XPUB → Master Key

A BIP32 design flaw: an extended public key (xpub) carries the parent chain code in the clear, so one leaked non-hardened child private key is enough to walk back up the tree and recover the parent master private key — k_par = (k_child − IL) mod n, where IL = HMAC-SHA512(chainCode, K_par || i). That single key then owns the wallet's entire subtree. Paste the xpub, one child key and its index; everything is computed and verified in your browser, offline.

Parent extended public key — xpub (also accepts ypub / zpub / tpub)

One non-hardened child private key (64 hex, or WIF)

Child index i (< 2³¹)

Runs entirely in your browser — press Ctrl+Enter to recover.

Hardened indices (i ≥ 2³¹, written i′) are immune — BIP32 hashes the parent private key for them, which an xpub does not contain. This attack only works on non-hardened children.

Instructions:
1. Paste the parent extended public key (xpub) — it embeds the 33-byte parent public key and the 32-byte chain code.
2. Paste ONE non-hardened child private key (64 hex or WIF) and the exact index i it was derived at (0 ≤ i < 2^31).
3. The engine computes IL = HMAC-SHA512(chainCode, K_par || ser32(i)) and recovers k_par = (k_child − IL) mod n. It is shown only when k_par·G equals the xpub's public key — no false positives.
4. No internet connection is used: everything is computed locally in your browser. Click "Load example" for a working demo.

Educational, offline tool. This demonstrates why BIP32 non-hardened derivation is dangerous: because an xpub publishes the chain code, a single exposed child private key lets anyone reverse CKDpriv and recover the parent master key — compromising every address in that branch. Hardened derivation (i ≥ 2³¹) is immune and is refused here by design. Every result is verified against the public key inside the xpub; nothing is guessed. Never enter keys for wallets you use.