<p>It gets it from the keypool, which has 100 pre-generated addresses by default.  The next time you enter your passphrase, it will refill the pool with new addresses.</p>

<p>Here's an example that shows the pool running out, and refilling when the password is supplied.  The following commands were performed by a trained professional.  Please don't try this at home (especially the first 2 commands):</p>

<pre><code>$ cd ~/.bitcoin
$ rm wallet.dat
$ bitcoin-cli -daemon -keypool=5
bitcoin server starting
$ bitcoin-cli encryptwallet mypass
wallet encrypted; bitcoin server stopping, restart to run with encrypted wallet
$ bitcoin-cli -daemon -keypool=5
bitcoin server starting
$ bitcoin-cli getnewaddress
1Bf6TrgiBxzZhdtEWZuWuREkbfoAtmZ5xa
$ bitcoin-cli getnewaddress
1JzjmeH1LHzJ5JYzUu3wh36N7LWvfVeB2u
$ bitcoin-cli getnewaddress
1sjVdVJAAWB6JTsja4nEVezdnqiE6Ko3V
$ bitcoin-cli walletpassphrase mypass 3600
$ bitcoin-cli walletlock
$ bitcoin-cli getnewaddress
1DVZHRNbdBivqRKzas7iFT8emsb8EtcJT1
$ bitcoin-cli getnewaddress
1HBXkVkWCVhntzgkxdb9hnUxNeMdFqVssQ
$ bitcoin-cli getnewaddress
18n17UHshaufcufo5z1PBPAdErPWxesBhs
$ bitcoin-cli getnewaddress
1CofrGkqWrAmibBUgtLysknXdsBpDJARTs
$ bitcoin-cli getnewaddress
1NwWuba3khc31ebZU8fVAept2MDdnSndgV
$ bitcoin-cli getnewaddress
16QVdikDatH2FkQNkrRgGXrQ9LbEooHAPF
$ bitcoin-cli getnewaddress
error: {"code":-12,"message":"Error: Keypool ran out, please call keypoolrefill first"}
$ bitcoin-cli walletpassphrase mypass 3600
$ bitcoin-cli walletlock
$ bitcoin-cli getnewaddress
1BSDX4PiHKvdssjAzDLVACAAQvwiijmETV
$ bitcoin-cli getnewaddress
1JJphgnC5gqunLtbbLAwtN8LXRnCUYWARm
$ bitcoin-cli getnewaddress
17UJqrpuakgPPuxPTLa8LeeWVAKijZW66x
$ bitcoin-cli getnewaddress
16itq5LpuwyhtfbiHbQxVzJYYdGE7nQRoz
$ bitcoin-cli getnewaddress
1QA4EnXPUHquK9WBxBppicfBTD2gYTB9ic
$ bitcoin-cli getnewaddress
12bgaABsakRouK9NZyUAK1RAD9nmDtHQKa
$ bitcoin-cli getnewaddress
error: {"code":-12,"message":"Error: Keypool ran out, please call keypoolrefill first"}
$ 
</code></pre>

CC BY-SA 3.0
2012-12-16T05:10:48.807Z
Where does the key pool track that the key is being  used if the wallet is locked?  What if bitcoind is restarted? http://bitcoin.stackexchange.com/q/5800/1878
makerofthings7
CC BY-SA 3.0
2012-12-16T19:06:00.407Z
Each 'getnewaddress' takes an address from the keypool. Being 'locked' simply means that the passphrase used to encrypt the private key of each address is unavailable. This prevents new addresses from being created (since the passphrase is required to encrypt the new private key) and existing addresses from having their contents spend (since the passphrase is required to decrypt their private key). The wallet isn't locked in the sense of being unmodifiable, and so addresses can be marked as no longer being in the keypool.
Chris Moore
CC BY-SA 3.0
2012-06-30T16:48:36.140Z
2017-01-12T21:12:10.073Z
2017-01-12T21:12:10.073Z
Chris Moore
<p>Suppose that my wallet is encrypted with a passphase and currently I have not provided <code>bitcoind</code> with the passphrase to access the private keys section of the wallet.</p>

<p>If I enter:</p>

<pre><code>bitcoind getnewaddress
</code></pre>

<p>It prints a new address, say [someaddress], but where does it store the private key that goes with it?</p>

<p>If I enter:</p>

<pre><code>bitcoind dumpprivkey [someaddress]
</code></pre>

<p>I get an error message since I have not provided the wallet passphrase.</p>

<p>But if I first provide the wallet passphrase and then try <code>dumpprivkey</code> it shows the private key.</p>

<p>When I asked it to get a new address, I had not provided the passphrase, so how it store the private key?</p>

<wallet><bitcoind><encryption><private-key>
How does bitcoind generate a new address if the wallet is encrypted
Sam
# How does bitcoind generate a new address if the wallet is encrypted

(Asked by: username_0 on 2012-06-30)

Suppose that my wallet is encrypted with a passphase and currently I have not provided `bitcoind` with the passphrase to access the private keys section of the wallet.

If I enter:

```
bitcoind getnewaddress

```

It prints a new address, say [someaddress], but where does it store the private key that goes with it?

If I enter:

```
bitcoind dumpprivkey [someaddress]

```

I get an error message since I have not provided the wallet passphrase.

But if I first provide the wallet passphrase and then try `dumpprivkey` it shows the private key.

When I asked it to get a new address, I had not provided the passphrase, so how it store the private key?

**Tags:** wallet, bitcoind, encryption, private-key


---

## 1 answers

### Answer by username_1 on 2012-06-30. Score: 19

It gets it from the keypool, which has 100 pre-generated addresses by default. The next time you enter your passphrase, it will refill the pool with new addresses.

Here's an example that shows the pool running out, and refilling when the password is supplied. The following commands were performed by a trained professional. Please don't try this at home (especially the first 2 commands):

```
$ cd ~/.bitcoin
$ rm wallet.dat
$ bitcoin-cli -daemon -keypool=5
bitcoin server starting
$ bitcoin-cli encryptwallet mypass
wallet encrypted; bitcoin server stopping, restart to run with encrypted wallet
$ bitcoin-cli -daemon -keypool=5
bitcoin server starting
$ bitcoin-cli getnewaddress
1Bf6TrgiBxzZhdtEWZuWuREkbfoAtmZ5xa
$ bitcoin-cli getnewaddress
1JzjmeH1LHzJ5JYzUu3wh36N7LWvfVeB2u
$ bitcoin-cli getnewaddress
1sjVdVJAAWB6JTsja4nEVezdnqiE6Ko3V
$ bitcoin-cli walletpassphrase mypass 3600
$ bitcoin-cli walletlock
$ bitcoin-cli getnewaddress
1DVZHRNbdBivqRKzas7iFT8emsb8EtcJT1
$ bitcoin-cli getnewaddress
1HBXkVkWCVhntzgkxdb9hnUxNeMdFqVssQ
$ bitcoin-cli getnewaddress
18n17UHshaufcufo5z1PBPAdErPWxesBhs
$ bitcoin-cli getnewaddress
1CofrGkqWrAmibBUgtLysknXdsBpDJARTs
$ bitcoin-cli getnewaddress
1NwWuba3khc31ebZU8fVAept2MDdnSndgV
$ bitcoin-cli getnewaddress
16QVdikDatH2FkQNkrRgGXrQ9LbEooHAPF
$ bitcoin-cli getnewaddress
error: {"code":-12,"message":"Error: Keypool ran out, please call keypoolrefill first"}
$ bitcoin-cli walletpassphrase mypass 3600
$ bitcoin-cli walletlock
$ bitcoin-cli getnewaddress
1BSDX4PiHKvdssjAzDLVACAAQvwiijmETV
$ bitcoin-cli getnewaddress
1JJphgnC5gqunLtbbLAwtN8LXRnCUYWARm
$ bitcoin-cli getnewaddress
17UJqrpuakgPPuxPTLa8LeeWVAKijZW66x
$ bitcoin-cli getnewaddress
16itq5LpuwyhtfbiHbQxVzJYYdGE7nQRoz
$ bitcoin-cli getnewaddress
1QA4EnXPUHquK9WBxBppicfBTD2gYTB9ic
$ bitcoin-cli getnewaddress
12bgaABsakRouK9NZyUAK1RAD9nmDtHQKa
$ bitcoin-cli getnewaddress
error: {"code":-12,"message":"Error: Keypool ran out, please call keypoolrefill first"}
$ 

```

> **Comments:**
> **username_2**: Where does the key pool track that the key is being  used if the wallet is locked?  What if bitcoind is restarted? http://bitcoin.stackexchange.com/q/5800/1878  
> **username_1**: Each 'getnewaddress' takes an address from the keypool. Being 'locked' simply means that the passphrase used to encrypt the private key of each address is unavailable. This prevents new addresses from being created (since the passphrase is required to encrypt the new private key) and existing addresses from having their contents spend (since the passphrase is required to decrypt their private key). The wallet isn't locked in the sense of being unmodifiable, and so addresses can be marked as no longer being in the keypool.  

---

