So I have a web3js script(bot), something along these lines:

let walletAddress = ""
let pvtKey = ""

signed = await web3.eth.accounts.signTransaction(txObject, pvtKey);

What is the best practise to not have the private key in plain text? I can read it from a file, but if the attacker can escalate his privileges he can also read it from the file.

Using webjs encrypt/decrypt functionality doesn't help either cause in this case I would have the password visible in the script (assuming attacker was able to escalate privileges) so I would just be delaying the problem.

Reading from a vault from azure or aws I guess would be the same if he can get to my script.

What could be the best way to do this without being a hardware wallet (because this is a bot that is constantly posting transactions).

1 Answer 1


you should use the dotenv package.

Then you create a .env file and put all such important keys there. For example, the .env file should look like this:


The file where you wish to use this key, has to access it like this:

require('dotenv').config() //This configures the usage of the file.

Now you may use it in that file as:

signed = await web3.eth.accounts.signTransaction(txObject, process.env.PRIVATE_KEY);

Similarly, you can store other keys and access them too.

Important: Include .env file in .gitignore or else if this is posted shall make the keys vulnerable.

  • 1
    But how come is that more protected than simply have the key in the file with the same permissions of the .env file? I'm not discussing code organization or structure. Just security perspective.
    – Jonh Snow
    Jan 30, 2023 at 11:02
  • @JonhSnow did you solve this?
    – gllambi
    Jan 16 at 17:45
  • There can be Access Control or Accidental Exposure issues. Other than that it is fine. One may use a file with the same permissions and not push it on GitHub.
    – vampireAb
    Jan 17 at 14:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.