Private Key Management
NozyWallet derives keys from a BIP39 mnemonic using standard Zcash Orchard HD paths.
What you hold
| Secret | Role |
|---|---|
| 24-word mnemonic | Root secret — restores entire wallet |
| Wallet password | Encrypts local wallet.dat / profile storage |
| In-memory keys | Active after unlock; cleared on lock |
Private keys are not displayed in normal UI. Optional CLI/settings paths may expose viewing keys for advanced debugging — treat as sensitive.
Derivation
- HD wallet follows Bcash/Zcash conventions in
hd_wallet/ orchard integration. - Optional Secret Network path shares mnemonic, different derivation — see Secret Network.
Storage
Encrypted at rest — see Wallet Storage.
- Argon2 / PBKDF-style password protection in core library
zeroizefor sensitive buffers where applicable
Operational rules
- Never paste mnemonic into websites.
- Never photograph seed on a networked phone.
- Hardware wallet: Keystone on Zcash mainnet — Keystone Hardware Wallet. Seed stays on device; Nozy builds PCZT for air-gapped signing.
- Compromised machine → move funds to new wallet on clean device with new seed.
Recovery
Only via mnemonic or encrypted backup — no “forgot password” server reset.