What format are Sui private keys in?

Sui private keys are exchanged as Bech32 strings that start with suiprivkey. The string encodes 33 bytes: a 1-byte signature-scheme flag followed by the 32-byte private key. The CLI keystore file stores the same 33 bytes as Base64 instead, and the old 32-byte hex format is deprecated for import and export.

The three encodings you'll see

Encoding	Where you see it	Contents
Bech32, `suiprivkey1...`	Wallet export and import, `sui keytool export`	`flag \|\| privkey` (33 bytes)
Base64	`~/.sui/sui_config/sui.keystore`, `sui keytool generate` output files	`flag \|\| privkey` (33 bytes)
Hex, 64 characters	Old Sui Wallet exports	32-byte Ed25519 key, no flag (legacy)

The Sui CLI source describes Bech32 as the "latest Sui Keystore and Sui Wallet import/export format", Base64 as the "Sui Keystore storage format" and hex as the "Legacy Sui Wallet format".

The flag byte

The first byte says which signature scheme the key is for:

Flag	Scheme
`0x00`	Ed25519
`0x01`	ECDSA Secp256k1
`0x02`	ECDSA Secp256r1

Without the flag you can't tell which curve a raw 32-byte key belongs to. That ambiguity is the reason the hex format was dropped. Multisig, zkLogin and passkey accounts have no exportable private key of this kind; see Which signature schemes does Sui support?.

Decoding a key in TypeScript

@mysten/sui/cryptography exports decodeSuiPrivateKey and encodeSuiPrivateKey. Keypair classes also accept a suiprivkey string directly:

TypeScript

import { decodeSuiPrivateKey } from '@mysten/sui/cryptography'
import { Ed25519Keypair } from '@mysten/sui/keypairs/ed25519'

const { scheme, secretKey } = decodeSuiPrivateKey(process.env.SUI_PRIVATE_KEY!)
console.log(scheme) // 'ED25519'

const keypair = Ed25519Keypair.fromSecretKey(secretKey)
console.log(keypair.toSuiAddress())

// Going the other way
console.log(keypair.getSecretKey()) // 'suiprivkey1...'

Keep keys in environment variables or a secrets manager, never in source control.

Converting an old hex or Base64 key

The CLI converts any of the older formats into Bech32:

Terminal

sui keytool convert <HEX_OR_BASE64_KEY>

The output has bech32WithFlag, base64WithFlag, hexWithoutFlag and scheme. A bare 64-character hex value is treated as an Ed25519 key. Import the Bech32 value with sui keytool import; see How do I import or export a private key in the Sui CLI?.

Private key vs recovery phrase

A recovery phrase (12, 15, 18, 21 or 24 BIP-39 words) isn't a private key. Wallets derive keys from it along a path: m/44'/784'/{account}'/{change}'/{address}' for Ed25519 (SLIP-0010), m/54'/784'/... for Secp256k1 and m/74'/784'/... for Secp256r1 (BIP-32). One phrase can therefore produce many addresses, while a suiprivkey string is exactly one key and one address. See How are Sui addresses derived from keys?.

Sources

Keys and addresses, Sui documentation
Sui CLI keytool reference, Sui documentation
crates/sui/src/keytool.rs and crates/sui-types/src/crypto.rs, MystenLabs/sui