Public and Private Keys: How Bitcoin Proves Ownership

Public and private keys are a pair of cryptographic keys, called a key pair. The private key is a secret value that creates digital signatures. The public key is derived from the private key, can be shared openly, and lets anyone verify a signature without learning the secret. In Bitcoin, controlling the private key is what makes it possible to spend BTC.

How Do a Private Key and a Public Key Fit Together?

A private key is a secret value that creates digital signatures. Whoever knows the private key can sign for the matching public key, so the owner keeps it and shares it with no one.

A public key is calculated from the private key by a one-way mathematical operation. The two keys together are called a key pair, which some writers spell “keypair.” A key pair is generated so that deriving the private key from the public key is designed to be computationally infeasible, which is why the public key can be shared openly. The table below sums up which of the public and private keys is shared and which is kept.

Key	Who may know it	What it does
Private key	Only its owner	Creates digital signatures
Public key	Anyone	Verifies signatures made with the matching private key

The field that uses key pairs is called public-key cryptography, or asymmetric cryptography, because the two keys are different and do different jobs. A key pair can be used to sign data or to encrypt it. Symmetric cryptography, by contrast, uses one shared key both to encrypt data and to decrypt it. That single key is often called a “secret key.”

How Do Bitcoin Keys Work When You Spend BTC?

Bitcoin keys work through digital signatures. On the Bitcoin blockchain, BTC exists as outputs, which are amounts of BTC locked by a condition. In the simplest case, the condition is a valid signature from the key tied to the output, so controlling BTC means being able to produce that signature.

Spending BTC with a key pair takes four steps:

1. The wallet, which is software that stores the private key, signs the transaction with the private key.
2. The wallet broadcasts the signed transaction to the Bitcoin network.
3. Nodes, which are computers that connect to the Bitcoin network, check the signature against the public key.
4. The check passes or fails, and the signature does not reveal the private key.

Creating a valid signature requires the private key, and checking one requires only the public key. The signer is therefore the holder of the private key, while the verifier can be anyone. A signature authorizes the spend of one specific output and, by default, covers the transaction’s details: the output being spent, the destination, and the amount.

Bitcoin uses key pairs to sign transactions, not to encrypt data. The transactions themselves are public on the blockchain, so a signature shows that someone holding the private key authorized a spend and does not hide the payment. Bitcoin accepts two signature schemes, the elliptic curve digital signature algorithm (ECDSA) and Schnorr signatures.

How Does Bitcoin Create a Key Pair?

A wallet creates a key pair by picking a private key at random. A Bitcoin private key is a 256-bit number, which means it takes 256 bits, or 32 bytes, to store. A valid private key runs from 1 up to just below a fixed limit called the order of the curve. That limit is slightly smaller than 2 to the power of 256, so nearly every 256-bit number is a valid private key.

Bitcoin uses the secp256k1 elliptic curve, a fixed set of mathematical constants that Bitcoin software shares. The public key is calculated from the private key with a one-way calculation on this curve, starting from a fixed point on the curve. A Bitcoin public key takes 33 bytes in its compressed form: one prefix byte followed by 32 bytes. Taproot, a different address type described in the next section, uses a 32-byte key instead.

The block below shows how a private key, a public key, and a common single-key address relate. The entries in angle brackets are labeled placeholders for the kind and size of each value, not real values. Each line is calculated from the line above it by a one-way step.

private key: <256-bit secret number, 32 bytes>
public key:  <compressed point, 33 bytes>
address:     <hash of the public key, encoded>

How Does a Bitcoin Address Come from a Public Key?

For the common single-key address types, a Bitcoin address is a payment identifier derived from a public key by hashing, so the address is not the public key itself. A single-key address is an address locked to one public key, and the two common types are the legacy type and the SegWit type. Hashing is a one-way calculation that turns an input of any practical length into a fixed-size output.

For a legacy or SegWit address, the wallet hashes the public key with SHA-256, a hash function, and then hashes that result with RIPEMD-160, a second hash function. The final result is 20 bytes long. A SegWit address uses this 20-byte result as it is, while a legacy address adds a version byte and a checksum and is written in an encoding called Base58Check.

Not every Bitcoin address type is built by hashing a single public key. Script-hash addresses hash a script, which is the condition that must be met to spend, instead of a key. Taproot addresses contain a 32-byte key directly rather than a hash of one.

For legacy and script-hash addresses that are not reused, the public key is not shown on the blockchain, only its hash, until the first time funds sent to that address are spent. The address is where BTC is received, and the private key is what spends it.

What Does a Wallet Hold, and Who Holds the Keys?

A Bitcoin wallet is a kind of crypto wallet: software that stores private keys and uses them to build and sign transactions. At its core, a wallet is a collection of private keys, not a store of BTC. The BTC itself is recorded on the blockchain as unspent transaction outputs (UTXOs). A UTXO is an output of an earlier transaction that has not been spent yet, so “my BTC is in my wallet” is a shorthand.

Self-custody means the owner holds the private keys. As long as no one else holds a copy of the keys, only the owner can spend the BTC, and the owner carries the risk of losing them.

A custodial wallet is a wallet in which a provider holds the private keys on behalf of the user. Whoever holds the private keys can spend the BTC locked to them, so self-custody and a custodial wallet differ in who that is: the owner in one case, the provider in the other.

Many wallets, called hierarchical deterministic (HD) wallets, can regenerate all their keys from one backup, usually a seed phrase.

What Happens If a Private Key Is Lost or Shared?

A private key cannot be changed or reset the way a password can. If no backup exists, access to the funds locked to that key is lost, because the outputs stay on the blockchain and no signature can be made to spend them.

Anyone who has a copy of the private key can sign and spend. A confirmed Bitcoin transaction is designed to be final, and that finality applies to a spend made with a copied private key as well.