imtoken will never ask for your seed phrase, private key or verification code. Always review the address, network and request details before transferring, signing or approving.

Security

Seed Phrase & Private Keys

Seed Phrase & Private Keys explains seed phrases, private keys, offline backups and safe recovery with practical wallet, network and Web3 checks.

Security center
Offline wallet key safety illustration
Core principles

Keep seed phrases and private keys under your own control; no one should ask for them; review each transfer, signature and approval separately.

Seed phrases

This section focuses on seed phrases and how it affects a practical wallet, network or Web3 workflow.

For seed phrases, begin by identifying the active network, the exact address or contract involved, and the result you actually intend to achieve. Separate chains maintain separate state, and similar-looking address formats do not make networks interchangeable; use the correct block explorer when you need public verification. This turns an interface prompt into information that can be independently checked instead of relying on a name, icon or single status label.

A practical review of seed phrases separates origin, target, permission or value, and network state. Fees, confirmation speed and contract behavior change with network conditions, so wallet estimates should be interpreted in the context of the active chain. If a contract is unfamiliar, an allowance is unexpectedly broad, the network is wrong, or the result does not match your intent, stop and verify the transaction hash, contract address or block state before continuing.

More broadly, seed phrases rarely stands alone. It usually connects to at least one of the following: an address, an active network, gas, a transaction hash, a DApp request or validator state. Reading those pieces together reduces errors caused by choosing the wrong chain, misunderstanding a permission or misreading a pending state.

  • Verify the active network, address or contract target
  • Keep a transaction hash or other public data that can be independently checked
  • Never provide a seed phrase, private key or verification code to anyone

Private keys

This section focuses on private keys and how it affects a practical wallet, network or Web3 workflow.

A practical review of private keys separates origin, target, permission or value, and network state. Fees, confirmation speed and contract behavior change with network conditions, so wallet estimates should be interpreted in the context of the active chain. If a contract is unfamiliar, an allowance is unexpectedly broad, the network is wrong, or the result does not match your intent, stop and verify the transaction hash, contract address or block state before continuing.

Understanding private keys also means considering what remains true after you confirm. Connections, message signatures, transaction signatures and token approvals are distinct requests; review the spender, allowance and expected effect separately. On-chain transactions generally cannot be reversed by a wallet alone, and a DApp connection is not the same as an approval. The confirmation button is only the final step; the important work happens before it.

More broadly, private keys rarely stands alone. It usually connects to at least one of the following: an address, an active network, gas, a transaction hash, a DApp request or validator state. Reading those pieces together reduces errors caused by choosing the wrong chain, misunderstanding a permission or misreading a pending state.

  • Verify the active network, address or contract target
  • Keep a transaction hash or other public data that can be independently checked
  • Never provide a seed phrase, private key or verification code to anyone

Offline backups

This section focuses on offline backups and how it affects a practical wallet, network or Web3 workflow.

Understanding offline backups also means considering what remains true after you confirm. Fees, confirmation speed and contract behavior change with network conditions, so wallet estimates should be interpreted in the context of the active chain. On-chain transactions generally cannot be reversed by a wallet alone, and a DApp connection is not the same as an approval. The confirmation button is only the final step; the important work happens before it.

Security around offline backups should be considered together with seed phrases, private keys, device conditions and permission management. Connections, message signatures, transaction signatures and token approvals are distinct requests; review the spender, allowance and expected effect separately. A legitimate workflow does not require sending recovery secrets or verification codes to another person or entering them into an unknown webpage.

More broadly, offline backups rarely stands alone. It usually connects to at least one of the following: an address, an active network, gas, a transaction hash, a DApp request or validator state. Reading those pieces together reduces errors caused by choosing the wrong chain, misunderstanding a permission or misreading a pending state.

  • Verify the active network, address or contract target
  • Keep a transaction hash or other public data that can be independently checked
  • Never provide a seed phrase, private key or verification code to anyone

Safe recovery

This section focuses on safe recovery and how it affects a practical wallet, network or Web3 workflow.

Security around safe recovery should be considered together with seed phrases, private keys, device conditions and permission management. Separate chains maintain separate state, and similar-looking address formats do not make networks interchangeable; use the correct block explorer when you need public verification. A legitimate workflow does not require sending recovery secrets or verification codes to another person or entering them into an unknown webpage.

For safe recovery, begin by identifying the active network, the exact address or contract involved, and the result you actually intend to achieve. Fees, confirmation speed and contract behavior change with network conditions, so wallet estimates should be interpreted in the context of the active chain. This turns an interface prompt into information that can be independently checked instead of relying on a name, icon or single status label.

More broadly, safe recovery rarely stands alone. It usually connects to at least one of the following: an address, an active network, gas, a transaction hash, a DApp request or validator state. Reading those pieces together reduces errors caused by choosing the wrong chain, misunderstanding a permission or misreading a pending state.

  • Verify the active network, address or contract target
  • Keep a transaction hash or other public data that can be independently checked
  • Never provide a seed phrase, private key or verification code to anyone