Public and Private Keys Explained

The pair

Crypto ownership rests on a pair of mathematically linked numbers. The private key is a secret number. The public key is derived from it, and your address is derived from the public key.

The derivation runs one way only. Anyone with your private key can compute your address; nobody with your address can compute your private key. That asymmetry is the whole basis of the system.

What each one does

	Public key / address	Private key
Purpose	Receiving funds	Authorising spending
Safe to share?	Yes	Never, under any circumstances
Can be recovered?	Derived from the private key	No — if lost, funds are gone
Looks like	bc1q… or 0x…	A long secret number or a seed phrase

What signing actually means

When you send crypto, your wallet uses the private key to produce a digital signature over the transaction. The network verifies that signature against your public key.

The important detail: the private key itself is never transmitted. The signature proves you hold the key without revealing it, and it is specific to that exact transaction — it cannot be lifted and reused for a different one.

"Not your keys, not your coins"

When you hold crypto on an exchange, the exchange holds the private keys. Your balance is an entry in their database, and your claim is contractual rather than cryptographic.

That is not automatically wrong — it is how every bank account works, and exchanges provide real services. But it means your funds depend on the exchange remaining solvent, honest and operational. History has repeatedly shown that assumption failing.

Practical implications

Never enter a private key or seed phrase into a website. No legitimate service ever needs it. This single rule prevents most losses.
Sharing an address is safe. Posting it publicly reveals your transaction history, but not control.
A private key is bearer ownership. Whoever holds it owns the funds, with no further authentication.
Addresses are chain-specific. Sending an asset to an address on the wrong network is a common and often unrecoverable mistake.

Why you rarely see the private key

Modern wallets show you a seed phrase rather than raw private keys. The seed deterministically generates many key pairs, so one backup covers every address the wallet will ever create. The seed is therefore at least as sensitive as any individual private key — it is all of them at once.

Hardware wallets

A hardware wallet keeps the private key on a dedicated device that never exposes it to your computer. Transactions are signed on the device itself, so malware on your machine cannot extract the key. For meaningful amounts this is the standard answer, and the reason it works is precisely that the key never leaves.

Addresses are derived, not registered

There is no central registry of crypto addresses. An address exists because someone generated a key pair, and the network has no record of it until a transaction involves it.

This is why a wallet can generate a new address instantly while offline, and why there is no "account opening" step. It also means a typo in an address usually produces a valid-looking address that nobody controls — which is why funds sent to a mistyped address are generally unrecoverable rather than bounced back.

Most address formats include a checksum, so a single mistyped character is normally detected by the wallet. That protection is real but not complete, and it does not help at all if you paste an address that was substituted by malware.

Address poisoning and clipboard attacks

Two common attacks target exactly this gap between what you intend and what you sign:

Clipboard hijacking — malware watches for a copied address and swaps it for the attacker's.
Address poisoning — an attacker sends a tiny transaction from an address resembling one you use, hoping you later copy theirs from your history.

The defence for both is the same: verify the full destination address before signing, and on a hardware wallet verify it on the device screen rather than the computer's.

One key, many chains

The same private key can control addresses on several networks, which is why one seed phrase restores balances across chains in a multi-chain wallet.

It also creates a specific hazard: an address that looks identical across two EVM networks may hold different assets on each, and sending a token to the right address on the wrong network is among the most common ways funds are lost. Recovery is sometimes possible where you control the key on both chains, and impossible where the destination is an exchange deposit address that only monitors one network.