A developer, trader, or long-term holder on Solana may already control SOL tokens through an older wallet application, a hardware device, or a recovery phrase written on paper. Moving that wallet to Solflare—a non-custodial application created by Dokia Capital that operates exclusively on the Solana blockchain—requires a deliberate choice of import method. Each approach carries distinct trade-offs between security, convenience, and exposure. Understanding the mechanics before selecting an import pathway can prevent irreversible mistakes.
Solflare is available as a browser extension for Chromium-based browsers like Chrome, Brave, and Edge, as well as a mobile application, making it a practical option for managing Solana assets across multiple devices. The wallet does not require a centralized intermediary; it stores private keys locally on the user’s device and never holds funds on behalf of the platform. But that custody independence places the burden of secure import directly on the user. A seed phrase, private key, or JSON file contains all the information needed to spend assets, and the method chosen to bring that information into Solflare will determine which safeguards apply and which risks remain.
Understanding the three import pathways before starting
Solflare offers three distinct ways to bring an existing wallet into the application: importing a seed phrase, importing a private key, and importing a JSON keystore file. Each method provides access to the same assets on the Solana blockchain, but they differ in how the secret is transmitted, stored, and recovered. A seed phrase is typically a 12- or 24-word mnemonic that derives all associated addresses and private keys through a standardized algorithm. A private key is a raw cryptographic secret, usually represented as a base58-encoded string or hexadecimal number, that directly controls one specific wallet address. A JSON file is an encrypted container, often exported from exchanges or other wallet applications, that holds private key data in a structured format.
The relationship between these formats matters for practical security. A seed phrase is the most portable and recoverable; the same 12 or 24 words will regenerate the identical wallet across any compliant application that supports the Solana derivation path. A private key is tightly bound to a single address and offers no built-in path to recover other wallets derived from the same source. A JSON file is application-specific; its format, encryption algorithm, and password handling vary depending on where it was created. Choosing the wrong import method can create unnecessary exposure, lock assets behind a difficult recovery process, or expose secrets to software that was never intended to see them.
Before importing anything, verify the source of the secret. If the wallet or seed phrase came from a hardware device like Ledger Nano S or Keystone, consider whether importing into Solflare still makes sense; connecting the hardware wallet directly to Solflare through the hardware import option is often more secure than extracting the seed phrase. If the secret was stored digitally—in a text file, screenshot, cloud service, or email—accept that the device holding it may already be compromised. Importing into Solflare will not fix prior exposure; it will only move the secret to a new location. The security baseline is set by the most vulnerable place the secret has ever been.
A final preliminary check: verify that you are downloading the genuine Solflare application. The official solflare wallet download page provides links for browser extension and mobile versions. Phishing extensions exist on browser stores, and counterfeit apps have appeared on third-party Android repositories. Installing a fake wallet, entering a seed phrase, and watching funds move to an attacker’s address is irreversible. If the download source is uncertain, verify the official URL with the Solana community or Dokia Capital’s website directly before proceeding.
Seed phrase import: the most portable but highest-exposure method
A seed phrase import is the most versatile import approach because the 12 or 24-word mnemonic can regenerate the same wallet across different applications and devices. This portability is valuable if the user wants to switch wallets frequently, migrate between platforms, or use the same seed phrase across hardware and software simultaneously. Solflare will derive the Solana addresses and private keys from the seed phrase using the standard derivation path (m/44’/501’/0’/0′), which is the same path used by most other Solana wallets. If the seed phrase was previously used in Phantom, Magic Eden, or another Solana wallet, importing it into Solflare will show the identical addresses and balances.
The security trade-off is severe. Entering a seed phrase into any software application, even one that is open-source and non-custodial, means that application and its execution environment have full access to the secret. If the device is compromised by malware, if the browser extension has been modified or replaced with a phishing version, or if the operating system itself is controlled by an attacker, the seed phrase can be stolen. The attacker does not need to wait for a withdrawal transaction; they can immediately use the seed phrase to create a wallet elsewhere and move all funds. A user who enters a seed phrase into Solflare is implicitly trusting the device’s security, the browser’s integrity, the extension’s code, and the network’s trustworthiness.
Seed phrase import should therefore be restricted to devices that are known to be clean and regularly updated. A dedicated computer that is rarely connected to the internet, or a fresh mobile device used only for wallet operations, shifts the risk profile. A personal laptop that is also used for email, browsing untrusted websites, and downloading files without scanning is not a safe environment for seed phrase entry. The convenience of seed phrase import—the ability to restore the wallet on any new device by typing 12 words—is offset by the permanent reduction in security from the moment of entry onward.
If seed phrase import is chosen, Solflare will display the recovered addresses and ask the user to confirm them before finalizing the import. This is a critical moment to verify that the shown addresses match the ones previously associated with the wallet. If the recovery does not match—if the addresses are unfamiliar or different from the original wallet—stop immediately and restore the device to a clean state. A mismatch indicates that either the seed phrase is incorrect, the derivation path is incompatible, or something in the import process has failed unexpectedly. Do not proceed with transactions until the discrepancy is resolved.
Private key import: single-address control with reduced recovery options
A private key import bypasses the seed phrase entirely and imports a single address directly. This is useful if the user has a private key from an isolated address, wants to control a specific wallet without exposing a master seed phrase, or is migrating from an exchange that generated individual private keys for users. A Solana private key is typically represented as a base58 string (the format exported by Phantom and Solflare) or as a Solders keypair JSON file (the format commonly output by command-line tools). Solflare accepts both representations and will import the corresponding address into the wallet.
The primary advantage of private key import is compartmentalization. If the user has 10 different Solana addresses, each with its own private key, importing one address into Solflare does not expose the others. If that single address is later compromised, the damage is limited to that address’s balance. A malicious actor who obtains one private key cannot derive the others or access wallets on different blockchains. This is particularly valuable for users who deliberately maintain multiple addresses for different purposes—one for trading, one for staking, one for NFT storage—and do not want to consolidate them under a single seed phrase.
However, private key import creates an obvious limitation: there is no way to recover or regenerate the address if the private key is lost. A seed phrase can be restored by memory or written notes; a private key cannot be recovered from a mnemonic or other backup format unless it was originally stored as a seed phrase in the first place. If the user imported a private key, that key must be backed up separately using the secure backup or recovery options within Solflare. Some private keys, especially those generated from exchanges or now-defunct wallets, may not have an associated seed phrase at all. The user must treat the private key as a final, irreplaceable secret.
Solflare allows users to export a recovery phrase after importing a private key, but this recovery phrase will only regenerate that single imported address, not any other wallets. This can be confusing for users accustomed to seed phrases that derive multiple addresses. The UI makes this distinction, but the risk of misunderstanding remains. Before importing a private key, confirm that the address is correct and that the key itself is not corrupted or incomplete. Solflare will display the resulting public address after import; verify that this address matches the expected wallet before confirming the operation.
JSON keystore import: encrypted but application-dependent
A JSON keystore file is an encrypted container that holds a private key or seed phrase data, typically exported from exchanges, command-line Solana tools, or other wallet applications. The JSON file format allows the secret to be encrypted with a password, making it safer to store than a plain-text private key. However, the encryption and format are not standardized across all applications; a JSON file created by Anchor, the Solana CLI, or FTX will have a different structure than one created by Solflare. Solflare can import certain JSON keystore formats, particularly those that follow the standard Solders keypair structure, but not all historical or non-standard formats.
To import a JSON file into Solflare, the user provides the file and the password (if one was set during export). Solflare decrypts the file in memory, extracts the keypair, and imports the corresponding address. The decrypted secret is never stored unencrypted on disk, which is a security advantage over importing a plain-text private key from a file. However, if the password is weak or reused across multiple services, an attacker who obtains the JSON file can brute-force the password and unlock the keypair. If the user enters the JSON file and password into a compromised version of Solflare, the decryption happens locally, and the secret can still be stolen.
JSON import is most appropriate when the wallet was originally exported from a structured application that supports that format, and the user has stored the JSON file securely. Do not import JSON files that were shared insecurely, stored in cloud services without encryption, or placed in email attachments. The file itself contains the complete secret, and a password alone does not make it safe if the file has been exposed. Additionally, verify that the JSON file is actually for the address the user intends to import. A corrupted file or one that was accidentally renamed can cause confusion or import the wrong wallet.
Hardware wallet integration: the low-exposure option
For users whose wallets originated on a hardware device like Ledger Nano S or Keystone, importing the device itself into Solflare is often the most secure pathway. Solflare supports hardware wallet integration, allowing the hardware device to sign transactions while the seed phrase and private keys remain on the device itself, never exposed to the computer. This requires the user to connect the hardware wallet to the computer, authorize the connection in Solflare, and then use the hardware device to approve transactions.
This approach eliminates the need to extract or enter the seed phrase into Solflare at all. The device displays the transaction details on its own screen, which is controlled only by the hardware wallet’s firmware, not by the computer or Solflare. An attacker who compromises the computer or the Solflare application cannot change the transaction without authorization from the device. The seed phrase itself never leaves the hardware wallet, and is never exposed to software that could steal it.
Hardware wallet integration does introduce an inconvenience: every transaction requires physical access to the device and approval by pressing a button. For users who make frequent transactions or want to use Solflare’s built-in staking tools to delegate SOL to validators, this approval requirement can become tedious. Hardware wallets also have a small risk of their own—physical damage, loss, or theft. Users should maintain a backup of the recovery phrase in a secure location separate from the device itself.
If the original wallet is already on a hardware wallet and security is the primary concern, hardware integration is usually preferable to extracting the seed phrase. If the wallet was created in software and the user later acquires a hardware device, consider transferring the wallet to the hardware device through a proper secure transfer process rather than storing both the original seed phrase and the hardware device with the same secret.
Protecting secrets during and after import
Regardless of which import method is chosen, several operational practices reduce exposure. First, never screenshot, photograph, or type the seed phrase, private key, or JSON password into any application other than Solflare. If a photo or text file exists elsewhere, it can be discovered by malware or a physical attacker. Second, import only on a device that is not being used for email, web browsing, or other software downloads at the same time. Closing unnecessary applications, disabling internet connectivity temporarily if possible, and performing the import in isolation can reduce the attack surface.
Third, after import, verify that the address and balance in Solflare match the original wallet. If SPL tokens or NFTs were associated with the previous wallet, check that they appear in Solflare as well. Some tokens may not display immediately if Solflare has not indexed them; in that case, the “Add Token” feature can manually add the token to the visible list. Do not send test transactions until the import is visibly complete and accurate.
Fourth, set a strong password or PIN for Solflare if the mobile application supports it, and enable biometric unlock if available. This adds a layer of protection against physical access to the device. Note that this password does not protect the wallet if the device is stolen and taken to an attacker who can reset the device itself; it only protects against casual unauthorized access. A truly stolen device should be considered compromised, and assets should be moved to a new wallet.
Fifth, do not delete the original wallet or remove the old application until at least one successful transaction has been made from Solflare and confirmed on the blockchain. If something goes wrong with the import—if the address is incorrect or funds are not visible—having the original wallet still accessible can allow the user to recover without panic. Once a full transaction cycle has been completed and weeks have passed without unexpected issues, the original wallet and its backups can be securely deleted or archived.
Comparing security and convenience across import methods
Seed phrase import offers the most convenience and portability but the lowest security, because the entire secret is exposed to the software environment. Private key import offers moderate security and convenience, since a single address is isolated but must be backed up separately. JSON keystore import offers moderate security if the file is stored securely and the password is strong, but creates an additional dependency on the JSON format and password mechanism. Hardware wallet import offers the highest security if the device is maintained properly, but requires physical access for every transaction.
For a user setting up Solflare for the first time and prioritizing security, the recommended path is to import a hardware wallet if one is already available. If no hardware wallet exists, importing a private key associated with a non-critical address is safer than importing a master seed phrase. If the entire wallet must be migrated and is currently stored only as a seed phrase, perform the import on a clean device, change the password or PIN in Solflare immediately, and consider transferring some assets to a new seed phrase created within Solflare itself, leaving a portion in the original imported wallet until full confidence is established.
For users making a conscious trade-off toward convenience—accepting higher risk in exchange for easier access—seed phrase import into a regularly updated, reputable device may be acceptable. The decision should be deliberate, not accidental. A user who downloads and installs Solflare without thinking about which import method to use, then imports a seed phrase because it is the quickest option, has made a security decision without awareness. The same user, having read this guide and understanding the consequences, can make the same choice with full knowledge of what they are accepting.
Testing and validating the import before moving large balances
After choosing an import method and completing the initial setup, validate the import with a small test transaction before trusting it with a full balance. Send a small amount of SOL from a different wallet to the newly imported Solflare address. Verify that it arrives, appears correctly in Solflare, and can be sent back out. This entire cycle—receive, verify, send—should complete without error. If any step fails or behaves unexpectedly, do not proceed with larger amounts until the issue is understood and resolved.
If the wallet was imported with its full balance already on the Solflare address (because it was simply imported, not transferred), a useful validation is to delegate a small amount of SOL to a validator through Solflare’s built-in staking tools and wait for the delegation to complete. Staking and unstaking operations are common transactions for Solana users, and a successful staking transaction confirms that Solflare can sign and submit different transaction types correctly. After a few hours or one full epoch cycle (approximately 2-3 days), unstake and verify that the SOL returns to the wallet.
Document which import method was used, the date of import, and any relevant details such as the hardware wallet model or the JSON file source. This documentation can be invaluable if recovery is needed later or if the user needs to migrate the wallet again to a different application. A simple note file encrypted on the same device as Solflare, or printed and stored separately, serves this purpose without creating undue complexity.
Frequently asked questions
What is the safest way to import an existing wallet into Solflare?
If the wallet exists on a hardware device like Ledger Nano S or Keystone, use Solflare’s hardware wallet integration to avoid exposing the seed phrase entirely. If the wallet is software-only, importing a single private key for a non-critical address is safer than importing a master seed phrase. If the entire wallet must be imported, use a clean device, import the seed phrase, then create a new wallet within Solflare itself and move most assets there, treating the imported wallet as a secondary backup.
Can I import the same seed phrase into multiple devices or applications?
Yes, the same seed phrase will regenerate the identical addresses and private keys in any compliant Solana wallet application that uses the standard derivation path. However, importing one seed phrase into multiple devices increases the risk that any one of those devices could be compromised, exposing the entire wallet. For better security, consider keeping the seed phrase on one secure device and using hardware wallet integration or individual private key imports for secondary devices.
What should I do if I forget the password for a JSON keystore file I want to import into Solflare?
If the JSON file is encrypted with a password and the password is forgotten, the file cannot be decrypted and imported. The private key or seed phrase inside is inaccessible unless you have a separate, unencrypted backup. Prevent this by storing JSON passwords securely in a password manager separate from the file itself. Do not attempt to brute-force or guess the password; treat a forgotten password as a permanent loss of that keystore.
Does Solflare wallet download include a secure wallet setup guide for beginners?
The Solflare application includes an onboarding flow that guides users through the import process and highlights security practices. However, the in-app instructions are necessarily brief. For a comprehensive understanding of each import method and its security implications, refer to this article or the official Solflare documentation. Always verify that you have downloaded Solflare from the official source before entering any secrets into it.