Seed phrase, private key, wallet address: what each one does and who should see it.

What is the difference between a seed phrase, a private key and a wallet address?

A seed phrase creates private keys, a private key controls one address, and an address only receives. The three are links in one chain, and each can be computed from the one before it but never from the one after. More wallet terms are defined in the crypto payment glossary.

Phantom's help centre article on the difference between a Secret Recovery Phrase and a private key describes the phrase this way: "It acts as the master key, from which all of your accounts and addresses are derived." And the key: "It lets you sign transactions and manage funds for that address only."

How does a seed phrase turn into a Solana address?

A seed phrase turns into a Solana address in four computed steps, none of which can be run backwards. Following one through shows why the phrase is the thing to protect.

1. Words to a seed. The BIP-39 specification turns 128 to 256 bits of randomness into 12 to 24 words, each word encoding 11 bits as an index into a 2,048-word list. To make the seed, it runs the words through PBKDF2 with "The iteration count is set to 2048 and HMAC-SHA512 is used as the pseudo-random function", producing 64 bytes.
2. Seed to keys. A derivation path picks one key out of the seed. The Solana CLI documentation says that by default its key tool uses Solana's base derivation path, m/44'/501', and derives child keys below it.
3. Key to address. Each private key has an Ed25519 public key. Solana's accounts documentation lists the address size as "32 bytes (Ed25519 public key)": the address is the public key, written in base58.
4. Address to the world. You share the address. Nobody can work back from it to the key, or from the key to the phrase.

The CLI docs show the derivation in one command, which asks for a phrase and prints the address of the child key 0/1:

solana-keygen pubkey 'prompt://?key=0/1'

Two consequences surprise people. A phrase typed into another wallet app can show different addresses, because, in Phantom's words from its import troubleshooting page, "Some wallet apps generate accounts using different derivation paths." And BIP-39 allows an optional passphrase on top of the words. The specification says "every passphrase generates a valid seed (and thus a deterministic wallet) but only the correct one will make the desired wallet available", so a mistyped passphrase opens a different wallet without any error.

What does Fianto ask your wallet for?

Fianto asks your wallet for its address and for signatures you approve inside the wallet, and nothing else. The wallet holds the key and does the signing; Fianto checks a signed message against the public address, and Solana checks a signed transaction the same way. These are the moments a Fianto page asks a wallet for something:

The setup message spells out what it is in its last line: "This is a message, not a transaction. Signing it costs nothing and moves nothing." Above that it names your account email and the wallet address, so you can check the request is for you. Why a message and a transaction are different requests is in sign message vs sign transaction.

Which mix-ups cost merchants access?

The mix-ups that cost merchants access come from treating one secret as a backup for another. Four are worth checking against your own setup today.

Recovery codes are not a recovery phrase

Fianto gives you 10 recovery codes when you set up two-factor sign-in, which every merchant account must have. They replace a lost authenticator for signing in to Fianto. They have nothing to do with your wallet, and your wallet's phrase cannot sign you in to Fianto. Keep the two in different places, so one lost drawer does not take both.

An imported key is not covered by your phrase

If your receiving wallet started life as a private key you imported, your phrase does not restore it. Phantom's article says so directly: "Imported accounts are not connected to your main wallet's recovery phrase, so the recovery phrase does not cover them." That key is the only backup of that address.

A hardware wallet hides both

A hardware wallet keeps the key on the device, so the wallet app on your computer has no key to show you. Its own recovery phrase, written down when you set it up, is the backup.

Your phrase also protects your Fianto account

The self-serve two-factor reset asks for a signature from your receiving wallet, together with your password and an emailed code, and then waits 72 hours. If you have lost your authenticator and your recovery codes and can no longer sign with the receiving wallet either, that self-serve route is closed and you need Fianto support; the details are in securing the wallet you get paid to and in the docs on account security.

What should you do if your seed phrase is exposed?

If your seed phrase is exposed, assume every account in that wallet belongs to someone else from that moment, and move what you can before they do. Changing the wallet app's password does not help: the phrase is the wallet.

1. Create a new wallet with a new phrase, on a clean device.
2. Send everything from the exposed accounts to the new wallet, starting with the largest balances.
3. If the exposed wallet is your Fianto receiving wallet, open Account in the dashboard and use Change wallet under Receiving wallet. It needs your password, a two-factor code and a signature from the new wallet, then an admin approves it.
4. Subscriptions set up before the change keep paying the old wallet, because each plan names its destination on chain. Cancel those and ask the customers to subscribe again.

Token approvals the exposed wallet granted stay on chain until they are revoked, but they reach only what is left in that wallet, so emptying it comes first. How the approvals work is in Solana token delegation explained, and how to find and remove them is in revoking token approvals on Solana.