Minimal offline Bitcoin key generator for cold storage.
Generates a Bitcoin private key and its corresponding native SegWit (Bech32) address in a single execution. Prints both to stdout, keeps no state, and exits. Designed to run on an air-gapped machine for cold storage key ceremonies.
$ btc-keygen generate
address: bc1q...
wif: K...
Every run creates a new keypair. The tool does not store secrets. If you lose the output, there is no way to recover the key.
- Cryptographically secure randomness from the OS
- secp256k1 validation using Bitcoin Core's libsecp256k1
- Compressed public keys, native SegWit (Bech32) addresses
- WIF private key export
- Optional hex and public key output
- JSON output for scripting
- Memory zeroization of secret material on exit
- Zero network code — fully offline
- Automated tests including known-answer vectors from the Bitcoin wiki
- Cross-platform: Linux, macOS, Windows, BSDs
Add to your project:
cargo add btc-keygen
let key = btc_keygen::generate()?;
let wif = btc_keygen::encode_wif(&key);
let pubkey = btc_keygen::derive_pubkey(&key);
let address = btc_keygen::derive_address(&pubkey);| Function | Input | Output |
|---|---|---|
generate() |
— | Result<PrivateKey, Error> |
PrivateKey::from_bytes(bytes) |
[u8; 32] |
Result<PrivateKey, Error> (validated scalar) |
PrivateKey::from_hex(hex) |
&str (64 hex chars) |
Result<PrivateKey, Error> (validated scalar) |
encode_wif(&key) |
&PrivateKey |
String (starts with K or L) |
derive_pubkey(&key) |
&PrivateKey |
[u8; 33] (compressed public key) |
derive_address(&pubkey) |
&[u8; 33] |
String (Bech32 address, bc1q...) |
PrivateKey zeroizes its bytes when dropped. Full API docs at docs.rs/btc-keygen.
Download a pre-built binary from the latest release, verify the SHA256 checksum, and run it.
Or build from source:
git clone https://github.com/aguimaraes/btc-keygen.git
cd btc-keygen
cargo build --release
./target/release/btc-keygen generate
Requires Rust and a C compiler.
btc-keygen generate # address + WIF
btc-keygen generate --hex # also show raw private key hex
btc-keygen generate --pubkey # also show compressed public key
btc-keygen generate --json # JSON output
btc-keygen generate --hex --pubkey --json # everything
# Provide your own 64-character hex private key instead of OS entropy:
btc-keygen generate --from-hex <HEX>
This tool is designed for air-gapped cold storage key generation. See the website for a plain-language explanation, or the docs/ directory for the full threat model, security assumptions, and dependency analysis.
Licensed under either of
at your option.