geth light mode features

Question

I am trying to fully grasp the concepts of the ethereum network. Therefore I want to setup a simple website which can manage ethereum wallets. I'm using the geth client with the following configuration:

geth --light --rpc --rpcapi personal,web3,net,eth --rpccorsdomain "*"

I've read a lot of documentation, but still not all the concepts are clear to me.

1. Do I need to have a node to create a wallet for a user and manage the private keys?
2. How does the geth --light mode work? When I create a new account, how can I know the account is created on the global ethereum network? etherscan.io shows an amount of 0, but that might be the default behaviour of a non-existing address number? Also for existing addresses, when using the eth_gethBalance rpc method, it always returns 0, while etherscan.io shows another amount.
3. What is the difference with a local account and a public address?
4. What does 'unlocking' an account actually do? Can I send transactions to a non-unlocked account?

Answer 1

You do not need to run a node to "own" a wallet. All you need is to possess the private keys. You can use the private keys to derive the public wallet address.

I don't know how geth --light works, but "creating" an account is done by simply creating a new private key and saving it somewhere. That key corresponds to a public address. You don't have to do anything to "create" an account on Etherscan. As soon as someone sends money to your public address, you will see that address has a balance on Etherscan.

If you are using Geth, a local account is the in-memory representation of the private key. An unlocked local account will allow Geth to sign transactions and send ether from the account. A public address is simply the hex string representation of any Ethereum account.

Geth encrypts all local accounts with a text password. It can load the encrypted local account's private key from disk, but it can't spend anything until you tell it to decrypt the private key with the password. Once Geth has the decrypted private key in memory, it can sign and send transactions from your local account.

You can send transactions to any public address at any time. You don't need to unlock an account to send to the public address.