What is a paper wallet? How it works, the real risks, and safer options

A paper wallet is a bitcoin private key and its matching address printed on paper, usually from a key-generator website, so the key is stored offline. Anyone who sees the private key can spend the coins. If the paper is lost or the key can't be read, the coins can't be recovered. The Bitcoin Wiki is the community reference for Bitcoin. It says paper wallets were popular from about 2011 to 2016 and now calls them "an obsolete and unsafe method of storing bitcoin" that "should not be used." For new storage, a seed phrase written by hand from a modern wallet does the same job with fewer ways to fail.

What is on the paper

A typical paper wallet has two items, often shown both as text and as QR codes:

• The address, which you share to receive coins.
• The private key, which authorises spending. Whoever holds it controls the funds.

A paper wallet holds one key and one address, so every deposit goes to the same address. The Bitcoin Wiki lists this as a problem: reusing an address harms privacy, and the generator sites usually don't warn against it.

Some generators can encrypt the private key with BIP38, a standard that turns the key into a passphrase-protected string starting with "6P". The BIP38 text says these records are "intended for use on paper wallets and physical Bitcoins." Without the passphrase the printed key can't be used. If you forget the passphrase, the coins are lost as well. The BIP38 entry's comments summary reads "Unanimously Discourage for implementation", so wallet support for it varies.

How a paper wallet is generated

Most paper wallets come from generators that run in a web browser. One example is the open-source bitaddress.org project: a single HTML file with embedded JavaScript that creates an address and private key in the browser. Its README says the code is not minified and makes no network requests, so you can open the page from a local copy and run it without a connection.

The Dash documentation sets out a safer way to do this:

1. Use an offline computer running a single-use operating system, such as a live CD or USB stick, so the generated data is not saved. A CD is the most secure choice because it is mounted read-only.
2. Disable all networking hardware before generating keys.
3. Print the key, then store the printout securely. The key can't be regenerated once the machine is off, so the printout is the only copy.

Warning: the private key is exposed during generation. Malware on the computer, a tampered copy of the generator or a malicious generator website can record the key and empty the wallet later. The Bitcoin Wiki notes that paper wallets carry the same risks as other browser-based wallets.

Warning: printers can keep copies. The Bitcoin Wiki says many printers have an internal hard drive that can store the printed wallet. Shared printers may keep logs, and Wi-Fi printers can expose the key to anyone listening to the radio signal.

Real security properties

What paper does well

A key that never touches a networked device after printing can't be stolen by an online attacker.

What paper does badly

• Physical damage and loss. Water, creasing and folding can make a QR code unreadable. If the paper is lost, burned or destroyed, the Dash documentation warns, "there is no way of recovering funds."
• Theft and coercion. Anyone who photographs or takes the paper can spend the coins. BIP38 encryption helps, but the Dash documentation notes that a determined attacker can get around it with the "$5 wrench attack", which means using force against the owner.
• Typing errors. Small print invites mix-ups such as B and 8, or 1 and l. According to the Bitcoin Wiki, "If even a single character is wrong or mistakenly typed then the entire private key will be invalid."
• No balance view. A paper wallet can't show its own balance. To check it you usually need a third-party block explorer or server, which can track you or return false data, according to the Bitcoin Wiki.
• Format changes. The Bitcoin Wiki reports at least one case where a software change to key formats left a user's funds stuck.

How to spend from a paper wallet: sweep the whole balance

To spend the coins, you have to enter the private key into wallet software. The safe method is a sweep: the wallet sends the entire balance controlled by the key to an address in your own wallet. The Bitcoin Wiki recommends sweeping into a deterministic wallet. The Electrum documentation describes sweeping as sending "all the bitcoins they control to an existing address in your wallet" and gives the menu path Wallet, Private Keys, Sweep. A sweep is an on-chain transaction, so it pays a network fee.

Warning: do not spend part of the balance and keep the paper. A Bitcoin transaction always spends each unspent output (UTXO) in full. The Bitcoin developer documentation says "a UTXO can only be spent once" and its full value "must be spent or given to a miner as a transaction fee." So most transactions send the surplus back to a change address. If you import a paper key and send part of the funds, the rest moves to a change address in the software wallet, not back to the paper. The Bitcoin Wiki records users who believed the rest was still on the paper. It also warns that destroying the paper after importing the key into a deterministic wallet can make funds unrecoverable.

Warning: raw transactions are risky. If you build a transaction by hand, the leftover amount can go to miners as a fee. The Bitcoin Wiki cites a reported case of 50 BTC lost this way.

After a sweep, treat the old key as used. The Dash documentation says a key imported into an online wallet should not be used again.

When a paper wallet still makes sense

• You already hold one. Keep it dry and private until you're ready, then sweep the full balance into a wallet you control. Before you start, check that your wallet software can sweep that key format.
• A one-time gift or hand-over, where the recipient will sweep the coins soon. The motivation section of BIP38 describes sending an encrypted paper wallet and giving the passphrase over a separate channel.

For long-term storage, the Bitcoin Wiki says a seed phrase is "a much better way" to do what paper wallets do. A seed phrase (BIP39) is 12 to 24 words that encode the seed of a hierarchical deterministic wallet (BIP32). One seed produces many keys, so the wallet can use a fresh address for each payment and show its own balance. You write the words by hand instead of printing them, and you never handle a raw private key.

Paper wallet vs seed phrase backup

Both are only as safe as the place you keep them, and if either is lost, nobody else can recover it for you.