Public Keys

Every private key has a partner: a public key. It's the half you can hand out freely. It proves the coins are yours without ever exposing the secret. If you've read Private Keys, this is the natural next step in the chain.

Derived From the Private Key

Your public key isn't chosen. It's computed from your private key with a single operation:

public key = private key × G

Here G is the generator point, a fixed starting spot on Bitcoin's elliptic curve (secp256k1). The "×" isn't ordinary multiplication, though. It's a special elliptic-curve operation that "bounces" around the curve a number of times set by your private key, landing on a new point. That point is your public key.

A Point on the Curve

So a public key is literally a point, an (x, y) coordinate on the curve. There are a few ways to write it down:

• Uncompressed: 04 followed by both coordinates (x then y). 130 hex characters (65 bytes). The old way.
• Compressed: a 02 or 03 prefix followed by just the x coordinate. 66 hex characters (33 bytes), and the modern standard. Since the curve is y² = x³ + 7, knowing x gives you two possible y values; the prefix just says which one (02 = even, 03 = odd). Half the size, same key.
• X-only: just the x coordinate, used by Taproot. Smaller still.

The One-Way Wall

Going forward, from private key to public key, is fast and easy. Going backward is the catch. Recovering the private key from the public key would mean solving the elliptic-curve discrete logarithm problem, which is computationally infeasible even with all the world's computers. This is what cryptographers call a trapdoor function: easy one way, effectively impossible the other. It's the wall that lets you publish your public key without putting your coins at risk.

What Your Public Key Does

The public key has one core job: proving ownership. When you spend, your wallet uses the private key to produce a signature over the transaction. Anyone on the network can then check that signature against your public key, confirming the coins are yours to move, while the private key itself never appears. The public key is also the input that gets hashed into your address (see Keys & Addresses).

Public, But Not Always Visible

Here's a subtle privacy point. An address is a hash of your public key, so when you receive coins, your public key isn't actually revealed on-chain. Only the address is. The public key only becomes visible when you spend. That's one more reason wallets use a fresh address for every payment: it keeps your public keys (and the links between your coins) private for as long as possible.