Seed Phrase vs Private Key vs Wallet Password: What Each Protects (2026)

By CoinX Editorial (GSPTeck) · Published 2026-11-01 · Last verified 2026-11-01

Seed phrase, private key or wallet password: what's the difference?

They protect different things. Your seed phrase (also called a recovery phrase) is the master backup: from it a wallet can rebuild every account and every private key it manages, on any device. A private key controls one account or address and is what actually signs transactions. Your wallet password or PIN only unlocks the copy of the wallet stored on one device; it encrypts that copy, but it can't move or restore funds on its own. So the phrase and the keys must never be shared with anyone, while the password mainly protects your phone or browser if someone gets hold of it. This guide explains each one in plain terms, what to do if one is exposed, and where apps like CoinDrop and Swappr fit in: they only ever need a receiving address.

Educational content, not financial or security advice for your specific setup. Wallet apps differ; check your wallet's own documentation before changing anything.

Grid comparing a seed phrase that restores every account, a private key that signs for one account and a password that unlocks one device, plus which to share and back up — Three secrets, three jobs.

The seed phrase: the master backup

Most self-custody wallets follow BIP-39, a Bitcoin standard that many other networks' wallets also use. It turns random data into a list of common words. The standard allows 12, 15, 18, 21 or 24 words, each picked from a fixed list of 2,048 words, and part of the final word acts as a checksum so a wallet can catch many typos. From those words the wallet derives a seed, and from the seed it derives a whole tree of keys (the method is described in BIP-32). That's why one phrase can restore many accounts and many networks at once.

What it unlocks: every account the wallet created from it, on any device, without your password.
Who needs it: only you, and only when restoring the wallet.
Optional passphrase: BIP-39 also allows an extra passphrase (sometimes called a "25th word"). A different passphrase produces a completely different set of accounts, so if you use one, it's as important to back up as the words.

The private key: one account's signing key

A private key belongs to one account. ethereum.org describes an Ethereum private key as 64 hexadecimal characters; the public key and then the public address are calculated from it, never the other way round. Whoever has the private key can sign transactions for that address, so it's as sensitive as the seed phrase, just for a single account. Most people never see their private keys, because the wallet derives them from the phrase in the background. You'll only meet one if you "export" or "import" a single account.

Four steps from a 12 to 24 word BIP-39 phrase to a seed, a BIP-32 tree of keys and public addresses — From phrase to address.

The wallet password or PIN: a lock on one device

When you install a wallet app, it asks for a password or PIN. That password encrypts the wallet data stored on that phone or browser. ethereum.org notes that a private key can be encrypted with a password, which is exactly what this lock does. It matters if someone steals the device, but it isn't a backup: on a new device, the password alone won't bring your accounts back; you'll need the seed phrase.

Forgot the password? Most wallets let you reset it by restoring from the seed phrase. The funds were never stored "in" the password.
An exchange account password is different. On an exchange, the company holds the keys, and your login and 2FA protect access to their system. That's custodial, and the hygiene is different; see SIM swaps and stronger 2FA for exchange accounts.

What CoinDrop and Swappr need from you

Reward and swap apps send coins to an address you provide. The address is public by design, and it's safe to paste into an app. In our apps:

CoinDrop: when you withdraw rewards, you enter a receiving address for the coin and network shown.
Swappr: you enter the address that receives the swapped coin, then send the deposit yourself from your own wallet. Swaps are processed by FixedFloat.

Neither app needs your seed phrase, private key or wallet password, and no legitimate support team will ask for them. If a "support agent", form or pop-up asks you to "verify" or "sync" your wallet by typing the words, it's a scam. The pattern is covered in fake exchange support and recovery scams. Only install the apps from their official store listings; fake APKs and sideloaded apps are a common way phrases get stolen.

Two columns: what CoinDrop and Swappr need, a receiving address on the right network, and what they never need, a seed phrase, private key or wallet password — What the apps need.

If one of them is exposed: what to do

The response depends on which secret leaked. In every case, act from a device you trust.

Seed phrase exposed (typed into a site, photographed, shared): treat every account from it as compromised. Create a new wallet with a new phrase on a clean device, then move all funds to the new addresses. Changing the password does nothing here.
One private key exposed: move the funds from that account to a new one. If other accounts come from the same phrase and you're not sure how the key leaked, move those too.
Wallet password exposed: change it in the app. It's only urgent if someone also has access to the device or a backup file of the encrypted wallet.
You signed something suspicious but shared no secret: that's an approval problem rather than a key leak. Check and remove permissions; see how to revoke token approvals.

Moving funds costs network fees, and very small balances may not be worth moving on expensive networks. That's a judgement call, but don't leave larger amounts on a phrase someone else has seen.

Four responses when a secret is exposed: a new wallet for a leaked phrase, moving one account for a leaked key, changing the password, and revoking a bad approval — If a secret is exposed.

Storing each one sensibly

Seed phrase: written on paper or metal, kept offline, ideally in two safe places. Not in a screenshot, cloud note, email draft or chat.
Private keys: usually there's nothing to store, because the phrase covers them. If you imported a single key, back it up the same way as a phrase.
Password or PIN: unique to the wallet, kept in a password manager if you use one.
Larger balances: a hardware wallet keeps the keys off your phone entirely; see hot vs cold wallets for small balances.

Vertical Pinterest graphic with five points on seed phrases, private keys and wallet passwords — Pinterest pin: seed phrase vs private key vs password.

FAQ

Is a seed phrase the same as a private key?

No. The seed phrase is a master backup that a wallet uses to derive many private keys. A private key controls just one account. Both must stay secret, but the phrase restores everything at once.

Can someone take my crypto with just my wallet password?

Not on its own. The password unlocks the wallet copy on one device. Someone would also need that device or a backup of its encrypted data. The seed phrase or a private key is enough without anything else.

Do CoinDrop or Swappr ever ask for my recovery phrase?

No. Both apps only need a receiving address for the coin and network you choose. Anyone asking for your recovery phrase, private key or wallet password in the name of either app is a scammer.

How many words should a seed phrase have?

The BIP-39 standard allows 12, 15, 18, 21 or 24 words. Most wallets use 12 or 24. Write down exactly what your wallet shows, in order, and check it once by restoring or using the wallet's backup check.

Sources

BIP-39: Mnemonic code for generating deterministic keys (checked 2026-11-01)
BIP-32: Hierarchical deterministic wallets (checked 2026-11-01)
ethereum.org: Ethereum accounts and keys (checked 2026-11-01)
ethereum.org: Ethereum security and scam prevention (checked 2026-11-01)