Public and Private Keys: The Math That Owns Your Coins
A plain-English guide to the two keys behind every Bitcoin wallet: how a private key is created, how the public key and the address are derived from it, and how a signature proves control without revealing the secret. It also covers where the real weak points are (bad randomness, scams that ask for the key and, if one is ever built, a large quantum computer) and what "not your keys, not your coins" means in practice.
Category: Security and Scam Prevention · Published 2026-10-28
Editorial review complete · technical review pending · sources under review What does this mean?
Editorial review covers clarity and neutrality. Technical, security, and source reviews indicate whether an article's material claims were checked against relevant authoritative material. A source link being available does not by itself mean every claim has been verified. A reviewed status means the article's material claims were examined; it does not mean the article is exhaustive or that future protocol, market, or software changes cannot make it outdated.
A lock that opens one way
Most locks we know are symmetric: the same key shuts the door and opens it. Bitcoin uses something stranger and far more useful, called asymmetric cryptography. Here there are two keys, mathematically bound together at birth, and each has its own job: the private key signs, and the public key lets anyone check that signature.1 The link runs one way only. The public key is easy to work out from the private key, but knowing the public key does not let you work out the private one.
This sounds like a paradox, but you already trust a one-way version of it. Mixing two paint colours is easy; un-mixing them to recover the originals is practically impossible. Bitcoin's keys lean on the same kind of asymmetry, built from numbers rather than pigment: a calculation that is quick to do in one direction and, for the computers that exist today, hopelessly hard to reverse. That single property is what lets strangers across the world agree on who can spend what, with no bank, no password reset, and no one to ask for permission.
The private key is just a number
Strip away the mystique and a private key is simply an enormous random number. Not a clever phrase, not a chosen password: a 256-bit value, which can be almost any whole number from 1 up to about 1.16 × 10⁷⁷, a range so vast it is hard to picture.2 Its only special quality is that it is yours, and that nobody else has ever seen it.
Because it is just a number, your wallet does not need to phone home to create one. It can generate a private key entirely offline, in a fraction of a second, from 256 bits of random data.1 As long as that randomness is good, the odds of two people ever landing on the same key are so remote that the whole system rests on it. The randomness is not a detail: in August 2013, a weakness in the random-number generator built into Android left wallets created by Android apps open to theft, and the affected apps shipped updates that moved users' coins to fresh keys.3
The number is what gives control. The public key and the address are worked out from it, and the coins recorded on the ledger can be spent only with a signature it makes. Guard it and you keep control of your coins. Lose it, and every backup of it, and they are simply gone, with no helpdesk able to conjure it back.
From private key to public key to address
From the private number, your wallet computes a public key using a one-way mathematical step: Bitcoin uses elliptic curve cryptography, on a curve called secp256k1.1 The direction matters enormously. Deriving the public key from the private key is instant, but going backwards, from the public key to the private one, is what makes the whole scheme safe. No one has a practical way to do it with today's computers. A large enough quantum computer could in principle, and standards bodies are already preparing quantum-resistant replacements, though no such machine has been built.4 How quantum computing could affect Bitcoin explains which parts of Bitcoin such a machine would and would not affect.
The address you actually share, the string someone pastes to pay you, is derived from the public key. For the hash-based address types, including native SegWit addresses that start bc1q, that step is a cryptographic hash, so the public key itself appears on the blockchain only when you spend.16 Taproot addresses, which start bc1p, are the exception: they carry a public key directly.56 So the chain flows in a single direction:
- Private key: the secret number you never reveal.
- Public key: derived from it, used to check your signatures.
- Address: derived from the public key, safe to hand out freely.
Each arrow is easy to follow forward and, as far as anyone can manage today, impossible to walk back. That is why publishing your address exposes nothing that leads to the secret controlling your coins, whether the address holds a hash of your public key or the key itself.
Signing: proving it is you without showing the secret
Owning coins is not enough; you have to prove ownership every time you spend, and prove it to a network of strangers who will never meet you. This is the elegant part. When you send bitcoin, your wallet uses the private key to produce a digital signature over the details of that transaction: which coins are being spent, how much, and to whom.17
The signature is tied to both your key and that precise transaction. Anyone can take your public key and check that the signature is genuine, yet the check reveals nothing about the private key itself, provided the wallet signs with good randomness; weak or exposed randomness in signing is the main known way a signature can give a key away.1 It is like a wax seal the whole world can confirm came from your ring, while the ring never leaves your pocket. Under the default signing mode wallets use, changing a single detail of the transaction breaks the signature, so no one can quietly redirect your payment after the fact.1 Bitcoin signs with ECDSA and, since the Taproot upgrade, also with Schnorr signatures; the principle is the same.5 You prove control of the coins without ever exposing the thing that grants it.
Why you never share the private key
Once you see that the private key alone can sign, the golden rule explains itself. Whoever can produce a valid signature can move the coins, and only the private key can produce one. So sharing it is not like sharing a password you can later change. It is handing over the ability to spend, permanently and silently, to anyone who now holds a copy; the only defence left is to move the coins to new keys before they do.
This is why honest services ask for an address, or at most a public key, and no one with a genuine reason will ask you to reveal a private key or the recovery phrase that generates it. Any message, site, or support agent that asks you to type your private key or recovery words is trying to take your coins, full stop. Breaking the mathematics is not the practical attack; getting a person to reveal the secret is. Write it down, keep it offline, and treat it as the one thing you never paste anywhere.
Not your keys, not your coins
Put it all together and the famous phrase stops being a slogan and becomes a plain description of how the system works. The Bitcoin network does not record names or accounts. It records that certain coins can be unlocked by whoever meets their conditions, usually a valid signature from a particular key.17 Control of the private key is control of the coins; there is no separate registry of who you are.
When you leave coins with a custodian, the custodian holds the keys and promises you a balance, and you rely on its security and honesty.8 When you hold your own keys, no promise sits between you and your money, but no safety net does either. That trade-off is the real meaning of self-custody, and it applies to mining payouts too: a pool that pays to an address you control leaves the keys with you, while one that keeps a balance for you holds them until it pays out. The math is impartial, and it always sides with whoever holds the key.
FAQ
What is the difference between a public key and a private key?
The private key is a secret random number that you keep to yourself and use to sign transactions. The public key is derived from it and lets others verify those signatures. You can derive the public key from the private one instantly, but not the reverse, which is what keeps the secret safe even after you share things derived from it.
Is my Bitcoin address the same as my public key?
Not quite. For hash-based address types, including native SegWit addresses that start bc1q, the address is derived from the public key by an extra step of cryptographic hashing, and the public key only becomes visible on the blockchain when you spend. Taproot addresses, which start bc1p, are the exception: they contain a public key directly. Either way, neither the address nor the public key reveals your private key.
Why is it safe to share my Bitcoin address but not my private key?
An address is derived from your keys by one-way steps, so giving it out reveals nothing that could be reversed back into the secret. The private key, by contrast, is the one thing that can sign transactions. Anyone who has it can spend your coins, which is why it must never be shared.
What is a digital signature in Bitcoin?
It is a proof, generated with your private key, that you authorize a specific transaction. The network checks it against your public key to confirm it is genuine, without ever learning the private key. Under the default signing mode wallets use, if any detail of the transaction changes, the signature no longer matches, so payments cannot be altered after signing.
What does "not your keys, not your coins" actually mean?
Bitcoin records which keys can unlock which coins, not which person owns them. So whoever controls the private key controls the coins. If a custodian holds the key, you are trusting its promise; if you hold it yourself, you control the coins directly, with no third party and no safety net in between.
Key takeaways
- A private key is a 256-bit random number, and the public key and address are derived from it by steps that cannot practically be reversed.
- Spending needs a digital signature made with the private key, which anyone can check with the public key without learning the key.
- Hash-based addresses hide the public key until you spend, while Taproot (bc1p) addresses contain a public key; neither reveals the private key.
- Good randomness matters: a weak random-number generator exposed Android wallets in 2013.
- Whoever holds the private key controls the coins, so no genuine service ever needs it or your recovery phrase.
Sources
- Bitcoin Developer Guide, Transactions: ECDSA on the secp256k1 curve, private keys as 256 bits of random data, the public key hashed into an address, the full public key revealed only when spending, signatures covering the transaction (SIGHASH_ALL by default), and signature attacks that work only when signing randomness is weak or exposed — Bitcoin Project (developer.bitcoin.org)
- Bitcoin Developer Guide, Wallets: a private key in standard format is a 256-bit number between 0x01 and 0xFFFF...4140 (just under 2^256), set by the secp256k1 standard; public keys are points on that curve — Bitcoin Project (developer.bitcoin.org)
- Android Security Vulnerability (11 August 2013): weaknesses in Android's secure random-number generator left wallets generated by Android apps vulnerable to theft, and the apps moved users' coins to new keys — bitcoin.org
- Post-Quantum Cryptography project: if large-scale quantum computers are ever built, they will be able to break many of the public-key cryptosystems in use today, so NIST is standardising quantum-resistant replacements — National Institute of Standards and Technology (NIST)
- BIP-341, Taproot: SegWit version 1 outputs whose 32-byte witness program is a public key (the taproot output key), spent with Schnorr signatures; activated on mainnet at block 709,632 — Bitcoin Improvement Proposals (GitHub)
- BIP-350, Bech32m: version 0 SegWit addresses (P2WPKH and P2WSH, beginning bc1q) keep Bech32, while version 1 and later addresses such as Taproot (beginning bc1p) use Bech32m — Bitcoin Improvement Proposals (GitHub)
- Bitcoin: A Peer-to-Peer Electronic Cash System (the Bitcoin whitepaper), section 2: a coin as a chain of digital signatures, each owner signing the transfer to the next owner's public key — bitcoin.org
- Securing your wallet: when a third party controls your keys you rely entirely on its security and honesty, and exchanges and online wallets have been hacked, failed or frozen access to funds — bitcoin.org