What are private keys and public keys? They’re the “keys” to keeping your crypto safe. This guide explains these everyday parts of your crypto experience.
What is a public key?
A public key is like your bank account number — it’s the address where other people can send you bitcoin. You can share it freely without any security risk. When someone wants to send you crypto, they send it to your public key (also called a public address).
Public keys are mathematically derived from private keys, but this derivation is a one-way function: you cannot work backward from a public key to discover the private key.
What is a private key?
A private key is like your bank PIN or password — it proves you own the funds associated with a public key and authorizes transactions. Never share your private key with anyone. Anyone who has your private key has full, irreversible control over your funds.
A private key is a randomly generated 256-bit number, typically displayed as a 64-character hexadecimal string. In practice, most users never directly interact with their private key — their wallet software manages it, and access is protected by a PIN or password.
How are public and private keys related?
A key pair is generated together using cryptographic algorithms. The relationship works like this:
- The private key is generated randomly first.
- The public key is mathematically derived from the private key.
- Your wallet address (what you share with others) is derived from your public key.
This system is called asymmetric encryption and is the foundation of how Bitcoin and most other cryptocurrencies work.
How do you keep your keys safe?
- Use a hardware wallet for any significant amount — it keeps your private key offline and out of reach of hackers.
- Back up your seed phrase — the human-readable backup of your private key. Store it physically in multiple secure locations.
- Never enter your private key or seed phrase online — no legitimate service will ever ask for it.
- Be wary of clipboard hijacking — malware can replace copied wallet addresses with the attacker’s address. Always double-check the full address before confirming a transaction.
