What an xpub reveals, and when it is safe to share one
An extended public key cannot spend your coins, but it shows every address and payment of an account, and in one case it can help expose a private key.
Published 3 min read
In short
An xpub, or extended public key, lets software derive every public address of a wallet account. Whoever holds it can see all past and future receiving and change addresses of that account, and therefore its full balance and history, but cannot sign transactions.
BIP32 warns of one dangerous combination: an extended public key together with any non-hardened private key derived from it reveals the parent private key. Share an xpub only with software and people that need it, such as your own watch-only wallet or the co-signers of a multisig.
Wallet software sometimes asks for an “xpub” (or “zpub”, “ypub” and similar variants) to show balances or to set up a multisig. It is called public, and it cannot move coins. It is still one of the most revealing pieces of information about your money.
What is an xpub?
Under BIP32, a wallet’s keys form a tree. An extended key is a key plus a 32-byte chain code, which together let software derive child keys. An extended public key, the xpub, derives child public keys, and therefore addresses, without any private key.
Wallets usually export the xpub of an account, a branch of the tree at a fixed derivation path. BIP84, for example, places the first native SegWit account at m/84'/0'/0'. From that one xpub, software can produce every receiving and change address the account will ever use.
What can someone do with it?
| With your account xpub, someone can… | …but cannot |
|---|---|
| List every past and future address of the account | Sign a transaction |
| See the full balance and every payment in and out | Move any coins |
| Watch new payments arrive in real time | Change the wallet |
| Link your addresses to each other even if you never reused one | Learn the seed phrase |
That middle row is the point. Avoiding address reuse protects you from strangers linking payments; handing out an xpub undoes it for whoever holds the key.
When can an xpub help expose a private key?
BIP32 includes a specific warning. In non-hardened derivation, knowing a parent extended public key and any one non-hardened child private key is enough to calculate the parent private key, and with it every key below it. This is why accounts are created with hardened derivation, marked with an apostrophe in the path, and why an xpub should never be combined with leaked private keys from the same branch, for example by a tool that exports single private keys for convenience.
Why are there xpubs, ypubs and zpubs?
The letters are a convention some wallets use to hint at the address type the key is meant for: the same underlying extended public key is encoded with a different prefix for legacy, nested SegWit or native SegWit accounts. It does not change what the key reveals. Newer software tends to use output descriptors instead, which state the address type and derivation path explicitly next to the key, so nothing has to be guessed from a prefix.
When is it reasonable to share one?
- With your own watch-only software, so a phone can show balances while the keys stay on a hardware wallet.
- With the co-signers of a multisig, because each needs every xpub to verify addresses. BIP380 output descriptors bundle them with the policy into one line that should be backed up alongside each key.
- With an accountant or heir, when you accept that they will see the account’s whole history.
Avoid pasting an xpub into websites you do not control, and treat services that ask for one as you would treat a request for a full bank statement: reasonable from your accountant, odd from a stranger.