I have a customchain running on a private server. I am also running a provider using geth, to which I am connecting from the browser using let web3 = new Web3(http://xxxxxx:8545).

My browser client connects to the provider and can issue transactions after they unlock the account using web3.eth.personal.unlockAccount(..., password).

The [web3.js documentation][1] states:

Sending your account password over an unsecured HTTP RPC connection is highly unsecure.

This confused me because I assumed that the browser recieves the keystore json object from the server, does the decryption locally using a password, and uses the unlocked account to sign transactions, which are send to the provider who then in turn would send this transaction to the chain.

The above quote from the documentation makes me think that the password may be sent to the provider and the provider does the signing etc. This obviously is not the case.

So my question is this: "At any point, does the web3.js client send the password to the provider?" [1]: https://web3js.readthedocs.io/en/v1.2.7/web3-eth-personal.html#unlockaccount

  • That is not the answer, but your client should not unlock account ... I don’t understand why they still have that method.... your Client should sign the transaction and send the signed transaction to the backend or your server :/
    – Majd TL
    Feb 6, 2021 at 15:42
  • No the keystore file will not be sent to the browser, the password is transferred from the browser to the server. And if the connection is not encrypted then it is possible that someone will see the password as plain text
    – Majd TL
    Feb 6, 2021 at 15:45
  • And if you unlock your account then anyone who knows that the account is unlocked and has access to your blockchain can use it to send transactions until the account is locked again. You are not unlocking it only for the client who give the password, you are doing it for everyone
    – Majd TL
    Feb 6, 2021 at 15:47
  • Yes, the password is sent to the server in the clear if you use http. As said by MajdTL it is not recommended to use unlockAccount for that reason. From the client side you can use HDWallet provider to manage private keys.
    – Ismael
    Feb 6, 2021 at 16:05
  • @MajdTL Thanks for the clarification. So If I have the keystore json file imported as an object in my DOM, can I use web3.js to sign the transaction using the keystore file? Feb 7, 2021 at 12:12

1 Answer 1


Thanks @MajdTL for the clarification. I understand now that the unlockAccount(...) method actually unlocks the account for everyone on the blockchain and not just for the client on the browser.

There is a way to use simply the keystore json file that is generated when an ethereum account is created.

  1. load the keystoreV3 json into a js object, say keystore.
  2. instantiate an account object: mydecryptedaccount=web3.eth.accounts.decrypt(keystore, "password");
  3. add this account object into the local wallet: web3.eth.accounts.wallet.add(mydecryptedaccount);
  4. Sending transcations then works by setting defaultAccount parameter to mydecryptedaccount.address for either web3.eth.accounts.wallet or somecontract.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.