Hardened vs. Normal Indices

In a derivation path, you will often see indices followed by an apostrophe (e.g., 84'). This symbol is more than a label; it represents a fundamental change in how the child key is calculated.

1. Normal Derivation (0 to 2,147,483,647)

In a "Normal" step, the child is derived using the Parent Public Key.

• Symbol: Plain number (e.g., 0).

• Feature: Allows the derivation of public children without needing the private key.

• Risk: If a child private key is leaked, an attacker can combine it with the parent xpub to find the parent private key.

2. Hardened Derivation (2,147,483,648 to 4,294,967,295)

In a "Hardened" step, the child is derived using the Parent Private Key.

• Symbol: Number with a prime/apostrophe (e.g., 0').

• Feature: Creates a "Firebreak." Even if a child private key is leaked, there is no mathematical way to work backwards to the parent key.

• Requirement: You must have the parent private key to calculate any child key in this range.

3. Why use Hardened at the top?

Standard paths like m/84'/0'/0' use hardened derivation for the first three levels (purpose, coin_type, and account).

• This ensures that your "Account" keys are completely isolated from each other.

• Even if someone hacks your "Savings Account" and finds a private key, your "Personal Account" remains completely safe and invisible to them.

4. Why use Normal at the bottom?

The change and index levels are normal (0/0).

• This allows you to share your Account xpub with a watch-only wallet or a merchant server.

• The server can then generate thousands of receiving addresses for you, but it cannot "jump" to your other accounts.

Type	Symbol	Range	Security
Normal	0	$0 \rightarrow 2^{31}-1$	Publicly derivable
Hardened	0'	$2^{31} \rightarrow 2^{32}-1$	Isolated / Private only

In the final section, we will build a Python Derivation Path Auditor.