A complete beginner-friendly guide to Bitcoin private keys, public keys, addresses, signatures, seed phrases, extended keys, Taproot, and secure key management.
Introduction
Bitcoin allows people to transfer value without asking a bank or payment company to approve each transaction. That independence depends on a cryptographic key system that proves spending authority without requiring the owner to reveal a secret to the network.
Two terms sit at the center of this system: the private key and the public key. They are mathematically connected, but they serve very different purposes. A private key must remain secret and is used to authorize spending. A public key can be shared and is used by Bitcoin nodes to verify a valid signature.
The relationship is easy to summarize but often explained too loosely. A Bitcoin address is not the same as a public key. A seed phrase is not one individual private key. A wallet password does not replace the underlying key material. An extended public key cannot normally spend funds, yet it can expose significant financial privacy.
At XTS, we believe these distinctions are essential for understanding Bitcoin wallets, transaction verification, self-custody, hardware wallets, multisignature arrangements, Taproot, and secure recovery. This guide explains the entire relationship in clear language while preserving the technical details that matter.
The Short Answer
A Bitcoin private key is secret data used to create spending signatures. The corresponding public key is derived from that private key and allows the network to verify those signatures. The public key cannot feasibly be reversed to recover the private key when secure cryptography is used correctly.
The simplest model is private key → public key → address or spending condition. In practice, modern Bitcoin wallets may derive many key pairs from one seed and combine them with script templates, descriptors, multisignature policies, or Taproot output keys.
What Are Cryptographic Keys in Bitcoin?
A cryptographic key is data used by an algorithm to perform a security function. Bitcoin uses asymmetric public-key cryptography: the signing key is private, while the verification key can be public.
This arrangement allows a wallet to prove authorization without giving Bitcoin nodes the secret itself. The wallet creates a signature for specific transaction data. Nodes verify the signature against the appropriate public key and the spending rules of the output being spent.
Cryptographic control is not always identical to legal ownership. From the protocol’s perspective, the central question is whether a transaction satisfies the output’s spending conditions. For common single-key outputs, that normally means providing a valid signature created with the corresponding private key.
What Is a Bitcoin Private Key?
A Bitcoin private key is a secret number chosen from the valid range defined by the secp256k1 elliptic curve. It is commonly represented as 32 bytes of data, although users may encounter encoded forms such as Wallet Import Format, or WIF.
The raw number is not Bitcoin itself. It is secret signing material. Wallet software uses it to create a valid digital signature for a transaction. The signature can be shared with the network while the private key remains hidden.
Anyone who obtains usable private-key material may be able to authorize spending of the outputs controlled by it. Private keys should never be shared with support agents, entered into untrusted websites, sent through messaging apps, or stored casually in screenshots and cloud notes.
How Is a Private Key Generated?
A secure private key must be generated from strong, unpredictable randomness. The possible key space is extraordinarily large, which makes accidental duplication effectively negligible when reputable software and hardware generate keys correctly.
Human-created phrases, birthdays, favorite numbers, or predictable patterns are not safe sources of private keys. So-called brainwallets have historically failed because attackers can guess human choices far more efficiently than they can search the full cryptographic key space.
Use established wallet software or hardware from an authentic source.
Allow the wallet to generate entropy using its documented process.
Do not invent a private key or recovery phrase yourself.
Verify backups before relying on the wallet for significant value.
Treat imported legacy keys with extra caution because their origin may be uncertain.
What Is Wallet Import Format (WIF)?
Wallet Import Format is a Base58Check encoding of a private key. It includes version information and a checksum that helps software detect some copying errors. It may also indicate that the key should be used with a compressed public key.
WIF is an encoding, not encryption. Anyone who sees a valid WIF private key can decode it and may be able to spend the associated funds. Its readable appearance does not make it safer to publish or store online.
What Is a Bitcoin Public Key?
A Bitcoin public key is an elliptic-curve point derived mathematically from a private key. Traditional Bitcoin keys use the secp256k1 curve. Wallet software can calculate the public key efficiently from the private key, but reversing that operation is considered computationally infeasible with current methods.
The public key helps verify digital signatures. When a wallet signs transaction data, Bitcoin nodes use the relevant public key and signature rules to confirm that the transaction was authorized by someone possessing the corresponding private key.
A standard public key is not secret. However, public information can still affect privacy. Sharing one public key repeatedly can help observers link activity, and sharing an extended public key can reveal an entire branch of addresses and transactions.
How Is the Public Key Derived?
In simplified form, the public key is calculated by multiplying the private key by a fixed generator point on the secp256k1 elliptic curve. This operation is fast in the forward direction.
Private key × generator point = public key
The reverse problem—finding the private key from the public key—is the elliptic-curve discrete logarithm problem. The security assumption is not that reversal is logically impossible, but that it requires an impractical amount of computation when keys are generated and used correctly.
Why Can the Public Key Be Shared?
A public key is designed to verify signatures, not create them. Knowing it does not normally provide the secret value required to authorize spending. This lets a network of independent nodes verify a transaction without learning the private key.
Public does not mean consequence-free. Publishing a public key can connect it to an identity, and address reuse can make separate payments easier to link. Extended public keys deserve even greater care because they can reveal many future addresses and transaction relationships.
Public Key vs Private Key
Private Key
Must remain secret.
Creates digital signatures that authorize spending.
Can derive the corresponding public key.
Loss may make funds permanently inaccessible if no valid backup exists.
Exposure may allow an attacker to transfer funds.
Public Key
Can be shared for verification and wallet coordination.
Verifies signatures but cannot normally create them.
Is derived from the private key through elliptic-curve mathematics.
May be used directly or indirectly in Bitcoin spending conditions.
Can reveal privacy information, especially when extended or reused.
Private keys authorize. Public keys verify.
How a Bitcoin Signature Works
A wallet constructs a transaction and identifies the inputs that require authorization.
The wallet calculates the exact transaction data that the signature must commit to.
The signing device uses the relevant private key to create a digital signature.
The signed transaction is broadcast without exposing the private key.
Bitcoin nodes use public information and the spending script to verify the signature.
If every rule is satisfied, nodes may accept the transaction into their mempools and miners may confirm it in a block.
A signature is tied to specific transaction data and signature-hash rules. If important committed details are changed after signing, the signature will not verify for the modified transaction.
What Is a Digital Signature?
A digital signature is cryptographic proof that the required secret key authorized particular data. It does not reveal the private key, and it is not a scanned handwritten signature.
Bitcoin signatures support two essential properties: only the appropriate secret key should be able to produce a valid signature, and anyone with the necessary public information should be able to verify it. Correct wallet implementation is important because poor randomness or flawed signing can undermine otherwise strong cryptography.
ECDSA and Schnorr Signatures
ECDSA
Bitcoin traditionally uses the Elliptic Curve Digital Signature Algorithm, or ECDSA, with secp256k1 keys. Many legacy and SegWit outputs continue to use ECDSA signatures.
Schnorr
Taproot introduced BIP340 Schnorr signatures for key-path spending. BIP340 uses 32-byte x-only public keys and fixed-size 64-byte signatures. Schnorr’s mathematical properties also support more efficient constructions for multiple signers and improved privacy in suitable protocols.
ECDSA and Schnorr use the same underlying secp256k1 curve but different signature rules and encodings. A beginner does not need to calculate either manually; secure wallet software handles the details.
Compressed and X-Only Public Keys
An elliptic-curve public key represents a point with X and Y coordinates. Older uncompressed encodings contain both coordinates and use 65 bytes. Compressed encodings store the X coordinate plus one bit of information needed to reconstruct Y, reducing the key to 33 bytes.
Compressed public keys became the standard choice for traditional Bitcoin uses because they reduce transaction data without losing the underlying point. BIP340 Schnorr signatures use a different 32-byte x-only encoding that selects a consistent Y-coordinate convention.
Private Key, Public Key, and Bitcoin Address
Private key → public key → address or spending script
This is a useful beginner diagram, but it is a simplification. A Bitcoin address is a user-facing encoding that helps the sender create a particular output script. It is not the same as the private key, and it is not always simply a public key written in another format.
Legacy P2PKH and native SegWit P2WPKH destinations commit to a hash of a public key; the public key is usually revealed when the output is later spent. Taproot P2TR addresses encode a witness version and a 32-byte output key. Script-hash and multisignature arrangements may commit to more complex conditions involving several keys.
What Is a Bitcoin Address?
A Bitcoin address is a shareable destination that encodes information needed to construct an output. Common mainnet addresses begin with 1, 3, or bc1, depending on the script type and encoding.
A wallet can generate many addresses from one root seed. Using a fresh receiving address for each payment generally improves privacy. Sharing an address is normal; sharing the private key or recovery phrase behind the wallet is not.
Does an Address Reveal the Public Key?
The answer depends on the output type and whether it has been spent. For P2PKH and P2WPKH, the address represents a hash of a public key, and the full public key is normally revealed in the spending transaction. An unspent output of those types may therefore expose only the hash commitment.
Taproot outputs are different because the address commits directly to an x-only output key. Other scripts can reveal different combinations of public keys and script data. In every case, seeing the public key should still not make calculating the private key practical under current security assumptions.
What Is a Seed Phrase?
A seed phrase, mnemonic phrase, or recovery phrase is a human-readable backup used by many deterministic wallets. It can recreate a seed from which the wallet derives many private and public keys.
A seed phrase is therefore not merely one private key. Depending on the wallet standard and derivation structure, it may regenerate an entire tree of accounts, receiving keys, and change keys. BIP39 is widely deployed, often with 12 or 24 words, but not every wallet uses BIP39.
The words, their order, the derivation method, script type, and any additional passphrase may all matter. Users should follow the exact recovery instructions for their wallet and never assume that every word-based backup is interchangeable.
Private Key vs Seed Phrase
Private Key
A single private key usually controls one corresponding public key and the outputs that require it. Importing an individual key may not restore the rest of a wallet, its labels, other addresses, or future derivation information.
Seed Phrase
A seed phrase often backs up the root of a deterministic wallet and can regenerate many keys. Because it may expose an entire wallet, it must be protected at least as carefully as the private keys derived from it.
What Are Extended Keys?
BIP32 hierarchical deterministic wallets combine a key with a chain code to create extended keys. An extended private key can derive a branch of child private and public keys. An extended public key can derive non-hardened child public keys without revealing the corresponding private keys.
Extended Private Key (xprv)
An extended private key can expose every descendant key in its branch. It must remain secret and should be treated as highly sensitive recovery material.
Extended Public Key (xpub)
An extended public key normally cannot spend funds, but it can allow software to generate addresses and monitor transactions across a wallet branch. Publishing it can reveal balances, transaction history, address relationships, and future receiving activity.
BIP32 also identifies a more advanced risk: possession of a parent extended public key together with a leaked non-hardened descendant private key can compromise the parent private branch. Hardened derivation is used to create boundaries against this class of exposure.
How HD Wallets Use Key Pairs
The wallet starts with a securely generated root seed.
It derives a master extended private key and corresponding extended public information.
Defined derivation paths create account, receiving, and change branches.
Each child private key produces a matching child public key.
Addresses or output scripts are created from the required public keys and policy.
The root recovery information can reconstruct the wallet when the same standards and configuration are used.
This design lets an online watch-only system generate fresh addresses from public information while an offline signer retains the private keys. It improves operational separation, but backup compatibility and xpub privacy still require care.
How Hardware Wallets Protect Private Keys
A hardware wallet is a dedicated signing device designed to keep private keys isolated from an ordinary internet-connected computer. A companion application prepares transaction data, while the device displays important details and creates the signature internally after approval.
The private key is not supposed to leave the signing environment. However, the user must still protect the recovery backup, buy authentic hardware, verify addresses on the device screen, update carefully, and avoid approving a malicious transaction.
Watch-Only Wallets and Public Keys
A watch-only wallet tracks addresses, balances, and transactions without holding the private keys required to spend. It may use individual public keys, extended public keys, scripts, or output descriptors.
Watch-only systems are useful for auditing, payment processing, and offline signing. They reduce direct theft risk on the monitoring device, but they can still expose financial privacy and must receive authentic public information from the correct wallet.
Multisignature and Multiple Keys
Not every Bitcoin output is controlled by one private key. A multisignature policy can require several signatures, such as two out of three authorized keys. This can reduce dependence on one device or person and support shared control.
Multisignature also increases operational complexity. A complete recovery plan may require seed backups, cosigner public keys, the script policy, derivation paths, and descriptors. Preserving only one seed phrase may not be enough to reconstruct the arrangement.
Who Controls the Private Key?
Non-Custodial Wallet
In a non-custodial setup, the user or a signing arrangement chosen by the user controls the keys needed to spend. This provides independence but creates direct responsibility for backup, device security, authentication, and recovery.
Custodial Service
A custodian usually controls the on-chain private keys and records customer balances internally. The customer depends on the custodian’s security, solvency, policies, access controls, and legal environment.
Controlling an account login is not always the same as controlling the on-chain private keys.
What Happens If a Private Key Is Lost?
If the only private key and every valid recovery method are lost, the associated Bitcoin may remain recorded on the blockchain but become practically unspendable. Bitcoin has no central administrator who can reset the key.
Losing a phone or hardware wallet is not necessarily fatal if a complete compatible backup survives. Losing both the signing device and the only recovery information can cause permanent loss of access.
What Happens If a Private Key Is Stolen?
A stolen private key should be treated as a critical compromise. An attacker may be able to sign and broadcast a transaction without the original device or the owner’s permission.
If the affected user still has access, the normal response is to create a secure wallet with entirely new key material and move funds as safely and promptly as circumstances permit. Changing an app password does not make an exposed private key safe again.
Does a Wallet Password Protect the Private Key?
A wallet password or device PIN may protect local access to a wallet file, application, or signing device. It can reduce risk if the encrypted device is stolen, but it does not replace the key or recovery backup.
If an attacker already has the seed phrase or raw private key, changing the local password does not change the compromised secret. Likewise, a password alone may not restore the wallet after device failure.
Key Reuse and Bitcoin Privacy
Reusing the same public key or address makes payments easier to link. It can connect customers, balances, and transaction history even when a real name is not written on the blockchain.
Use a fresh receiving address for each payment when practical.
Avoid publishing extended public keys or complete wallet address lists.
Understand which addresses a watch-only service or backend can observe.
Preserve labels and wallet metadata without exposing them publicly.
Remember that Bitcoin is pseudonymous, not automatically anonymous.
Essential Private-Key Security Practices
Never share a private key, seed phrase, extended private key, or recovery file.
Generate keys with reputable software or hardware and strong randomness.
Keep recovery information offline and protected from theft and physical damage.
Verify recipient addresses and amounts on a trusted display before signing.
Use strong device security and authentic wallet software.
Start with a small test transaction when using a new wallet or recovery setup.
Separate everyday spending keys from long-term savings when appropriate.
For large or shared holdings, consider a carefully designed multisignature or professional custody arrangement.
Create a tested inheritance and emergency-recovery plan.
Common Misconceptions About Bitcoin Keys
‘A Bitcoin address is a public key.’
Not always. An address encodes information for constructing an output script. Some address types commit to a public-key hash, while Taproot addresses commit to an output key and script-hash addresses can represent more complex conditions.
‘A seed phrase is one private key.’
Usually false. In many deterministic wallets, the seed phrase recreates a seed from which an entire tree of private and public keys is derived.
‘A public key can spend Bitcoin.’
A public key verifies a signature but does not normally create one. Spending requires satisfying the output conditions, often with a signature produced by the corresponding private key.
‘WIF encrypts a private key.’
False. WIF is an error-resistant encoding with version information and a checksum. It can be decoded and must remain secret.
‘A wallet password can recover every wallet.’
No. A password may unlock a local wallet, while recovery can depend on a seed phrase, private keys, descriptors, derivation paths, cosigner data, or a custodian’s account process.
‘Sharing an xpub has no risk because it cannot spend.’
An xpub usually cannot spend by itself, but it can reveal a large branch of wallet addresses and transaction history. Some key-derivation exposures also make extended-key handling more sensitive than ordinary public-key sharing.
XTS Perspective
At XTS, we view public-key cryptography as the bridge between personal authorization and decentralized verification. Private keys allow a holder to create valid signatures; public keys allow thousands of independent Bitcoin nodes to check those signatures without receiving the secret.
The most important practical lesson is not simply ‘never share your key.’ Users should understand which secret protects a single output, which backup can recreate an entire wallet, who controls the on-chain signing authority, what an extended public key reveals, and what information is required for recovery.
Strong cryptography cannot compensate for weak key generation, phishing, careless backups, malicious transaction approval, or misunderstood custody. Education turns abstract mathematics into safer everyday decisions.
Frequently Asked Questions (FAQ)
What is the difference between a public key and a private key?
A private key is secret signing material used to authorize spending. A public key is derived from it and is used to verify signatures.
Can someone calculate my private key from my public key?
With correctly generated secp256k1 keys and current methods, deriving the private key from the public key is considered computationally infeasible.
Is a Bitcoin address the same as a public key?
No. An address is an encoding that helps create an output script. Depending on its type, it may represent a public-key hash, script hash, or Taproot output key.
Can I share my public key?
A standard public key is not a spending secret, but sharing or reusing it can reduce privacy. Extended public keys should be shared only when their monitoring and privacy implications are understood.
Can I share my Bitcoin address?
Yes. Addresses are designed to be shared for receiving payments. Use a fresh address when practical and verify it through a trusted channel.
What happens if someone gets my private key?
They may be able to spend the associated funds. Treat the key as compromised, create fresh key material, and move funds safely if access remains.
Is a seed phrase the same as a private key?
Not usually. A seed phrase often recreates a seed that derives many private keys. It can expose an entire wallet rather than one key.
What is the difference between xpub and xprv?
An xprv is an extended private key that can derive descendant private keys. An xpub derives non-hardened descendant public keys and can monitor activity but normally cannot spend by itself.
Do Taproot addresses use public keys?
A Taproot P2TR address commits to a 32-byte x-only output key. Spending can occur through a valid key-path signature or, when committed, a revealed script path.
Can Bitcoin keys be reset?
There is no central Bitcoin password-reset authority. A wallet can move funds to newly generated keys if the old keys still work, but lost keys cannot be reset by the network.
Conclusion
Bitcoin’s key system makes decentralized authorization possible. A private key creates signatures and must remain secret. The corresponding public key lets the network verify those signatures without learning the private key.
The simple private-key-to-public-key relationship sits inside a broader wallet system. Addresses encode spending destinations, seed phrases may recreate many keys, extended keys support hierarchical wallets, hardware devices isolate signing, and multisignature policies can distribute authority across several keys.
Understanding these distinctions helps users protect backups, evaluate custody, preserve privacy, and recover wallets correctly. The mathematics is powerful, but secure Bitcoin use ultimately depends on careful key management.
Key Takeaways
- A private key is secret data used to authorize spending signatures.
- A public key is mathematically derived from a private key and verifies signatures.
- Deriving a private key from a correctly generated public key is considered computationally infeasible.
- A Bitcoin address is not identical to a private key or always identical to a public key.
- ECDSA is widely used in Bitcoin; Taproot key-path spending uses BIP340 Schnorr signatures.
- Seed phrases often restore entire deterministic key trees, not one key.
- Extended private keys can expose a wallet branch; extended public keys can expose privacy.
- Hardware wallets isolate signing but do not remove backup, phishing, or user-error risks.
- Lost keys may make Bitcoin inaccessible, while stolen keys may allow unauthorized spending.
- Secure randomness, offline backups, careful verification, and tested recovery are essential.
Leave a Reply