Multi-Signature and Advanced Account Security

How multi-signing, regular keys, and account-level permissions work on the XRP Ledger, and when they're worth the added complexity.

Beyond the basic hygiene covered in Wallet Security Best Practices, the XRP Ledger has several protocol-level features for accounts that need stronger or more flexible security than a single private key can provide.

Multi-signing

An XRP Ledger account can designate a list of up to 32 "signer" addresses and a signing quorum (a minimum combined weight required to authorize a transaction). Once multi-signing is enabled, no single key can move funds alone — a transaction must be co-signed by enough of the designated signers to meet the quorum.

This is standard practice for:

• Exchanges and custodians holding customer funds, where no single employee should be able to unilaterally move assets.
• DAOs or multi-party treasuries, where spending should require agreement among several stakeholders.
• High-value personal holdings, split across keys stored in different physical locations or hardware devices.

The tradeoff is operational complexity: every transaction now requires coordinating multiple signers, which is slower and less convenient than single-key signing.

Regular keys

Normally, an account is controlled by the key pair derived from its original creation. A "regular key" lets an account holder authorize a different key pair to sign transactions on the account's behalf, while keeping the original ("master") key available as a backup — or disabling the master key entirely once the regular key is confirmed working.

This matters for key rotation: if a signing key is potentially compromised, a regular key can be swapped out without changing the account's address, avoiding the need to notify every counterparty of a new address.

Disabling the master key

An account can permanently disable its original master key (asfDisableMaster), forcing all future signing through a regular key or multi-sign list. This is irreversible unless the account later re-enables it via the still-active regular key or signer list — so it is typically done only after the replacement signing method has been thoroughly tested.

Account-level permissions (tickets and deposit authorization)

Related but distinct protocol features worth knowing about:

• Deposit authorization lets an account require pre-approval before it can receive payments from unknown counterparties — a defense against unsolicited-token spam and certain phishing patterns.
• Tickets reserve a transaction sequence number for later use, useful for coordinating multi-signed transactions without sequence-number collisions.

Should you use any of this?

For most individual holders, standard wallet security best practices — hardware wallets, unique addresses, verifying destination tags — are sufficient. Multi-signing and regular keys are primarily relevant for organizations, custodians, and holders of institutional-scale balances, where the added operational overhead is justified by the reduction in single-point-of-failure risk. See Custody Risk and Counterparty Risk for the related question of self-custody versus third-party custody.