Private key and public key: 256 bits decide who owns your coins

A private key is a secret number. Anyone who knows it can spend the coins held at an address. Anyone who does not cannot, no matter how much computing power they bring. The public key is its open counterpart: it is calculated from the private key, may appear anywhere and still gives the secret away. This one-way street is the whole trick behind Bitcoin and every other blockchain that works without a bank.

Ownership in this system does not mean that a name sits in a register. Ownership means that someone can produce a valid signature. That is exactly why a lost key is lost for good and a copied key is dangerous at once.

A private key is a number with 78 digits

Technically, a Bitcoin private key is a random number between 1 and just under 2 to the power of 256. Written out, that upper limit has 78 decimal digits and starts with 115,792,089. It sounds like a game with large numbers, but it has a practical consequence: guessing is not an attack method. There is no stock of keys that would eventually be worked through.

Seed, private key, address: these three terms often get mixed up, yet they describe three stages of the same calculation. The seed is the origin from which any number of private keys can be derived. Each private key produces exactly one public key. And from the public key comes the address, the one you hand out when someone is to send you coins.

A key is not something stored somewhere in the blockchain. The blockchain holds only addresses, amounts and signatures. The private key exists solely where you keep it: in a hardware wallet, in an app on your phone, on a piece of paper or in an exchange's database.

From the number to the public key: the one-way street on secp256k1

The calculation that turns the private key into the public key is called point multiplication on an elliptic curve. Bitcoin has used the secp256k1 curve for this since 2009. Put simply, there is a fixed starting point on that curve, and your private key says how often this point is combined with itself. The result is a new point, and that point is your public key.

In one direction, the operation takes a computer microseconds. The reverse, working back from the end point to the number of steps, is the discrete logarithm problem on elliptic curves. As things stand, no practical method is known that solves it on classical computers in any sensible time. The security of every balance rests on exactly that.

Ethereum uses the same curve but derives its addresses differently from Bitcoin. That is why Bitcoin addresses and Ethereum addresses do not fit each other, even though the mathematics underneath is identical. Send coins to an address on the wrong blockchain and they are usually gone, because nobody there can produce a matching signature.

The address is a fingerprint of the public key

What you copy as a receiving address is, in Bitcoin, not the public key itself but a hash of it. The public key is passed through two hash functions, and what remains at the end is a 160-bit value, which is then encoded into a readable string of characters. An address is therefore a kind of fingerprint.

This intermediate step has a consequence that surprises many people: as long as you have not spent anything from an address, your public key appears nowhere in public. It becomes visible only with the first spend, because the signature has to be verifiable and the network needs the public key for that. Before then, the blockchain knows only the hash.

The difference in size also explains why address collisions are not a realistic avenue of attack. Every 160-bit fingerprint corresponds, arithmetically, to around 7.9 times 10 to the power of 28 different private keys. That is an unimaginable number of matches in theory and zero reachable matches in practice, because finding even a single fingerprint exceeds the world's computing capacity.

Two keys, one proof: how the signature works

A transfer in a blockchain is a record that says: these amounts from these addresses go to that address. For the network to accept it, the record has to be signed. The signature arises from the private key and the content of the transaction. Anyone on the network can then use the public key to check that this signature can only have come from the matching private key, without ever seeing the key.

Satoshi Nakamoto described this principle in the Bitcoin white paper of 2008 as a chain of ownership proofs: each owner signs the handover to the next, and the signatures stay verifiable forever. A bank that keeps accounts and confirms entries becomes superfluous as a result.

The difference from a password matters. A password you send to a service, which checks it, and from then on the service has seen it. A private key ideally never leaves the device it sits on. A hardware wallet does exactly that: the unfinished transaction goes in, signing happens inside the device, and only the signature comes out. Which device handles that how is shown in our hardware wallet comparison.

Twelve or 24 words produce all of your keys

Nobody writes down a 78-digit number by hand. That is why almost all wallets today work with a seed phrase under the BIP39 standard: twelve or 24 words from a fixed list of 2,048 terms. This sequence of words is the human-readable form of a random value, from which the wallet then calculates.

The second standard, BIP32, governs what happens next. The seed produces a master key, and from it any number of further key pairs are derived in a tree structure. In practice that means a single sequence of words carries every address in your wallet, including those that will only be generated two years from now. That is why a lost wallet can be fully restored from the seed phrase, and why a photo of those words is enough to clear out a balance.

How the first minutes with a new wallet unfold, and which steps really count, is set out in our guide to creating a Bitcoin wallet. With software wallets, the seed sits encrypted on the device itself, protected only by the app's password and the security of the system underneath.

The xpub shows every address and hands over no coin

Out of the BIP32 tree structure comes a tool that is little known and remarkably useful: the xpub, the extended public key. It allows every address in a wallet branch to be calculated and their balances read, without enabling a single spend.

With it you can watch the holdings of a hardware wallet on a computer that has never seen the seed, or give a tax program read access to your history. The price is privacy: whoever holds your xpub sees every movement in that branch, past and future. An xpub therefore does not belong in a public document, even though it cannot move any money.

At an exchange, the provider holds the key

If you buy coins at an exchange and leave them there, you own no private key. You own a claim against the company, and the company owns the keys. Your coins are on the provider's balance sheet; in your account there is a number.

The European crypto regulation MiCA treats precisely this as a service in its own right: the custody of crypto-assets and of the means of access, meaning the private keys, requires authorisation. Providers need a licence as a crypto-asset service provider, granted and supervised in Germany by BaFin. The duties that come with it are set out in our overview of the MiCA obligations for crypto companies.

That supervision changes nothing about the technical position. A licence obliges the custodian to segregate client holdings, to hold own funds and to bear liability, but its infrastructure still produces the signature. If access fails, an account is frozen or the provider runs into trouble, what you are left with is legal recourse and not the key. Custody at a regulated provider and custody in your own hands therefore solve different problems, and many investors split their holdings between the two.

Taproot brought Schnorr signatures to the Bitcoin network in 2021

Bitcoin signed with the ECDSA scheme from the outset. With the Taproot update, active since November 14, 2021 and block 709,632, a second scheme joined it: Schnorr signatures under the BIP340 standard. These signatures sit on the same secp256k1 curve but are always exactly 64 bytes long, and the public key shrinks to 32 bytes.

The gain lies in a property ECDSA lacks: Schnorr signatures can be added together. Several parties can jointly produce a single signature that looks to the network like that of one individual user. A wallet requiring three signatures can thus be run more cheaply and less conspicuously than before. For your day-to-day use it mainly means that newer address formats incur smaller fees, because the signature needs less space.

Quantum computers target the public key, not the seed

The worry about quantum computers is often told the wrong way round. What would be vulnerable is the path from the public key back to the private key, not the seed phrase and not the address. A sufficiently large quantum computer could solve the discrete logarithm problem on which secp256k1 rests. The balances first at risk are therefore precisely those whose public key already sits in the open in the blockchain, meaning all those that have been spent from before.

How large that share of the supply is, we counted on October 21, 2026 in our analysis of the Quantum Alliance: 6.04 million Bitcoin with an exposed public key were recorded there. Moving to a fresh address that has never been spent from removes this avenue of attack again, because only the hash is then visible.

Replacement schemes already exist. In August 2024, the US standards institute NIST published FIPS 204, a signature standard considered secure against quantum computers as well. For Bitcoin, though, switching would be a protocol change the network first has to agree on, and the new signatures need considerably more space than 64 bytes. No date has been set.

Four ways in which keys get lost

The weak point almost never lies in the mathematics. What decides the outcome is storage, and the patterns repeat themselves:

First, the copy on the internet. A seed phrase as a photo in the cloud, in a notes app or in a chat is exactly as secure as the account it sits in. One compromised login is enough.

Second, entering it in the wrong place. Type your words into a cloned website or a planted app and you have handed the key over voluntarily. A genuine wallet asks for the seed phrase only when restoring, never to unlock a withdrawal or a bonus.

Third, the single medium. Paper burns, a stick dies, a device goes missing. Without a second copy in another place the balance is gone, and nobody can bring it back.

Fourth, unsettled succession. If the owner dies without the heirs knowing where the words are, the holdings stay in the blockchain for good. They are then visible and out of reach.

The same idea helps against the first three points: the key exists at least twice, physically and without a network connection. For larger holdings, a multisig wallet requiring several signatures spreads the risk across several places and people as well.

Securing a private key: two copies in two places, neither of them online

Three steps that settle your position in half an hour:

1. Check where your keys sit today. Write down which part of your holdings sits with a provider and which sits in a wallet whose seed you hold yourself. For the provider part, authorisation is the decisive question, and which trading venues can show a European licence is set out in our overview of regulated crypto exchanges.
2. Make a second copy of your seed phrase. Handwritten or stamped into metal, in a different place from the first, with no photo and no cloud. A hardware wallet from the comparison keeps the key inside the device, so that it cannot leak from an infected computer.
3. Test the restore before you need it. Set up a wallet with a small amount, delete it and restore it from the words alone. Only that attempt proves your note is complete and correct. Which programs are suited to it is set out in our software wallet comparison.

(As of October 25, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)