Keys, addresses & seed phrases simply explained

Your bitcoin aren’t stored in an app – they are recorded in the blockchain. Only someone with the matching key can move them. If you hold them yourself, you hold that key: nobody can freeze it – but nobody can replace it either if you lose it along with its backup. If you leave your bitcoin on an exchange, the exchange holds the key (Understanding custody). You don’t need any maths for this – we explain everything with a picture from everyday life.

The principle: one key ring and many letterboxes

Imagine glass letterboxes: anyone can look inside and drop something in, but only someone with the matching key can open them. Bitcoin works with four building blocks:

• Private keyGlossaryPrivate keyA secret, randomly generated number that you use to sign transactions and so control your bitcoin. Anyone who knows the private key can spend the bitcoin that belongs to it – it must never fall into anyone else’s hands.On the learning path: Stage 5 · Step 3 – Backing up your seed phrase →In the glossary →× – a secret random number. You use it to sign transactions.^[1]
• Public keyGlossaryPublic keyCalculated from the private key and used to check your signatures. The calculation only works in one direction: the private key cannot be worked out from the public key.In the glossary →× – calculated from the private key. Anyone can use it to check whether a signature is genuine, without knowing the private key.^[1]
• AddressGlossaryBitcoin addressA string of characters like ‘bc1q…’ that someone can send bitcoin to. It is usually derived from a public key, can be shared without risk to your funds and should be generated afresh for every payment.On the learning path: Stage 5 · Step 4 – First withdrawal →In the glossary →× – derived from the public key (or from a script). You share it to receive bitcoin.^[1]
• Seed phraseGlossarySeed phrase (recovery phrase)A sequence of usually 12 or 24 words from which your wallet derives all its private keys. Anyone who knows the words has full access to your bitcoin – so they belong in an offline backup and never in anyone else’s hands.On the learning path: Stage 5 · Step 3 – Backing up your seed phrase →In the glossary →× – a list of words from which your wallet derives all its private keys: the backup for the whole key ring.^[2],[3]

So a wallet is a key ring with bookkeeping: it generates keys and addresses, searches the blockchain for balances and signs when you send something.

The private key: a very large random number

A private key consists of 256 bits of randomness.^[1] The number of possible keys is just under 2²⁵⁶ – a number with 78 digits.^[4] Guessing blindly at a quintillion (10¹⁸) keys per second, you would need more than 10⁵¹ years for a 50% chance of hitting one particular key (own calculation).

Two hard rules follow from this:

1. Whoever knows the private key can spend the bitcoin. There is no authority that can say ‘no’.
2. The randomness has to be real. Made-up keys (‘my birthday’, a song lyric) can be guessed. Always let a reputable wallet generate your keys.^[4]

Public key and address: the one-way street

From the private key, the wallet calculates the public key using the elliptic curve secp256k1. For 1…, 3… and bc1q addresses, a hash functionGlossaryHash (hash value)A fixed-length digital fingerprint that a hash function calculates from any data. Even the tiniest change produces a completely different value, and the original data can’t be worked out from the hash.On the learning path: Stage 1 · Step 3 – How does Bitcoin work? →In the glossary →× then turns it into the shorter address;^[1] a Taproot address (bc1p) contains a public key derived from it directly.^[10] Both steps are easy and always give the same result. Getting back to the private key is practically impossible with today’s technology.^[4]

It’s like mixing paint: turning blue and yellow into green is easy, getting blue and yellow back out of the green is not. That is why you can show your address without giving away your key.

Why your wallet keeps showing new addresses

The whitepaper already recommends a new key pair for every transaction, so that payments can’t easily be linked to one owner.^[5] If you reuse an address, others can easily trace its incoming payments, outgoing payments and balance.^[1] Old addresses remain valid, but modern wallets automatically show you a new one each time you receive. More on this in Privacy with Bitcoin.

Dive deeperWill the one-way street last forever?

Powerful quantum computers could one day calculate the private key from a visible public key. With most formats, the public key only becomes visible once bitcoin have been spent from the address; with Taproot (bc1p), it is visible as soon as you receive. Developers are working on countermeasures, such as BIP 360: a Taproot-like output type with no visible public key for as long as the bitcoin stay unmoved (status as of September 2026: draft).^[6] For you, this means: don’t reuse addresses, and keep your wallet software up to date. The wider assessment is in Criticism & risks.

Address formats: 1, 3, bc1q and bc1p

The beginning of an address tells you its format:

Starts with	Name	Standard	Since	What you should know
1…	Legacy (P2PKH)	Base58[1]	2009	Oldest format; with simple single-key wallets, spending from it costs the most
3…	Script hash (P2SH)	BIP 16[7]	2012	For multisig and the older SegWit variant (‘nested SegWit’)
bc1q…	Native SegWit	Bech32, BIP 173[8]	2017	No mixed upper and lower case, very good error detection, cheap
bc1p…	Taproot	Bech32m, BIP 350[9],[10]	2021	Newest standard, more privacy for complex spending conditions

• Error detection: In the data part, Bech32 addresses avoid easily confused characters such as ‘1’, ‘b’, ‘i’ and ‘o’, and they always detect up to four mistyped characters.^[8] Bech32m fixes a weakness of its predecessor and is used for Taproot addresses.^[9]
• Fees: The network fee depends on the size of the transaction, not on the amount. An input from a 1… address takes up around 148 vbytes, one from a bc1q address around 68 vbytes – so at the same fee rate you pay less than half for that part.^[11] More in Transactions & fees.
• Compatibility: In principle, you can send between all formats. If a platform doesn’t accept a format, have your wallet show you an address in a different format.

The seed phrase: the backup for all your keys

Since BIP 32, modern wallets derive a whole tree of keys from a single seed – always in the same order.^[2] That is why any compatible wallet finds the same addresses again from the same seed. So that you can write the seed down, BIP 39GlossaryBIP 39 (standard for seed words)The widely used standard that turns random data into 12 to 24 words from a fixed list of 2,048 words. Your wallet calculates all its keys from these words – BIP 39 is behind most seed phrases.On the learning path: Stage 5 · Step 3 – Backing up your seed phrase →In the glossary →× translates it into words.^[3]

2,048

words in the BIP 39 list

each word stands for 11 bits

12 or 24

usual length

128 or 256 bits of randomness plus a checksum

4

letters are enough

each word can be identified uniquely by them

1 in 16

random 12-word sequences is valid

because of the checksum (own calculation)

What matters:^[3]

• Checksum: It catches many typos, but not all – BIP 39 itself names the short checksum as a weakness. It is no substitute for copying the words carefully. Twelve words you make up yourself are usually invalid.
• Order: The same words in a different order produce a different, usually invalid phrase.
• Language: BIP 39 advises against non-English word lists, because most wallets only support the English one.

Passphrase: the optional ‘25th word’

You can also set a passphrase of your own choosing. Every passphrase produces a valid but different wallet. That protects you if someone finds only your words – but it also means: forget the passphrase and you lose access.^[3] When this is worth it is explained in The passphrase.

Dive deeperDerivation path and xpub: good to know for later

Which keys are created from the seed is determined by the derivation pathGlossaryDerivation pathThe route a wallet follows to calculate individual keys from your seed phrase, for example m/84'/0'/0'. If another wallet uses a different path when you restore, it looks empty – even though nothing has been lost.In the glossary →×: m/84'/0'/0' is common for bc1q addresses and m/86'/0'/0' for bc1p addresses.^[13],[14] If a wallet looks empty after recovery, often just a different path has been selected – the balance hasn’t gone. See Testing recovery.

The xpubGlossaryxpub (extended public key)An extended public key from which all the addresses of a wallet account can be calculated. Nobody can spend bitcoin with it – but anyone who knows it can see your entire account history.In the glossary →× (extended public key) enables watch-only wallets: they see all addresses and balances but cannot spend anything.^[2] Even so, don’t hand it out lightly. It reveals your entire payment history, and together with a single derived private key it can, under certain circumstances, expose the whole key branch.^[2]

What this means for you

1. Let the wallet generate the seed

   Only use seeds that your wallet or hardware walletTermHardware walletA small dedicated device that keeps your private keys offline and signs transactions internally.On the learning path: Stage 6 · Step 1 – Hardware wallets compared →In the glossary →AdManufacturers with a paid linkProviders from our comparisonBitBox02Hardware wallet · SwitzerlandVisit BitBox* (paid link, opens in a new window)Trezor SafeHardware wallet · Czech RepublicVisit Trezor* (paid link, opens in a new window)Blockstream JadeHardware wallet · Canada/USAVisit Blockstream Jade* (paid link, opens in a new window)All 6 compared – including non-partners →Only buy hardware wallets from the manufacturer or an authorised reseller.*Paid link: if you sign up or buy through it, we earn a commission. Your price stays the same. How we make money →× generates itself. If a device comes with words already supplied, it’s a scam.

2. Back up the words offline

   Paper to start with, metal for the long term. Note separately which wallet you use.

3. Use a new address for every payment

   Your wallet usually does this automatically.

4. Check addresses before sending

   Compare them in full, confirm on the device with a hardware wallet, and send a small test amount before larger ones.

A hardware wallet keeps your keys offline: it generates the seed phrase itself and shows addresses on its own display.

Quick check

What’s next?