While answering questions from newcomers to Web3, I've found widespread misunderstandings about wallet usage and asset custody. Some believe a lost password means permanent loss; others screenshot their seed phrases and store them in their phone gallery, thinking it's safe as long as they don't share them; many cannot distinguish between exchange accounts and self-custodial wallets. These issues seem basic, yet even long-time users may not fully grasp them.
Therefore, I am launching the "Web3 Survival Manual" series, avoiding jargon and focusing on small but critical details. This is the first article, starting with the most fundamental concepts: what is the difference between private keys, seed phrases, and wallet passwords?
Assets Are Not Stored in the Wallet
Many believe their BTC, USDT, or ETH are stored inside the wallet app. In fact, assets are recorded on the blockchain; the wallet is merely a tool to hold your keys—like a key box, not a safe. When you transfer, swap tokens, or authorize a dApp interaction, the wallet uses the stored private key to sign the operation, proving to the blockchain that the address controller agrees to the action. This explains two common puzzles: even if the wallet app ceases to exist, is delisted, or is deleted, as long as you have backed up the correct private key, you can import it into another wallet and recover your assets (the industry uses unified technical standards). If someone obtains your private key, they can transfer your assets even if your phone is still in your possession—because the blockchain only recognizes the key, not the person holding it.
The Fundamental Difference: Private Key, Seed Phrase, Wallet Password
A private key is a long, randomly generated string that is error-prone to back up manually. The industry standard converts the private key into a seed phrase of 12 or 24 English words—essentially the same key in a different format. In theory, one seed phrase can derive multiple private keys, akin to a master backup for a keychain. Most modern wallets guide users to back up the seed phrase during creation, seldom requiring direct private key copying. However, neither the private key nor the seed phrase should ever be disclosed to anyone. Requests for private keys under pretexts like "wallet verification," "risk control lifting," or "airdrop claiming" should be treated as scams.
A wallet password, on the other hand, is the PIN or unlock code set to open the app, serving solely to unlock the app—unrelated to the private key. Simple principle: if you forget the password, you can re-import the private key/seed phrase and set a new one; if you lose the seed phrase but the wallet is still accessible, you may re-backup or transfer assets; if the seed phrase is lost and the wallet cannot be opened, recovery may be impossible; if the seed phrase is leaked, immediately move your assets to a brand new wallet.
Exchange Accounts vs. Self-Custodial Wallets
Many users first encounter crypto through centralized exchanges like Binance or OKX, where they hold BTC, ETH, USDT without receiving a seed phrase. This is because the exchange manages the assets on their behalf—users log in via phone/email + password and 2FA, and the displayed balance is internal bookkeeping, not a directly controlled on-chain address. Exchange accounts offer convenience: if you forget your password, you can contact customer support, verify your identity, and recover the account. The trade-off: you must trust the exchange to securely custody assets. In contrast, a self-custodial wallet puts the private key (and thus control) in your hands. You can transfer anytime without platform approval, but you also bear full responsibility for securing the seed phrase, avoiding phishing sites, and preventing mistakes.
Major exchanges now often offer both a "trading account" and a "Web3 wallet" within the same app. Though accessible together, they are separate accounts with fundamentally different asset control. The judgment is simple: if the wallet requires you to independently back up the seed phrase and states that the platform cannot recover it for you, it is a self-custodial wallet.
Hot Wallets and Cold Wallets
With an understanding of private keys and seed phrases, the distinction between hot and cold wallets becomes straightforward. Hot wallets store the private key on an internet-connected device (phone or PC) and sign transactions there—examples include MetaMask, OKX, SafePal, TP. Cold wallets, typically hardware wallets, generate and store the private key on a dedicated offline device; the key never leaves the device during signing, as with Ledger, Trezor, OneKey. However, hardware wallets are not immune to risk: if you photograph and upload the seed phrase, enter it on a phishing site, or approve a malicious contract, the hardware protection becomes irrelevant. In essence, hardware wallets secure the storage and signing environment, but cannot prevent user-initiated leakage of the seed phrase.
Risks of Seed Phrase Storage
Storing a seed phrase in a regular notes app, WeChat favorites, chat logs, email, or photo gallery carries major risks: phone malware, remote control, cloud account compromise, automatic synchronization, or incomplete data erasure when selling or repairing a device. Tools with separate passwords and encryption offer marginal improvement, but still depend on the security of the phone system, the app, and the cloud account. For large amounts or long-term holdings, it is advisable to handwrite the seed phrase on paper or use a dedicated metal seed plate (available from major hardware wallet providers), storing copies in two separate, secure locations. Offline storage also has risks: paper deterioration, loss during moving, fire, or water damage. A truly rational security strategy involves multiple redundant backups. The specific use cases and choices of hot and cold wallets will be discussed in the next article.
This series will continue to explore asset custody techniques, helping every Web3 participant build a secure and reliable knowledge foundation.