--- title: "Private Key QR Code Risks: Why Online Generators Are Unsafe" url: "https://bip39-phrase.com/qr-code-private-key-security-risks/" language: "en" published: "2025-05-30T00:00:00+00:00" updated: "2026-10-19T00:00:00+00:00" --- [ Security ](/topics/security/) Published May 30, 2025 Updated October 19, 2026 # Private Key QR Code Risks: Why Online Generators Are Unsafe ![Private Key QR Code Risks: Why Online Generators Are Unsafe](/wp-content/uploads/2025/05/qr-risk-hero.webp) An online QR code generator is an unsafe place for a private key or a seed phrase. Whatever you type goes to a website whose code, servers and third-party scripts you cannot inspect, and the finished QR code is the key itself, readable by any camera that sees it. Public data, such as a receiving address or a payment request, is fine to encode anywhere. Secret data should become a QR code only on a device that already holds it and never goes online. ## What Is Safe to Put in a QR Code? | What the QR code holds | Make it in an online generator? | Why | | ------------------------------------------------------------- | --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | A receiving address or payment request | Yes | It is public by design; [BIP321](https://github.com/bitcoin/bips/blob/master/bip-0321.mediawiki) defines the bitcoin: URI that payment QR codes carry | | An extended public key (xpub) | No | It cannot spend, but it reveals every address, balance and transaction of the account ([xpub, ypub and zpub](/xpub-ypub-zpub/)) | | A private key, for example in [WIF format](/private-key-btc/) | No | Whoever sees, stores or photographs the code can spend the funds | | A seed phrase | No | It restores every key of the wallet | | A transaction for an offline signer (PSBT) | Only between your own wallet apps | It holds no keys, but it shows amounts and addresses | ## Why Are Online QR Generators Risky for Private Keys? Turning a key into a QR code takes a few lines of code, but on a website those lines run alongside everything else the site loads: - **Server-side generation.** Many generators build the image on their server, so the key crosses the internet and can be logged or stored, even if only briefly. - **“Processed in your browser” claims you cannot check.** A page can say it never sends anything, and you have no practical way to confirm that the code it serves today matches what it promises, or what it served yesterday. The case below shows how far the two can drift apart. - **Third-party scripts.** Analytics, ads, fonts and libraries loaded from other servers run in the same page and can read what you type, as can browser extensions with page access. - **Copies on your own device.** The key passes through the clipboard, and the generated image can stay in the browser cache, the downloads folder or a printer’s job history. SeedSigner’s [SeedQR specification](https://github.com/SeedSigner/seedsigner/blob/dev/docs/seed%5Fqr/README.md) treats a seed QR as secret data that should never be stored on any digital medium, and notes that even printers add risk. - **HTTPS is not a safeguard here.** It encrypts the connection, so nobody in between can read the key, but it says nothing about what the site does once the key arrives. | Weak point | Who can exploit it | Can you rule it out as a visitor? | | ------------------------------------------- | ------------------------------------------------- | --------------------------------- | | Server-side logging | The site’s operator, or anyone who breaches it | No | | Code that differs from the published source | The operator, or an attacker who changed the site | No | | Third-party scripts | The script’s provider, or whoever compromised it | Partly, by blocking scripts | | Browser cache and downloads | Malware or anyone with access to the device | Partly, by clearing them | | Clipboard | Clipboard malware | No, once the device is infected | ## Real Cases: Weak Keys and Clipboard Malware These risks are not just theoretical. In May 2019, MyCrypto researcher Harry Denley found that WalletGenerator.net, an open-source online paper wallet generator, was no longer serving the code published on GitHub. Asked for 1,000 keys, the GitHub version produced 1,000 unique keys, while the live site produced only 120 unique keys per session, so different visitors could receive the same private keys. MyCrypto advised anyone who had generated keys on the site after August 17, 2018 to move their funds ([CoinDesk report](https://www.coindesk.com/markets/2019/05/27/researcher-discovers-serious-vulnerability-in-paper-crypto-wallet-site)). Clipboard hijacking is the other well-documented threat. Malware known as a “clipper” watches the clipboard and quietly replaces its contents with data the attacker controls. In February 2019, ESET [found the first clipper on Google Play](https://www.welivesecurity.com/2019/02/08/first-clipper-malware-google-play/): it impersonated the MetaMask wallet, tried to steal credentials and private keys, and swapped copied Bitcoin and Ethereum addresses for the attacker’s own. Anyone who copies a private key to paste it into an online generator sends it through that same clipboard, so an infected device can expose the key before the website even sees it. ## What If the Key Leaks Later? A key that went through a generator, or a QR code that was printed, photographed or synced, stays dangerous for as long as the funds sit behind it: - **Old data resurfaces.** A breach, a log file or a backup can expose keys months or years after they were entered. - **Scanning is automated.** A leaked key can be checked against Bitcoin, Ethereum and other networks in seconds, so even a key that looks unimportant gets tried. - **Thieves can wait.** An attacker who holds a key can let the balance grow before taking it; in one counterfeit hardware wallet case described in [seed phrase scams](/seed-phrase-scams/), the thieves waited about a month. - **A photo is a copy.** A picture of a QR code is as good as the key. Wallets such as MetaMask and BlueWallet can display the recovery phrase as a QR code, so keep that screen out of photos and screen recordings ([how to view a seed phrase safely](/view-seed-phrase/)). If a key or phrase has already been through an online generator, treat it as exposed and move the funds to a new wallet; [is my seed phrase compromised?](/bip39-seed-phrase-compromise/) walks through the steps, and the [key and seed phrase security guides](/topics/security/) cover the other ways keys leak. ## Safer Ways to Create a QR Code of a Key The basic rule of key management applies: the [Bitcoin Wiki](https://en.bitcoin.it/wiki/Seed%5Fphrase) says a seed phrase must not be typed into any website, and a raw private key deserves the same treatment. - **Keep the key in the wallet that created it.** [Hardware wallets](/hardware-wallets-explained/) never let the keys leave the device, so there is no raw key to paste anywhere in the first place. Software wallets that show a backup QR code, such as BlueWallet, draw it inside the app rather than through a website. - **Use QR codes for transactions, not keys.** Air-gapped signers exchange unsigned and signed transactions with the online wallet as QR codes, usually in the PSBT format of [BIP174](https://github.com/bitcoin/bips/blob/master/bip-0174.mediawiki); the keys never leave the signer ([hot vs cold wallets](/difference-hot-wallet-and-cold-wallet/)). - **For a seed backup, use SeedQR on the signing device.** SeedSigner encodes a BIP39 phrase as a QR code compact enough to copy by hand onto paper or metal. Its specification warns never to photograph a SeedQR. - **Encrypt a key before printing it.** A [BIP38-encrypted key](/bip38/) starts with 6P and is useless without its passphrase, so a printed QR code of it is far less dangerous than one of a raw key. Paper wallets in general, a single key printed on a sheet, are what the [Bitcoin Wiki](https://en.bitcoin.it/wiki/Paper%5Fwallet) calls an obsolete and unsafe method; a written seed phrase is the standard backup today ([how to store a seed phrase](/store-a-seed-phrase/)). - **If you must generate one yourself**, use open-source software on a computer that stays offline, and wipe the image, the clipboard and any print job afterwards. ## Frequently Asked Questions ### Is a QR code of my seed phrase safer than the written words? No. It is the same secret in another form, and a camera can copy it faster than a person can read the words. Store it like the phrase itself, offline and out of sight. ### Is it safe to scan a QR code to pay someone? An address QR code holds public data, but a scammer can swap it, for example by sticking their own code over a real one. Check the address and amount your wallet shows before you confirm; BIP321 tells wallets never to act on a payment link without your approval. ### I already made a QR code of my key online. What now? Treat the key as exposed. Create a new wallet, move the funds to it, and stop using the old key or phrase. [ Back to Blog ](/blog/)