HD Wallet Key Derivation: Hardened vs. Non-Hardened Security

Hierarchical-deterministic (HD) wallets derive an unlimited tree of key pairs from one master seed using BIP-32: each child key is the parent key plus an HMAC-SHA512 output, reduced modulo the curve order. This simulator computes that derivation for real, in the browser, with actual crypto.subtle HMAC-SHA512 calls and secp256k1-order modular arithmetic, and renders the resulting key tree in 3D. Build out branches with normal or hardened derivation, then "leak" a selected child's private key to watch the real consequence play out: on a normal path the leak lets an attacker reconstruct the parent key — and everything below it — from public data alone, while a hardened path keeps the damage contained to the single leaked leaf. A separate panel estimates brute-force time against a BIP-39 recovery phrase's keyspace at a chosen guess rate, showing why entropy, not obscurity, is what actually protects a seed phrase.