Public keys

A public key is the partner of a private key, and your wallet calculates it from the private key using a one-way mathematical step. Because nobody can work backwards from a public key to find the private key, you can share it safely with anyone who needs it.

How is a public key calculated?

Bitcoin uses elliptic curve maths for this step. The curve has a fixed starting point, called G, that every wallet agrees on. Your wallet "multiplies" G by the private key, but this is not the everyday kind of multiplication. Each step moves to a different point on the curve. For example, G multiplied by 2 gives a point called 2G. The point you reach after multiplying G by the private key is the public key.

That point has an x value and a y value. Those two values together form the public key.

Why can't you work backwards?

The maths only works in one direction. Going from the private key to the public key is quick, but going back from the public key to the private key is, in practice, impossible with today's computers. A function that is easy in one direction and very hard to reverse is called a one-way function.

The public key is also linked to the private key in a useful way. You can sign with the private key, and anyone can check that signature using the public key alone. The digital signatures page explains how this proves ownership without revealing the key.

What does a public key look like?

Here is the public key for the example private key used on these pages, shown in its compressed form. It starts with 02 because its y value is even, and the prefix records that fact.

02b4632d08485ff1df2db55b9dafd23347d1c47a457072a1e87be26896549a8737

Why are there two formats?

Early Bitcoin used the long form of a public key, which is called uncompressed, and that form is still valid. Today's wallets use the short form, which is called compressed, because it saves space on every payment that uses it.

The curve follows the equation y² = x³ + 7. For any x value, there are two possible y values, one even and one odd. A compressed key stores only the x value. The prefix says whether the y value is even (02) or odd (03), and that is enough to find the right one. This keeps the key at 33 bytes instead of 65, and that difference adds up across millions of transactions.

The uncompressed form of the same key starts with 04, followed by the full x value and the full y value:

04b4632d08485ff1df2db55b9dafd23347d1c47a457072a1e87be26896549a87378ec38ff91d43e8c2092ebda601780485263da089465619e0358a5c1be7ac91f4

Taproot outputs go one step further. They use only the x value, which is 32 bytes with no prefix at all. The y value is assumed to be even. The Taproot page explains why this change was made.

Is it safe to share a public key?

Yes. A public key lets someone send coins to you, and it lets anyone check your signatures. It does not reveal the private key, so the secret stays with you. Anyone with your public key can check your signatures, but cannot spend your coins.

Payers usually use your address, which is a short code built from the public key. Early coins were locked straight to public keys, through a method called pay to public key, but most payments today use addresses instead.

Next, digital signatures shows how you prove that you hold a public key's private key, one transaction at a time, without ever showing the key itself.