Xpub: what your Bitcoin wallet's public key reveals
An xpub lets anyone find every address of a Bitcoin account, and so its whole history, without being able to spend. What it reveals, its risk, and who to give it to.
An xpub (extended public key) is the public key of a Bitcoin wallet account from which all of its addresses are derived: whoever holds it sees every payment the account receives and sends, but cannot spend anything.
What an xpub holds
The BIP32 standard describes hierarchical deterministic wallets: a single seed produces a whole tree of keys. An extended key adds a chain code to the key, which is used to compute its child keys. According to BIP32, knowing an extended public key allows the reconstruction of all its non-hardened child public keys.
Wallets arrange these keys along the BIP44 path: m / purpose' / coin_type' / account' / change / address_index. The xpub a wallet shows is the one at the account' level. It covers two chains of addresses: 0 for receiving addresses, 1 for change addresses, which receive the change from your own payments.
xpub, ypub or zpub
The prefix tells which type of address the account uses:
| Prefix | Standard | Path of the first account | Addresses |
|---|---|---|---|
xpub | BIP44 | m/44'/0'/0' | Legacy addresses, starting with 1 |
ypub | BIP49 | m/49'/0'/0' | Nested SegWit, starting with 3 |
zpub | BIP84 | m/84'/0'/0' | Native SegWit, starting with bc1q |
All three are the same kind of key: only their version bytes change, and with them their first letters.
What an xpub reveals
- Every address of the account, past and future: they are derived one by one, with no end.
- The whole history: every receipt, every payment, every amount, since the blockchain is public.
- The account's balance, at any time.
- Nothing to spend with: without a private key, no transaction can be signed.
BIP32 gives this very use: handing an account's extended public key to an auditor lets them see all incoming and outgoing payments, without access to any secret key. Whoever has your xpub has that auditor's view, for good: an xpub cannot be revoked.
The risk to know
An xpub alone cannot spend. But BIP32 warns: knowing an extended public key plus any non-hardened private key descending from it is the same as knowing the parent extended private key. In other words, your xpub and the private key of a single one of your addresses are enough to spend the whole account.
The account' level is hardened: such a leak stays within that account and does not reach the other accounts of the same seed. So export an xpub, never the private key of an address, and never give out your recovery phrase.
How software finds the addresses
Software that reads an xpub derives the addresses in order and stops after a run of addresses that were never used: BIP44 sets this limit (the gap limit) at 20. If you created more than 20 addresses in a row without using them, software that follows this rule will not see the ones after.
To read the balances, the software then queries a server or a node, address by address. That server then learns all your addresses and can link them together: that is the other leak, which comes not from the xpub itself but from the way it is read.
Before you share your xpub
- Ask who keeps it: an app that keeps your xpub on its servers knows your account for as long as it does, and any leak of its data exposes it.
- Prefer reading it locally: a wallet connected to your own node, or a tool that derives the addresses on your device, hands the xpub to no one.
- One account per use: another account (the next
account') has another xpub, which reveals nothing about the other accounts.
How CentraFIN reads your xpub
CentraFIN reads your xpub on your device: your browser derives the addresses, reads their balances over an end-to-end encrypted connection and keeps it all in a vault it encrypts itself. CentraFIN's server never sees your xpub, an address or a balance. Each address is always read from the same node, drawn at random, so that no node sees the whole account. The details are on the Bitcoin page.
Sources
- BIP32: hierarchical deterministic wallets
- BIP44: derivation path and gap limit
- BIP49: ypub, nested SegWit
- BIP84: zpub, native SegWit
Frequently asked questions
Can someone steal bitcoin with an xpub?
Not with the xpub alone: it cannot sign. With the private key of one of the account's addresses as well, yes: the whole account.
Is an xpub enough to see my balance?
Yes. It gives every address of the account, and the blockchain gives their balances and transactions.
What should I do if my xpub leaked?
It cannot be revoked: whoever has it will always see that account. From now on, use a new account whose xpub has never been shared. The transfer from the old account will stay visible.
What is the difference between xpub, ypub and zpub?
The account's type of address: addresses starting with 1 for xpub, with 3 for ypub (nested SegWit), with bc1q for zpub (native SegWit).
Take control of your wealth
Your account is ready in a minute, with no password.