web3.eth.accounts.create returns the address along with private key so I was wondering if is it safe to call it using plain JS in website frontend instead of doing it server side in Node?

My use case is to let users create wallet address on the website and store the encrypted private key in database. Since only the authorized user creating the address would be able to see the private key (using console), I think it shouldn't be an issue but I just wanted to make sure it's safe to do it?

Also, I plan to build this dapp without NodeJs using a traditional server side language, e.g. Python or PHP with web3js. What are the things I should keep in mind while doing it from security perspective?

  • If you are the 'manager' of the wallets, then the user shouldn't see the private key and therefore it should be created in the backend. However, like MyEtherWallet, if you are not the manager of the wallets, it is safest to do everything in the frontend so the user itself can manage the private key and wallet only. – devqon Jan 17 '18 at 13:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.