Beginner· Lesson 2 of 2· 3 min

Wallets, keys and addresses

A wallet is a keypair with a nice interface. Know what the key does and most of the scary parts stop being scary.

Keypairs

Every Solana account is identified by a public key: 32 bytes, shown as a base58 string of 32–44 characters. It is derived from a private key with the Ed25519 signature scheme. The public key is your address, safe to share. The private key produces signatures, and whoever holds it controls everything at that address.

A wallet app — Phantom, Solflare, Backpack, a Ledger — generates and stores private keys, shows balances and asks you to approve each transaction. It does not hold your funds; the ledger does. The wallet holds the key that can move them.

1234

1. A keypair generated for this lesson. The public key is a valid address the moment it exists — nothing on-chain had to happen.
2. But there is no account yet. One appears the first time lamports are sent here.
3. A wallet address carries no data, before or after.
4. Its owner will be the System Program: the program that moves SOL when you sign.

Seed phrases

The 12 or 24 words a wallet shows at setup are a seed phrase. From that seed the wallet derives as many keypairs as you like along a derivation path (Solana wallets use m/44'/501'/n'/0'). Restore the phrase in another wallet app and the same addresses come back. Three consequences:

• The phrase is the master key. Anyone who has it has every account derived from it, and no password on the wallet app can stop them.
• No website ever needs it. A site that asks for a seed phrase is a drainer, whatever it says on the button.
• Write it down offline. A screenshot in a cloud photo library is the most common way phrases leak.

What “connect wallet” actually does

Connecting gives the site your public key and permission to ask for signatures. The site cannot sign anything itself. Each transaction still arrives in the wallet as a popup you approve or reject, and modern wallets simulate it first so you can see what will change. That is the whole non-custodial model: the site builds, you sign — The non-custodial model walks through it.

Signing messages vs transactions

Wallets sign two kinds of thing. A transaction changes the ledger and costs a fee. A message is arbitrary bytes, used to prove you control an address — logging in, verifying ownership — without touching the chain. A message signature cannot move funds, but read it anyway: a legitimate one is plain text you understand. Try both sides with Sign & Verify.

Hot, hardware and burner

Handling addresses

Base58 leaves out 0, O, I and l so characters can't be misread, but there is no checksum: a mistyped address is just a different address, and SOL sent there is gone. Paste, never type. Check the first and last four characters against the source. Never copy a recipient from your transaction history — attackers send dust from look-alike addresses precisely so you will. Common Solana scam patterns covers the rest.