I'm building a web app making JSON-RPC calls to the bitcoind server. I have security concerns on how to protect the wallet.dat file.

I'm encrypting the directory where wallet.dat will be. Should I also use the bitcoind encryptwallet command? When using Bitcoin client wallets like Electrum every time I send BTC it asks me for my password. Building a web app where users will have their own account (and addresses) should a bitcoind password be used? Does bitcoind store the private keys for every public address generated?



Yes for all your questions.

Suppose you don't encrypt wallet, if someone access your computer with unlocked bitcoin directory (such directory must be readable for running bitcoin) he can steal your BTC.

It might be better just to encrypt wallet and leave unencrypted directory. He can steal encrypted wallet.dat, which isn't useful.

  • When encrypting my wallet using encryptwallet the following API calls fail until I run walletpassphrase: settxfee sendtoaddress Which are essential for my web app. How would this be done? Every time a user wants to send Bitcoins to another address I will need to call the walletpassphrase function, which requires to enter the passphrase and leaves the wallet.dat file unencrypted for N seconds.
    – Antoni
    Aug 1 '13 at 6:31
  • Yes, you are right
    – ripazha
    Aug 1 '13 at 6:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.