Hardened derivation

Also called: hardened key, hardened child key, hardened path, hardened index, apostrophe in derivation path, non-hardened derivation.

Hardened derivation is a BIP 32 way of deriving child keys that requires the parent private key, written with ' or h, as in m/84'/0'/0'.

Hardened derivation is one of the two ways an HD wallet creates child keys. A hardened child can only be derived from the parent's private key. A normal (non-hardened) child can also be derived from the parent's public key.

How to spot it

BIP 32 gives every extended key 2^32 possible children. Indexes 0 to 2^31 - 1 are normal; indexes from 2^31 (0x80000000) up are hardened. To keep paths readable, a hardened index is written with an apostrophe or an h: 44' and 44h both mean 2^31 + 44. Output descriptors (BIP 380) accept either form.

Why both kinds exist

For a normal child, the HMAC-SHA512 input is the parent public key plus the index. That is what lets an xpub derive receiving addresses with no secret at all. For a hardened child, the input is the parent private key instead, so an xpub can't follow that step.

The convenience has a known cost, spelled out in BIP 32: anyone who has a parent xpub and any non-hardened child private key below it can work out the parent private key, and with it every key in that branch. Hardened steps act as firewalls. That is why the first three levels of the standard derivation paths, such as m/84'/0'/0', are hardened (separating purposes, coins and accounts), while the last two, such as /0/5, are not, so the account xpub can generate addresses.

Practical upshot

Keep account xpubs private if any child private key below them could ever be exposed, and never export single child private keys from a wallet whose xpub is shared. Use our derivation path tool to see where the hardened steps fall, or read the derivation paths guide.