Seed phrase, private key, xpub: what each one can actually do
Crypto wallets hand you several kinds of secret-looking material, and they are not equally dangerous. Some can spend everything you own. Some can only watch. Some can do neither on their own.
Most security mistakes come from treating them as interchangeable — guarding a harmless string like treasure, or pasting a dangerous one into a website that asked politely. The fix is to know exactly what each one can do.
The seed phrase: everything, forever
Your seed phrase — the 12 or 24 words — is the root. From it, a wallet deterministically derives every private key, for every chain, for every account, it will ever use.
That makes it the most powerful thing you own. Anyone with those words can recreate your wallet on their own device and spend every coin it controls, today or in ten years. There is no password on top, no second factor, no support desk that can reverse it.
It also means the seed is the only thing you need to recover. Lose every device and keep the words, and you've lost nothing. What you actually need to restore a wallet comes down to this one piece of paper — which is exactly why it must never be typed into anything that isn't the wallet itself.
Rule: a seed phrase is never requested by anyone legitimate. Not support, not a "sync" tool, not a verification form.
Private keys: one lock each
A private key is derived from the seed and controls one specific address, or in some schemes one account. It is the thing that actually produces signatures.
Leaking a single private key loses what that key controls, not necessarily everything. That's narrower than a seed leak, but it is still total loss for those funds — and in practice many wallets can export a private key per address, so a careless export is a common way single addresses get drained.
You should almost never need to handle a private key directly. If a tool asks you to paste one, treat it with the same suspicion as a request for your seed.
The extended public key: watch everything, spend nothing
An extended public key, or xpub, is derived from the seed at the account level. It can generate every public address in that account — but no private keys.
So an xpub cannot move a single coin. What it can do is see: every address the account has used or will use, and therefore the account's full balance and transaction history. Handing someone an xpub is handing them a permanent window into that account, which is why it matters for on-chain privacy even though it's harmless to your funds.
That's the whole distinction worth remembering:
Seed and private keys can spend. An xpub can only watch.
Watch-only tools, accounting software and portfolio trackers legitimately use xpubs. A reasonable request for an xpub is not a red flag. A request for a seed or private key always is.
Where multisig changes the arithmetic
Everything above describes a single-key wallet. Multisig changes what one secret is worth.
In SSP, your funds sit in a 2-of-2 multisig: one key on your browser extension, one on your phone, each derived from its own seed. Spending needs a signature from both. So a single leaked seed, on its own, cannot move your funds — the attacker still needs the other device's key. That's the real protection two-of-two multisig buys: no single secret is a skeleton key.
It doesn't make a leaked seed harmless. It turns an instant loss into a warning you have time to act on — and the right response is still to treat that seed as burned and move funds to a fresh setup.
The xpub story is the same in multisig. SSP derives addresses along a BIP-48 path, m/48'/coin'/account'/script_type'/change/index, and each device holds an xpub for the other side so it can build the shared addresses. Those xpubs let each side see the account; neither lets anyone spend.
A practical cheat sheet
Seed phrase. Spends everything, forever. Store offline, never type it anywhere but the wallet, never share it with anyone for any reason.
Private key. Spends what it controls. Don't export it unless you know exactly why; never paste it into a website.
xpub. Spends nothing, reveals everything in the account. Share only with tools you trust to see your full history.
Addresses. Public by design. Share freely — they're how you get paid — but remember that reusing one links your payments together.
Signed transactions and messages. A one-time authorisation of a specific action. Harmless once used, dangerous only if you signed something you didn't read.
The one question to ask
Whenever anything asks for wallet material, ask: can this spend, or can it only watch?
If it can spend, the answer to sharing it is no, and the request itself tells you who you're dealing with. If it can only watch, the question becomes whether you're comfortable with that party seeing everything in that account. Almost every avoidable loss in self-custody comes from getting that first question wrong.
