Public key vs private key: the difference, explained plainly

Updated August 6, 2026

People usually ask which key is the public one and which is private, as if it's a labeling problem. The sharper question is why one of them can sit in a block explorer for anyone to see while the other has to stay secret forever, and the answer is a one-way math problem: a private key is a huge random number, and a public key is what you get after an irreversible piece of arithmetic on it.

A private key is just a number

A Bitcoin private key has no real structure to it. It's a number picked at random from a range so large that guessing it isn't a realistic risk with any computer built so far, classical or quantum. That's the whole object: a 256-bit number, nothing more. Wallet software stores it, encrypts it, and often represents it as twelve or twenty-four English words for backup purposes, but underneath all of that it's still just a number you're supposed to never show anyone.

Anyone who learns your private key can spend the coins it controls, immediately, with no recovery process. That single fact is close to the entire security model of holding your own bitcoin.

The public key is what that number produces

The public key comes from the private key through elliptic curve multiplication on the curve Bitcoin uses, called secp256k1. You take your private number, multiply it against a fixed starting point on that curve, and the result is your public key, another point on the same curve. Computing that forward is fast; any ordinary computer does it instantly. Reversing it, starting from the public key and working backward to the private number, is currently infeasible for classical computers no matter how much hardware you throw at it. That gap between easy-forward and hard-backward is a one-way function, and it isn't a Bitcoin invention. Most of modern cryptography leans on some version of the same idea.

A Bitcoin address usually isn't the public key itself. It's a hashed and encoded form of it, shorter and, until spent from, an extra step removed from the underlying key. So there are really three layers stacked on top of each other: the private key you hold, the public key it derives, and the address that's a compressed reference to that key.

Why one-way math is the whole trick

Signing a transaction means using your private key to produce a signature over that transaction's data. Anyone can then take your public key and the signature and confirm, mathematically, that whoever signed it must have known the private key, without the verifier ever learning the number itself. That's the entire trick behind digital signatures: proof of a secret without disclosure of it. It's why you can hand out an address to strangers and let them pay you, while moving that money stays locked to whoever holds the private number.

This only holds up because reversing the derivation is hard. If computing a private key from its public key were easy, anyone who saw your public key, visible the moment you spend from most address types and immediately for Taproot, could compute your private key and take everything you have.

Where quantum computers actually threaten this

This is exactly the gap quantum computers threaten, specifically through Shor's algorithm, which can efficiently solve the discrete logarithm problem that secp256k1's security depends on. A sufficiently large, sufficiently error-corrected quantum computer running Shor's algorithm could, in principle, take a known public key and work backward to the matching private key, something no classical computer can do in any practical amount of time. That's a separate threat from what Grover's algorithm poses to hash functions and symmetric cryptography, including the hashing inside Bitcoin addresses. Grover's speeds up brute-force search, and it's generally handled with larger key sizes, not a redesign.

Exposure depends heavily on address type. Older formats such as P2PKH ("1"), P2SH ("3"), and SegWit v0 ("bc1q") only reveal the public key once you spend from them; before that, the world only sees a hash of it. Taproot addresses ("bc1p"), active since November 2021, commit to the actual public key directly, so it's exposed the moment funds arrive, spent or not. Roughly 5.4 million BTC, about a quarter of all bitcoin that will ever exist, already sits in addresses with an exposed public key, mostly from a prior spend, including an estimated 1.1 million BTC tied to Satoshi-era mining, dormant since around 2010.

None of this is an active threat today. No quantum computer that exists now, or that's credibly expected within the next few years, can run Shor's algorithm anywhere near the scale needed to threaten a real secp256k1 key. Serious estimates for when a cryptographically relevant quantum computer might exist range from several years to a decade or more, and that range is genuinely uncertain, not a date anyone can quote with confidence. For the fuller picture, including the draft BIP-360 and BIP-361 proposals for a quantum-resistant address format and the contested question of old, dormant, exposed coins under a migration deadline, the site's page on whether bitcoin is safe from quantum computers covers it in full.

What this means for your own coins

For any modern address you haven't spent from, the asymmetry between private and public keys is exactly as strong as it's ever been. If you want to see which exposure tier your own address falls into, the schrodinger's wallet checker looks up its spend history and Taproot status against a public block explorer. And if the numbers involved, sats, whole BTC, 256-bit ranges, start blurring together, the sats converter handles plain unit arithmetic without pulling price into it.

The private key is a secret number, the public key is the one-way output of multiplying that number against a fixed point on secp256k1, and every signature Bitcoin has ever accepted depends on that direction staying irreversible by any computer alive today.