imtoken will never ask for your seed phrase, private key or verification code. Always review the address, network and request details before transferring, signing or approving.
imtoken · Knowledge and practical checks

Seed Phrase & Private Keys

Seed phrases and private keys represent account control. Secure handling is about reducing copying, exposure, accidental sharing and third-party access—not making them easier to synchronize.

Use the page as a decision guide: identify the network, account and request before signing or moving assets.
On this page

Understand seed phrases and private keys

A seed phrase typically restores a set of accounts, while a private key can control a specific account directly. Both are highly sensitive, and disclosure can compromise control.

A repeatable order of checks is more reliable than memory. Review source, network, account, target and expected outcome each time so the same safety logic carries across wallets and DApps.

Prefer offline backups

Offline media can reduce network exposure, but it still needs protection from loss, viewing and physical damage. A screenshot that syncs to photo or cloud services is not a strong primary backup.

When a task involves a third-party contract, bridge, validator or web service, separate that external risk from the wallet itself. A wallet can display and sign a request, but it cannot guarantee the safety of outside code or services.

Avoid remote assistance around keys

Do not continue any support flow that asks for remote-control software, screen sharing or photos of a recovery phrase. Legitimate support should not request seed phrases or private keys.

Put this concept back into the current network, account and request type before acting. Identify what the interface is asking for, then decide whether a signature, gas payment or ongoing permission is actually required.

Restore only in a trusted environment

When recovery is necessary, enter the phrase only in a verified wallet environment and ensure no screen recording, clipboard sync or observers are present. Recheck device security afterward.

Do not rely on a button label or a familiar-looking page as the reason to continue. Compare the request with the on-chain target, network state and expected result, and stop when those pieces do not line up.

Practical checklist

  • Confirm that “Understand seed phrases and private keys” matches the task you intend to perform
  • Confirm that “Prefer offline backups” matches the task you intend to perform
  • Confirm that “Avoid remote assistance around keys” matches the task you intend to perform
  • Confirm that “Restore only in a trusted environment” matches the task you intend to perform

Risk reminder

Seed phrases and private keys remain under the user’s control. Legitimate support should not ask for a seed phrase, private key or verification code. Review address, network and amount before transferring; blockchain transactions generally cannot be unilaterally reversed by a wallet. Third-party DApps and smart contracts carry risk, so review spender and permission scope and consider revoking unused approvals.