Encrypt Your Wallet | Divi Services

1Why encrypt, and why before the backup

A fresh node wallet stores your private keys and your recovery phrase in plain form on disk. Anything that can read that file can spend every coin in it: a thief with the laptop, malware, a cloud sync folder, or whoever finds an old backup drive. Encrypting the wallet scrambles those keys with a passphrase you choose. The wallet still watches the chain and shows your balance, but it cannot sign a payment, show your phrase or stake until you unlock it.

This is tutorial #4 for a reason. Back up your wallet (#5) comes next, and it only ever backs up an encrypted wallet. A backup of an unencrypted wallet is a second plain copy of your keys lying around; one of the nodes below says so itself when it finishes encrypting: "Back up your wallet again: earlier backups are not encrypted." So: encrypt first, then back up.

What the passphrase does and does not protect It protects the file. It does not replace the recovery phrase: if the disk dies, only the phrase brings the coins back. And it cannot be reset. Forget the passphrase and the coins in that file are gone unless you still have the phrase. Keep both in your password manager (step 2).

2Choose the passphrase

Let the password manager make it. Proton Pass (free), 1Password, Bitwarden, Dashlane, Keeper and Apple Passwords all generate and store long passphrases. Save it in the same entry as the wallet's recovery phrase, labelled with the computer and folder it belongs to.
Long beats clever. Four or more random words, or 20+ random characters. Not a password you use anywhere else.
Never paper only. Paper is a fine extra copy; it is a bad only copy. The password manager comes first.
Practise on testnet. Every command below was run on a testnet wallet, so the outputs are real. Mainnet is identical; only the money is.

Nobody will ever ask for your passphrase or your phrase Not Divi support, not this site, not a "wallet validation" page. Anyone who asks is stealing. See Avoid scams.

3IronDivi node

IronDivi encrypts in place. The node keeps running, the wallet comes back locked, and you unlock it for a set number of seconds whenever you need to spend or read the phrase. These steps use the testnet node and config file from Create your first wallet.

Encryption needs IronDivi 0.2.6 or newer, released on 2026-10-22. The 0.2.5 release answers error code: -32601: Method not found: encryptwallet; upgrade the node first.

Encrypt. Use --stdin so the passphrase is typed into the program, not written on the command line where the shell history would keep it:
```
irondivi-cli -c ~/divi-test/irondivi.conf --stdin encryptwallet
```
Type (or paste) the passphrase, press Enter, then press Ctrl+D to finish. The reply:
```
wallet encrypted; the wallet is now locked. Use walletpassphrase to unlock it. Back up your wallet again: earlier backups are not encrypted.
```
The passphrase was visible on the screen while you typed, so run clear afterwards.

Check the state:

irondivi-cli -c ~/divi-test/irondivi.conf getwalletinfo

{
  "active_wallet": "wallet.dat",
  "balance": 25000.0,
  "encryption_status": "locked",
  "hdmasterkeyid": "",
  …
  "spendable_balance": 25000.0,
  "unlocked_until": 0,
  …
}

encryption_status is now locked. The balance is still there and still spendable once unlocked. (IronDivi 0.2.6 shows an empty hdmasterkeyid while the wallet is locked; it was filled in before encryption.)

See what "locked" means. Ask for the phrase:

irondivi-cli -c ~/divi-test/irondivi.conf dumphdinfo

error code: -13: Error: Please enter the wallet passphrase with walletpassphrase first.

Good: the file on disk can no longer give up your keys.

Unlock for 60 seconds. Again through --stdin, one line for the passphrase and one for the timeout in seconds:
```
irondivi-cli -c ~/divi-test/irondivi.conf --stdin walletpassphrase
```
Type the passphrase, Enter, 60, Enter, Ctrl+D. A silent null means success. getwalletinfo now shows:
```
  "encryption_status": "unlocked",
  "unlocked_until": 1792629885,
```
unlocked_until is a clock time in seconds; yours will differ. When it passes, the wallet locks itself.
Lock it early when you are done:
```
irondivi-cli -c ~/divi-test/irondivi.conf walletlock
```
encryption_status goes back to locked and unlocked_until to 0.
Change the passphrase later with walletpassphrasechange, two lines on stdin: the old passphrase, then the new one:
```
irondivi-cli -c ~/divi-test/irondivi.conf --stdin walletpassphrasechange
```
Update the password manager entry straight away.

Two things IronDivi does differently from the C++ node A wrong passphrase answers error code: -14: Incorrect passphrase. And IronDivi has no "staking only" unlock: the optional third argument to walletpassphrase is ignored, and an unlocked IronDivi wallet can also spend. Stake in a wallet covers what that means for staking.

4Divi Desktop

Divi Desktop 2.0.0 does the same thing with buttons. It runs the C++ node underneath, so the states you see are the same ones the command line shows.

Open Settings and find Encrypt Wallet. Press Encrypt.
On Choose a password, paste the passphrase from your password manager. The screen warns: "Do NOT forget this password or you will be unable to access your coins". Press Next.
On Confirm your password, paste it again and press Encrypt Wallet.
Settings now shows Wallet lock/unlock, Change password and Default unlock timeout. The padlock in the status bar reads Locked, Unlocked or Unlocked, staking only.
To spend, the app opens Unlock your wallet and asks you to Enter your password. Tick Unlock for Staking only when you want the wallet to stake but not to send.

The screen text here comes from the Divi Desktop source code; the layout may differ a little from release to release.

5BoxWallet

BoxWallet (v0.8.38) wraps the C++ node it installed for you. Its own commands do the encryption and unlocking:

./boxwallet wallet encrypt
./boxwallet wallet unlock
./boxwallet wallet unlockfs

encrypt asks for the passphrase and encrypts the wallet; unlock unlocks it fully; unlockfs unlocks it "for staking" only, the safer state for a node that stakes day and night. The first ./boxwallet dash wizard also offers to encrypt. Underneath, these call the same encryptwallet and walletpassphrase commands shown in the next step, so divi-cli getwalletinfo tells you the state at any time.

6C++ Divi command line

Same commands, two differences: divi-cli has no way to read the passphrase from stdin, and the C++ node has the staking-only unlock. These steps use the testnet node from Create your first wallet.

Encrypt:
```
 divi-cli -testnet encryptwallet "your passphrase here"
```
```
Wallet reloaded!
```
Note the space before divi-cli: with HISTCONTROL=ignorespace (bash) or setopt HIST_IGNORE_SPACE (zsh) the shell does not save that line. If your shell lacks that, run history -c afterwards. Older guides say the node shuts down here; Divi 3.0.0 keeps running and reloads the wallet.

Check:

divi-cli -testnet getwalletinfo

{
    "active_wallet" : "wallet.dat",
    "walletversion" : 120200,
    "balance" : 0.00000000,
    …
    "keypoolsize" : 2000,
    "unlocked_until" : 0,
    "encryption_status" : "locked"
}

Locked means locked. divi-cli -testnet dumphdinfo now answers:

error: {"code":-13,"message":"Error: Please enter the wallet passphrase with walletpassphrase first."}

Unlock for 60 seconds, the same leading space:
```
 divi-cli -testnet walletpassphrase "your passphrase here" 60
```
getwalletinfo then shows "encryption_status" : "unlocked" and an unlocked_until time. A wrong passphrase answers Error: The wallet passphrase entered was incorrect. A timeout of 0 keeps it unlocked until the node stops.
Unlock for staking only, by adding true:
```
 divi-cli -testnet walletpassphrase "your passphrase here" 0 true
```
getwalletinfo shows "encryption_status" : "unlocked-for-staking": the wallet can sign stakes, but sendtoaddress answers Error: Please enter the wallet passphrase with walletpassphrase first. as if it were locked. This is the state to leave a staking node in.
Lock early with divi-cli -testnet walletlock. Change the passphrase with walletpassphrasechange "old" "new", leading space again.

7Web wallet, browser extension and Telegram

The light wallets keep no wallet file on a node, so there is no encryptwallet. Each protects your phrase on the device in its own way:

Wallet	What protects the phrase	Where to set it
IronDivi Web Wallet	Nothing is stored unless you say yes to "Remember this wallet on this device?". Then the phrase is encrypted with an unlock method you choose: a passphrase or a passkey (strong), a complex pattern on a 5 by 5 grid (medium), or a PIN or simple pattern (weak, and removed after 5 wrong tries). It locks itself after 15 minutes idle.	The remember prompt, then the security panel: Add a method, Lock Wallet, Forget this wallet on this device.
IronDivi browser extension	The password you set when creating the wallet encrypts the phrase (PBKDF2-HMAC-SHA512, 600,000 rounds). Every signature asks for it again: Enter Password to Sign.	Set at creation; not yet published in a store, see #3.
IronDivi Telegram wallet	An unlock pattern of at least 8 dots, drawn in the mini-app. "Draw your pattern to unlock."	`/settings` in the bot opens the app to change the pattern or wipe the wallet; `/forgot` if you lose it (you then restore from the phrase).

Treat these like the passphrase above: generated and stored in the password manager, next to the recovery phrase. A pattern or PIN is convenience, not a vault; the phrase is what a thief with your phone would need, and it is what gets you back in.

8Living with a locked wallet

Receiving needs no unlock. Addresses and balances work while locked.
Sending needs an unlock, then lock again. The apps do this for you; on the command line, use a short timeout.
Staking needs the C++ node unlocked for staking only, or IronDivi unlocked fully. Stake in a wallet explains the trade-off.
Now back it up. The wallet file is finally safe to copy: Back up your wallet is next.

Troubleshooting

"running with an encrypted wallet, but encryptwallet was called" (code -15): it is already encrypted. Use walletpassphrasechange to change the passphrase.
"running with an unencrypted wallet, but walletpassphrase was called": you have not encrypted yet, or you are pointing at the wrong node or data folder.
"Passphrase required" (IronDivi, code -1): nothing reached the program on stdin. Run the command again and type the passphrase before Ctrl+D.
Lost the passphrase? There is no reset. Restore a new wallet from the recovery phrase (#3, step 10) and encrypt it with a new one. If both are gone, see Rescue a wallet.

Still stuck? Ask the Divi chatbot, or see all tutorials.

← Create your first wallet Back up your wallet →