<p>It should also be added that most web wallets (one example is blockchain.info) encrypts the private key with your password. As the web wallet service does not store your password, your encrypted private key is secure, even if the web wallet service is hacked. </p>

<p><strong>To put this in simpler terms:</strong></p>

<p>Your private key is in essence just a number between 1 and 0xFFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFE BAAE DCE6 AF48 A03B BFD2 5E8C D036 4140 (slightly less than 2^256). </p>

<p>Lets say that the private key the web wallet service generates for you is 1012. In reality the number would of course be much bigger than this as randomly generating such a small number is extremely small. Lets say your password is "bbfh454!fdfK". </p>

<p>If you encrypt the number 1012 with the password "bbfh454!fdfK" the number 5056 is generated (this is only an example and not accurate). The same number (5056) will always be generated with the same password ("bbfh454!fdfK") starting from 1012. The number 5056 is your real private key which is used to access your wallet, but is never stored in the web wallet service database. The number is only generated when you log into your web wallet with your password. </p>

<p>Now lets say you instead try to encrypt the number 1012 with the password "qwerty". This time another number is generated, which could be 205. As 205 is not 5056, this password does not grant you access to the bitcoins in your wallet. </p>

<p>So for this reason no one can ever access your wallet without knowing your password, and no hacker can find out your password by hacking the web wallet service as they <strong>do not store</strong> your password. </p>

<p>One downside with this approach is that if you forget your password and have no backup of the wallet, your private key and also your bitcoin is gone forever. </p>

<p>Another downside is that this approach isn't secure if your hardware is infected with malware, as the specific malware can check which password you encrypt the private key with. </p>

<p>This feature was introduced with <strong>BIP38</strong>.</p>

CC BY-SA 3.0
2016-12-22T01:12:52.227Z
If you have an encrypted wallet backup, you can bruteforce the password, assuming the password is low-entropy enough/there isn't enough key stretching.
Nick ODell
CC BY-SA 3.0
2016-12-22T00:05:23.910Z
2016-12-24T23:25:02.593Z
2016-12-24T23:25:02.593Z
user44404
<p>Any of web wallet secure, if you trust all in a row.</p>

<p>Money (Work) is not for the trust, so all web wallets are not secure.</p>

<p><a href="https://bitcoin.stackexchange.com/q/70662/43221">Here</a> is the discussion about security. Hope you find something useful above the link.</p>

CC BY-SA 3.0
2018-02-12T17:45:12.127Z
2018-02-12T19:21:31.880Z
2018-02-12T19:21:31.880Z
Denis Leonov
<p>Bitcoin security is about who sees your private keys.</p>

<p>With private keys you are able to do any transaction.</p>

<p>If there is a server that store your private keys then you should trust the server.</p>

<p>But when you store your private key, you are free to choose the security policies that fits your needs.</p>

<p>I wrote a wallet that doesn't use a server to store your private keys: <a href="https://vladimirtahl.github.io/bolt/#" rel="nofollow noreferrer">Bolt</a></p>

CC BY-SA 3.0
2016-12-21T18:22:04.777Z
2016-12-21T22:52:58.063Z
2016-12-21T22:52:58.063Z
vladimir
<p>Why store your money on some unregulated entity like most web wallets?  Either run a full bitcoin node on your computer <a href="https://www.bitcoin.com/choose-your-wallet/bitcoin-classic" rel="nofollow noreferrer">https://www.bitcoin.com/choose-your-wallet/bitcoin-classic</a> or for more security purchase a Trezor at <a href="https://www.buytrezor.com/" rel="nofollow noreferrer">https://www.buytrezor.com/</a> and back it up with a "paper" wallet with Cryptosteel.</p>

CC BY-SA 3.0
2016-12-27T17:43:23.120Z
2016-12-27T17:43:23.120Z
SatoshiReport
<p>With web wallets you need to be careful. As you stated, if they get hacked and they store your private keys, your Bitcoins are at risk. You really just need to ask yourself: </p>

<ol>
<li>how risk adverse are you? </li>
<li>can you afford to lose your coins? </li>
<li>does the convenience of a web wallet outweigh the risks?</li>
</ol>

CC BY-SA 3.0
2014-02-07T13:28:24.453Z
So I should just put a small amount in there (what your willing to loose) for convenience and keep my other bitcoins protected in cold storage? Anyways, You answered my question. Thank you.
SimplePi
CC BY-SA 3.0
2014-02-07T07:36:02.393Z
2014-02-07T07:36:02.393Z
JP Richardson
<p>I normally keep only small amounts in a web wallet because I heard that web wallets are not secure. The rest of my Bitcoins are kept in cold storage in my safe. </p>

<p>I'm just wondering if you have any experience with web wallets, if they have gotten hacked and/or if you think I should worry about it.</p>

CC BY-SA 3.0
2018-02-12T17:49:43.660Z
https://bitcoin.stackexchange.com/q/70662/43221
Denis Leonov
<wallet><security>
Are Web Wallets Secure?
SimplePi
# Are Web Wallets Secure?

(Asked by: username_0 on 2014-02-06)

I normally keep only small amounts in a web wallet because I heard that web wallets are not secure. The rest of my Bitcoins are kept in cold storage in my safe.

I'm just wondering if you have any experience with web wallets, if they have gotten hacked and/or if you think I should worry about it.

**Tags:** wallet, security

> **Comments:**
> **username_1**: https://bitcoin.stackexchange.com/q/70662/43221  

---

## 5 answers

### Answer by username_6 on 2014-02-07. Score: 3 | Accepted answer

With web wallets you need to be careful. As you stated, if they get hacked and they store your private keys, your Bitcoins are at risk. You really just need to ask yourself:

1. how risk adverse are you?
2. can you afford to lose your coins?
3. does the convenience of a web wallet outweigh the risks?

> **Comments:**
> **username_0**: So I should just put a small amount in there (what your willing to loose) for convenience and keep my other bitcoins protected in cold storage? Anyways, You answered my question. Thank you.  

---

### Answer by username_2 on 2016-12-22. Score: 1

It should also be added that most web wallets (one example is blockchain.info) encrypts the private key with your password. As the web wallet service does not store your password, your encrypted private key is secure, even if the web wallet service is hacked.

**To put this in simpler terms:**

Your private key is in essence just a number between 1 and 0xFFFF FFFF FFFF FFFF FFFF FFFF FFFF FFFE BAAE DCE6 AF48 A03B BFD2 5E8C D036 4140 (slightly less than 2^256).

Lets say that the private key the web wallet service generates for you is 1012. In reality the number would of course be much bigger than this as randomly generating such a small number is extremely small. Lets say your password is "bbfh454!fdfK".

If you encrypt the number 1012 with the password "bbfh454!fdfK" the number 5056 is generated (this is only an example and not accurate). The same number (5056) will always be generated with the same password ("bbfh454!fdfK") starting from 1012. The number 5056 is your real private key which is used to access your wallet, but is never stored in the web wallet service database. The number is only generated when you log into your web wallet with your password.

Now lets say you instead try to encrypt the number 1012 with the password "qwerty". This time another number is generated, which could be 205. As 205 is not 5056, this password does not grant you access to the bitcoins in your wallet.

So for this reason no one can ever access your wallet without knowing your password, and no hacker can find out your password by hacking the web wallet service as they **do not store** your password.

One downside with this approach is that if you forget your password and have no backup of the wallet, your private key and also your bitcoin is gone forever.

Another downside is that this approach isn't secure if your hardware is infected with malware, as the specific malware can check which password you encrypt the private key with.

This feature was introduced with **BIP38**.

> **Comments:**
> **username_3**: If you have an encrypted wallet backup, you can bruteforce the password, assuming the password is low-entropy enough/there isn't enough key stretching.  

---

### Answer by username_1 on 2018-02-12. Score: 0

Any of web wallet secure, if you trust all in a row.

Money (Work) is not for the trust, so all web wallets are not secure.

[Here](https://bitcoin.stackexchange.com/q/70662/43221) is the discussion about security. Hope you find something useful above the link.


---

### Answer by username_4 on 2016-12-21. Score: 0

Bitcoin security is about who sees your private keys.

With private keys you are able to do any transaction.

If there is a server that store your private keys then you should trust the server.

But when you store your private key, you are free to choose the security policies that fits your needs.

I wrote a wallet that doesn't use a server to store your private keys: [Bolt](https://vladimirtahl.github.io/bolt/#)


---

### Answer by username_5 on 2016-12-27. Score: 0

Why store your money on some unregulated entity like most web wallets? Either run a full bitcoin node on your computer <https://www.bitcoin.com/choose-your-wallet/bitcoin-classic> or for more security purchase a Trezor at <https://www.buytrezor.com/> and back it up with a "paper" wallet with Cryptosteel.


---

