The tezos-client allows users to generate a pair of public and secret keys in the command line:

  gen keys <new> [-f --force] [-s --sig <ed25519|secp256k1|p256>]                                                                                                                                                  
    Generate a pair of keys.                                                                                                                                                                                       
    <new>: new secret_key alias                                                                                                                                                                                    
    -f --force: overwrite existing secret_key                                                                                                                                                                      
    -s --sig <ed25519|secp256k1|p256>: use custom signature algorithm 

It also requests a password

Enter password to encrypt your key:

It looks like it the public key and encrypted private key get stored in a file ~/.tezos-client/secret-keys.

If I need to move these keys from one computer to another (physically on a USB hard drive device or through the network), are their any best practices to consider? What are the risks if the encrypted secret key is exposed?

1 Answer 1


If you want to move the keys, copy all the files inside ~/.tezos-client/ to the new machine. As you noticed, your secret key is encrypted, so even exposed by someone stealing your USB stick, they'd have to brute-force the encryption passphrase on your secret key in order to do any operations with it.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.