Private Key Import in Mobile Crypto Wallet
Private key import — operation user performs once, but must be implemented flawlessly. Key transmitted in hex or Base58, passes through UI and lands in storage. This is where memory and validation errors occur most often.
What to Validate Before Saving
Ethereum key in hex: 32 bytes, exactly 64 characters without 0x prefix or 66 with it. Value range — 1 to 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364140 (secp256k1 group order). Zero key or exceeding group order — invalid. Library @noble/secp256k1 throws exception trying to get public key from invalid private — good validation point.
Bitcoin WIF format: Base58Check with version byte 0x80 (mainnet) or 0xEF (testnet), optional compression byte 0x01 end. bitcoinjs-lib or WalletCore decode and validate checksum.
Solana: Base58 without checksum, 32 bytes (Ed25519 scalar). Any value 1 to Ed25519 group order valid.
Input Security
TextField for private key must have secureTextEntry = true (iOS) / inputType="textPassword" (Android). Prevents keyboard autocorrection and caching. autocorrect = false and spellCheck = false mandatory — otherwise key lands in keyboard dictionary.
After copying key from paste buffer — immediately null UITextField (show ***...***) and schedule clipboard clearing. In SwiftUI:
.onChange(of: keyInput) { value in
guard value.count >= 64 else { return }
processImport(value)
keyInput = "" // clear field
UIPasteboard.general.string = "" // clear clipboard
}
After Validation — Straight to Secure Storage
Private key can't remain in memory longer than necessary. Pattern:
func importPrivateKey(_ hexKey: String) throws -> String {
let keyData = try validateAndDecodeHex(hexKey)
defer { keyData.withUnsafeMutableBytes { $0.baseAddress?.initializeMemory(as: UInt8.self, repeating: 0, count: keyData.count) } }
let address = try deriveAddress(from: keyData)
try keychain.store(keyData, identifier: "pk_\(address)")
return address
}
defer with buffer zeroing — minimum key memory TTL. On Android similarly: Arrays.fill(keyBytes, 0) in finally.
Process
Implementation takes 1–3 days: format validation for needed blockchains, secure input, Keychain/Keystore saving, address derivation for user confirmation. Separately test edge cases: key outside range, WIF with invalid checksum, input with spaces.