Keystore file (JSON keystore)

A keystore file holds a private key in encrypted form. The user's password is stretched with a key derivation function such as scrypt or PBKDF2, the result encrypts the key with AES, and a checksum lets software detect a wrong password. The file also records the parameters needed to decrypt it, so any compatible wallet can import it with the right password.

Ethereum clients like Geth have long saved accounts this way, and early web wallets let users download a keystore instead of writing down a seed phrase. Validators use a similar standard for their BLS signing keys: the staking deposit tool generates keystores that consensus clients load at start-up, keeping the raw key off disk.

A keystore is only as strong as its password. If someone obtains the file and the password is weak, they can brute-force it offline at leisure, so the file should be treated as sensitive even though it is encrypted. Losing either the file or the password usually means losing the funds, and a keystore is not a seed phrase: it protects one key, not a whole wallet hierarchy.