Why Does a Cardano Hardware Wallet Ask for a Staking Certificate Export?

02 November 2026

When your Cardano hardware wallet prompts you to export a staking certificate, it is not asking for a file you need to find. It is asking for permission to generate and share a cryptographic proof that your wallet controls a particular stake key. This step is necessary for the wallet software to construct a delegation transaction that links your ADA to a stake pool, without the hardware device having to reveal your private key.

What a staking certificate actually is

On Cardano, staking is not a lockbox or a deposit contract. It is a ledger-level association between a stake address and a stake pool. That association is recorded on-chain as a stake delegation certificate - a small piece of data that says "this stake key delegates to that pool."

The stake key itself is derived from your wallet's master seed, just like your spending keys. When your hardware wallet manages that seed, it keeps the stake key inside the device. No software on your computer ever sees it.

Why the hardware wallet cannot just sign blindly

A hardware wallet is designed to enforce a strict policy: it will not sign a transaction unless it can verify what the transaction does. For a simple payment, the device shows you the amount and the destination address. For a staking delegation, the transaction includes a stake registration certificate (if the key is new) and a delegation certificate (pointing to a pool). The wallet must verify that the stake key being used belongs to this device, and that the delegation is not tricking the device into signing something else.

To do that verification, the hardware wallet needs to see the public part of the stake key - the part that will appear on the blockchain. It generates this public key internally, but it needs your consent to export it to the computer so the wallet software can build the transaction.

What the export contains

The export is not a private key, a seed phrase, or a file you should save. It is a short data structure containing:

• The stake public key (not the private key)
• A stake key hash (a shorter identifier derived from that public key)
• A path indicator that tells the wallet which derivation path produced this key

The hardware wallet displays some of this information on its screen. You confirm that the details match what you expect, then the device exports the data to the wallet software.

How the Process Works Step by Step

1. You open your wallet application (Daedalus, Eternl, Yoroi, etc.) and navigate to the staking section.
2. You select a stake pool to delegate to.
3. The wallet software asks the hardware device for the staking certificate.
4. The hardware wallet generates the certificate from the stake key it holds.
5. The device displays a summary - typically the stake key hash or a portion of it - on its own screen.
6. You verify that the displayed information matches what the wallet software shows, then press the confirm button.
7. The hardware wallet exports the certificate to the computer.
8. The wallet software builds the full delegation transaction, including the certificate.
9. The hardware wallet signs the transaction (after showing you the final details again).
10. The wallet software submits the signed transaction to the Cardano network.

When you see this prompt

You will see the export request in these situations:

• First-time staking from a hardware wallet that has never been used for delegation. The stake key exists but has no on-chain registration yet.
• Switching pools with a wallet that was used for staking on a different computer or software. The wallet software needs to confirm it is using the correct stake key.
• Restoring a wallet from seed on a new computer. Even if you have staked before, the new software instance must request the certificate because it does not store the stake key itself.
• Using a different wallet application with the same hardware device. Each application independently requests the certificate.

What this export does NOT do

• It does not send your ADA anywhere. The certificate only associates a stake key with a pool; the actual ADA never leaves your wallet.
• It does not lock your ADA. You can spend or move your ADA at any time, even while staking.
• It does not transfer control of your stake key. The private key remains inside the hardware device.
• It does not expose your seed phrase or any other private data.

Security Implications

The export itself is safe. The stake public key and its hash are already visible on the blockchain once you delegate. Anyone can look them up. The risk is not in the export - it is in what you confirm on the hardware device screen.

If the display shows a stake key hash that does not match what your wallet software shows, or if the display asks you to confirm something you do not recognize, do not confirm. That mismatch could indicate a compromised computer or a malicious wallet application trying to use a different stake key.

A Common Misunderstanding

Some users see the export prompt and assume the hardware wallet is asking them to save a file or transfer data manually. It is not. The "export" happens directly from the device to the connected computer over USB or Bluetooth, as part of the normal transaction-building workflow. You do not need to locate, copy, or store anything.

Back to cardano