Private Key Import Implementation for Mobile Crypto Wallet
Private key import is a one-time operation that must be implemented flawlessly. The key is transmitted in hex, Base58, or WIF, passes through the UI, and must be stored in secure storage. Common mistakes include format validation errors, clipboard leakage, and unzeroed memory. Loss of funds due to such errors can be significant—hence security is critical. We develop import modules with all security best practices. Our team has extensive experience in mobile development and has implemented key import for numerous projects.
Problems We Solve
Validation errors—key outside valid range (e.g., zero or exceeding secp256k1 order) can lead to incorrect address generation or loss of funds. Clipboard—if not cleared, the key remains accessible to other apps, including malware that may read it in the background. Memory—private key must not linger in RAM longer than necessary; it must be zeroed immediately after use. Also, format differences: Ethereum uses 32-byte hex, Bitcoin uses WIF with Base58Check, Solana uses raw Base58. For validation we use the secp256k1 library, which correctly checks key range and curve membership. Clipboard handling in SwiftUI is 30% faster than UIKit thanks to built-in onChange.
Why Clipboard Cleanup Matters
After copying the key from the clipboard via paste, you must immediately clear the UITextField and global clipboard. In SwiftUI:
.onChange(of: keyInput) { value in guard value.count >= 64 else { return } processImport(value) keyInput = "" // clear field UIPasteboard.general.string = "" // clear clipboard } On Android: clipboardManager.setPrimaryClip(ClipData.newPlainText("", "")). Without this, the key remains in the system buffer and can be read by any app. Clearing is mandatory, especially on devices with malware scanners.
How to Ensure Secure Storage?
After validation, the key must immediately be stored in Keychain (iOS) or EncryptedSharedPreferences/Keystore (Android). Pattern with defer and zeroing buffer:
func importPrivateKey(_ hexKey: String) throws -> String { let keyData = try validateAndDecodeHex(hexKey) defer { keyData.withUnsafeMutableBytes { $0.baseAddress?.initializeMemory(as: UInt8.self, repeating: 0, count: keyData.count) } } let address = try deriveAddress(from: keyData) try keychain.store(keyData, identifier: "pk_\(address)") return address } On Android: Arrays.fill(keyBytes, 0) in a finally block. Never store the key in UserDefaults.
Key Format Comparison
| Blockchain | Format | Length (bytes) | Checksum | Valid Range |
|---|---|---|---|---|
| Ethereum | hex (0x...) | 32 | No | 1 … secp256k1.order |
| Bitcoin | WIF (Base58Check) | 32 + 1 compression | Yes (4 bytes) | 1 … secp256k1.order |
| Solana | Base58 | 32 | No | 1 … Ed25519.order |
Storage Method Comparison
| Method | Platform | Security | Performance |
|---|---|---|---|
| Keychain | iOS | High (hardware encryption) | Fast access |
| EncryptedSharedPreferences | Android | Medium (AES-256) | Medium |
| Android Keystore | Android | High (TEE) | Slower, more secure |
Keychain on iOS provides hardware encryption and memory dump protection, making it the best choice. Android Keystore, though slower, uses Trusted Execution Environment for key isolation.
Supported Key Formats
We support all major formats: hex (Ethereum, Bitcoin with conversion), WIF (Bitcoin) with checksum verification, and raw Base58 (Solana). Each format has separate length and range validation. BIP38 (password-encrypted key) support available on request. We also handle cases with spaces, extra characters, and mixed case.
Typical Import Errors
- Missing zero-key check (key equals 0) — leads to incorrect address generation.
- Ignoring 0x prefix in hex — library may not recognize the key.
- Storing key in UserDefaults after import — data remains unprotected.
- Not clearing clipboard after paste — key accessible to other apps.
- Using outdated libraries for address derivation — potential vulnerabilities.
Implementation Process
- Analysis — determine supported blockchains, key formats, storage requirements.
- Design — UI/UX for secure input, library selection (noble/secp256k1, WalletCore, Web3.swift).
- Implementation — validators for each format, address derivation, integration with secure storage.
- Testing — edge cases (zero key, wrong checksum, input with spaces, paste from third-party apps).
- Deployment — build, sign, publish to App Store / Google Play.
What’s Included
- Source code of import module for iOS (Swift 5.9+) and Android (Kotlin, Jetpack Compose).
- Documentation on formats and integration.
- Tests for edge cases.
- Consultation on Keychain/Keystore configuration.
- 30-day post-delivery support.
Estimated Timeline
Implementation takes 1 to 3 days depending on the number of blockchains. Cost is calculated individually based on scope. Get a consultation — we will evaluate your project for free.
Contact us to discuss your private key import requirements. Order the implementation — we guarantee secure integration with App Store Review Guidelines and Google Play policies.