Private keys, public keys and addresses explained

Three terms cause most of the early confusion in crypto: private key, public key and address. They are linked, but each does a different job, and only one of them must stay secret. A private key is a very large secret number. Whoever holds it can sign transactions for an account, which in practice means controlling everything in that account. A public key is a second number worked out from the private key. An address is a shorter identifier built from the public key, and it is the item you hand to someone who wants to send you a coin or a token. Think of the address as a mailbox slot and the private key as the only key that opens the box from the inside.

The relationship runs in one direction only. A wallet first generates a private key from a source of randomness. Using elliptic-curve cryptography, it then derives the public key from that number. The calculation is easy to perform forward and practically impossible to reverse, so nobody can work backward from a public key to the private key. Next, the wallet passes the public key through a hash function, a fixed recipe that turns any input into a short scrambled output, and the result becomes the address. When you send funds, the wallet uses the private key to produce a signature. The network checks that signature against the public key and accepts the transaction only if the two match. The private key itself never has to leave your device.

Imagine a student named Omar who wants a friend to send him a token for a shared project. He opens his wallet, taps the receive button and copies the address on the screen. He pastes it into a chat, and the friend sends the token. Later he sees a post that promises a free wallet check and asks him to type in his secret key so the tool can scan for problems. Omar remembers that the address was the part meant for sharing, and that the secret number is a different item entirely. He closes the page. The next day a classmate asks for his public key to set up a joint contract. Omar finds that his wallet does not normally show that value, so he asks what the classmate really needs, and the answer is the address.

The common failures each have a clear cause. People often treat the recovery phrase as something less sensitive than a private key, when that phrase can regenerate every key in a wallet and deserves the same secrecy. Fake support pages and pop-ups ask users to import a wallet by typing a key, and the typed secret goes straight to a thief. Many readers also assume an address reveals who stands behind it. It does not. Some addresses belong to smart contracts, which are programs that no private key controls, so an address alone cannot say whether a person, a business or a piece of code sits behind it. Finally, malware can swap a copied address for another one, so the payment lands in the wrong place.

A few checks can be done alone, with public sources. Before sharing a value, ask whether it is the address shown on the receive screen of the wallet itself. If the answer is no, stop. Before typing anything into a website, ask whether it wants a private key or a recovery phrase, because a genuine receiving or checking tool never needs either one. After pasting an address, compare its first and last characters with the original. Look the address up on a public block explorer, which usually labels contract addresses and shows past activity. Ask how you reached the site: through a bookmark you saved yourself, or through a link a stranger sent. A request that mixes up the three terms is itself a warning sign.

For further reading, the developer documentation on ethereum.org explains accounts, keys and addresses in detail, and its security pages describe common theft methods and how they work. Details differ between blockchains, since address formats, signature schemes and key derivation vary, so the documentation for the network in question is the place to confirm them. This page does not judge any wallet or tool, and it cannot assess your own setup. It is general education, not financial, legal or security advice, and the sources listed below give the full technical background, in the words of their own authors, for anyone who wants more depth than a short explainer can offer.

• An address is meant to be shared; a private key and a recovery phrase are never meant to be shown
• Any site or person asking for a private key or recovery phrase should be treated as a theft attempt
• An address alone does not say who or what controls it, since contracts have addresses too