RPC credentials private. RPC credentials give someone control over your node. They will be able to issue all of the commands that you can issue, including sending coins, shutting down the node, disconnecting and connecting peers, etc. The most important part is that if your wallet is not encrypted OR if you have unlocked the wallet, having the RPC credentials allows someone to move your Bitcoin.

The RPC interface can also be used to overwrite files in your filesystem. The `backupwallet` command will overwrite files with the backup. An attacker could use this to effectively delete files on your machine by overwriting them with copies of your wallet.

However, the RPC interface is typically not exposed to the internet, so even if someone does have your RPC credentials they probably cannot connect to your node to issue commands. Even so, you should keep your credentials private, or as username_1 username_1 suggests, change them before you post the video.

> **Comments:**
> **username_3**: You might want to add that the RPC can be used to overwrite files on your filesystem. (so, e.g. "this wallet is an empty testnet wallet" doesn't mean its safe to expose the rpc to the outside world). We have also previously had security vulnerabilities that were only exploitable via RPC.  
> **username_4**: Are there still issues if `disablewallet` is enabled?  

---

