Bitcoin Core Wallet: Basic Setup, Encryption, Backup & Recovery

Install Bitcoin Core from its official website for your operating system and open it. Start without a wallet loaded, as shown in the screenshot. Use a new, empty wallet for this exercise and keep your operating system up to date. Do not proceed if you suspect the computer has malware.

This is a conceptual walkthrough with a disposable wallet, not a complete deployment procedure. Use no real bitcoin here. Before committing meaningful funds, work through the full self-custody curriculum and prepare a dedicated computer with a fresh Linux installation. A practice wallet created on your daily computer should remain a practice wallet.

Select Create Wallet and enter a local name. The screenshots in this guide use disposable Test Wallet and Tutorial Wallet examples. A wallet name is only a local identifier; it does not need to reveal your identity or the purpose of the funds.

Leave Disable Private Keys, Make Blank Wallet, and External signer unchanged for this basic setup.

Check Encrypt Wallet. This protects the secret keys that approve payments. You will need your wallet passphrase to use those keys to sign a transaction — in other words, to authorize spending.

Someone with a copy of this wallet can still view its addresses, transaction history and balance. The passphrase protects spending; it does not hide the whole wallet. Step 7 adds GPG encryption for privacy.

Download and install KeePassXC for Windows, macOS or Linux, then open it. You can follow this practice exercise on the computer you already use, with an empty test wallet and a passphrase you will never reuse for real funds.

Open Tools → Password Generator → Passphrase. Use the bundled EFF large wordlist, choose lower-case words separated by a single space, and let KeePassXC generate them. Keep the words in their generated order, including any repeats. You do not need to create a password database just to use the generator.

Bitcoin Core’s encryption dialog recommends eight or more words. Eight independently generated random words are a good starting point for this exercise and match the screenshots. Before deciding on eight, more or fewer, try the calculator below to see how the word count changes the estimated effort and cost of guessing the passphrase.

Entropy describes how many possible combinations an attacker has to consider. With randomly generated words, more entropy means more possibilities to try. Brute force means testing those possibilities until one works: more guesses generally mean more computing time and a bigger bill. Entropy is not itself a price tag; the cost also depends on how quickly guesses can be tested and what the computing power costs.

The calculator gives you a rough feel for that relationship. Under its starting assumptions, eight random words imply an enormous guessing cost — and so do seven and even six. Move the slider through six, seven and eight words and compare the numbers yourself. Fewer random words are generally easier to remember but offer less protection against guessing; more words offer more protection but are harder to remember. Explore the trade-off until those numbers mean something to you, rather than choosing a word count without understanding it.

These are illustrations under the displayed assumptions, not a current market quote or a guarantee. Computing power and attack methods improve: an attack that looks prohibitively expensive today may cost less in a year, ten years or thirty years. That is why I leave an extra safety margin instead of choosing only what appears sufficient today. Whatever you choose, keep a separate recovery record rather than relying on memory alone. The calculations apply to independently generated random words, not a sentence you invent. For more detail, see the curriculum’s entropy explanation and attack-economics exercise.

• Do not invent a memorable sentence.

  Use words selected randomly by a password manager instead of a phrase designed to feel clever or familiar.

• Do not reuse a password.

  A breach of another service must not expose the passphrase that protects your wallet.

• Do not include personal information.

  Names, dates, quotations, and familiar patterns make a passphrase easier to predict.

• Separate the two recovery components.

  Keep the real passphrase physically separate from every copy of the wallet backup.

Enter the generated passphrase in both fields. The entries must match exactly. Verify the phrase carefully before continuing, then return it to its separate, deliberate backup location. A real wallet passphrase should not remain in your clipboard or in a screenshot.

Bitcoin Core warns that losing the passphrase means losing the ability to use the encrypted private keys. There is no password reset service. Before meaningful funds are involved, create a deliberate passphrase backup strategy; do not rely on memory as the only copy.

The second warning is about malware: harmful software can steal your passphrase or interfere with a payment while you use the wallet. Encrypting a file does not make an infected computer safe.

Before continuing, choose the environment deliberately. For meaningful amounts, I do not recommend creating or unlocking a wallet on your daily computer. Browsers, extensions, email attachments and everyday software expose that machine to malware. An antivirus or anti-malware scan reporting “clean” does not establish that it is safe to handle wallet secrets. Even after cleanup, that residual risk is too high for serious savings in my view.

Use a dedicated generic computer with a fresh Linux installation. My recommended foundation is Debian Stable and verified Bitcoin Core . For now, practise creating, encrypting, backing up and restoring an empty wallet. The curriculum covers preparing a computer for real funds.

Open Receive, add a local label such as Test Transaction, and select Create new receiving address. Bitcoin Core displays the address and a QR code. Labels help you remember an address's purpose; the label itself is not written to the Bitcoin blockchain.

Keep this address unfunded. Its purpose here is to give you something to recognize when you restore the backup.

Choose File → Backup Wallet and save a copy, for example as practice-wallet.dat. Use a folder that is not automatically uploaded to cloud storage.

The Core passphrase protects the keys that sign payments. Someone who gets this backup can still view the wallet’s addresses, transaction history and balance, but cannot use its locked keys to sign a new payment without the passphrase. My recommendation is to encrypt the entire backup file with GPG as well, using a different passphrase. That keeps the wallet’s contents private.

With one GPG layer, you have three things to keep:

• The GPG-encrypted file — the backup containing your wallet.
• The GPG passphrase — opens that file.
• The Bitcoin Core passphrase — unlocks the wallet’s keys to approve payments.

Keep more than one copy of each, in separate locations. Keep the two passphrases separate from each other and from the encrypted file, so one theft or loss does not expose or destroy everything. Write down how to recover the wallet, and test the instructions.

A random-word passphrase by itself does not say what it unlocks. A GPG file with a neutral name such as backup.gpg keeps the Bitcoin wallet inside it hidden from view. To add another layer, encrypt that GPG file again with a new passphrase. Each extra layer adds one more passphrase to back up separately.

Follow the GPG steps below, then continue to step 8 to restore your wallet.

First use GPG to open your encrypted backup with its GPG passphrase. If you added more layers, open them in reverse order, last added first. You should end up with the wallet .dat file. In Bitcoin Core, close the original practice wallet with File → Close Wallet, then choose File → Restore Wallet. You will restore the recovered wallet file, not the .gpg file.

Find the wallet file you recovered from GPG, select it, and choose Open. If you skipped GPG for this practice run, select the copy saved with Backup Wallet. Check the filename and folder so you restore the intended backup. When Core asks for a wallet name, use a new name such as Restored Practice.

Finish the restore and check that the receiving address and label from step 6 are there. This practice wallet should still have a zero balance. The screenshot uses archive.dat; your file may have a different name. Core may open the wallet without asking for its passphrase. Its keys are still locked for spending.

You have now checked that the backup opens correctly. The next stage is to prove that the restored keys can approve a payment using valueless test coins. Follow that exercise in the self-custody curriculum.

Review the checklist below before treating the exercise as complete. A backup strategy is only credible after you have restored it, understood when the passphrase is required, and separated the wallet backup from the passphrase backup.