How does bitcoind generate a new address if the wallet is encrypted Suppose that my wallet is encrypted with a passphase and currently I have not provided bitcoind with the passphrase to access the private keys section of the wallet.

If I enter:

bitcoind getnewaddress


It prints a new address, say [someaddress], but where does it store the private key that goes with it?

If I enter:

bitcoind dumpprivkey [someaddress]


I get an error message since I have not provided the wallet passphrase.

But if I first provide the wallet passphrase and then try dumpprivkey it shows the private key.

When I asked it to get a new address, I had not provided the passphrase, so how it store the private key?
It gets it from the keypool, which has 100 pre-generated addresses by default.  The next time you enter your passphrase, it will refill the pool with new addresses.

Here's an example that shows the pool running out, and refilling when the password is supplied.  The following commands were performed by a trained professional.  Please don't try this at home (especially the first 2 commands):

$ cd ~/.bitcoin
$ rm wallet.dat
$ bitcoin-cli -daemon -keypool=5
bitcoin server starting
$ bitcoin-cli encryptwallet mypass
wallet encrypted; bitcoin server stopping, restart to run with encrypted wallet
$ bitcoin-cli -daemon -keypool=5
bitcoin server starting
$ bitcoin-cli getnewaddress
1Bf6TrgiBxzZhdtEWZuWuREkbfoAtmZ5xa
$ bitcoin-cli getnewaddress
1JzjmeH1LHzJ5JYzUu3wh36N7LWvfVeB2u
$ bitcoin-cli getnewaddress
1sjVdVJAAWB6JTsja4nEVezdnqiE6Ko3V
$ bitcoin-cli walletpassphrase mypass 3600
$ bitcoin-cli walletlock
$ bitcoin-cli getnewaddress
1DVZHRNbdBivqRKzas7iFT8emsb8EtcJT1
$ bitcoin-cli getnewaddress
1HBXkVkWCVhntzgkxdb9hnUxNeMdFqVssQ
$ bitcoin-cli getnewaddress
18n17UHshaufcufo5z1PBPAdErPWxesBhs
$ bitcoin-cli getnewaddress
1CofrGkqWrAmibBUgtLysknXdsBpDJARTs
$ bitcoin-cli getnewaddress
1NwWuba3khc31ebZU8fVAept2MDdnSndgV
$ bitcoin-cli getnewaddress
16QVdikDatH2FkQNkrRgGXrQ9LbEooHAPF
$ bitcoin-cli getnewaddress
error: {"code":-12,"message":"Error: Keypool ran out, please call keypoolrefill first"}
$ bitcoin-cli walletpassphrase mypass 3600
$ bitcoin-cli walletlock
$ bitcoin-cli getnewaddress
1BSDX4PiHKvdssjAzDLVACAAQvwiijmETV
$ bitcoin-cli getnewaddress
1JJphgnC5gqunLtbbLAwtN8LXRnCUYWARm
$ bitcoin-cli getnewaddress
17UJqrpuakgPPuxPTLa8LeeWVAKijZW66x
$ bitcoin-cli getnewaddress
16itq5LpuwyhtfbiHbQxVzJYYdGE7nQRoz
$ bitcoin-cli getnewaddress
1QA4EnXPUHquK9WBxBppicfBTD2gYTB9ic
$ bitcoin-cli getnewaddress
12bgaABsakRouK9NZyUAK1RAD9nmDtHQKa
$ bitcoin-cli getnewaddress
error: {"code":-12,"message":"Error: Keypool ran out, please call keypoolrefill first"}
$