What is xpub (extended public key)?

A key that can generate every receiving address in a wallet branch without being able to spend from any of them.

It is the reason a modern wallet can hand out a fresh address for every payment and still be recovered from twelve words. Rather than storing hundreds of unrelated keys, the wallet derives them all from one root, and the extended public key is the half of that root which can produce addresses but not signatures.

The property that catches people out is that an xpub confers no spending power and total visibility. It cannot move a coin and it can see every coin you have.

How it works

BIP-32 defines hierarchical deterministic derivation, in which a master key produces a tree of child keys. An extended public key consists of a public key plus a chain code, and that pair is enough to derive every non-hardened child public key beneath it, and therefore every address in that branch. Deriving the corresponding private keys requires the extended private key, which the xpub does not contain.

The address structure comes from BIP-44 and its successors, which organize the tree by purpose, coin type, account, and then chain, with one branch for receiving addresses and one for change. An xpub is normally exported at the account level, so it covers one account's entire history rather than the whole wallet.

Prefixes signal the address type: xpub for legacy, ypub and zpub for the wrapped and native segwit conventions on Bitcoin. Importing the wrong one into a tool shows an empty balance, since it derives a different set of addresses. Descriptors, a newer format, express this more precisely and are gradually replacing raw extended keys.

Uses follow directly. watch only wallets import an xpub to monitor cold storage. Accounting and tax tools import one to reconstruct history. Merchant systems generate a fresh address per invoice from an xpub while the keys stay offline. A few exchanges accept an xpub as a withdrawal destination so each payout lands on a new address, and most expect a single fixed address instead.

Example

Illustrative. You give your accountant the xpub for one Bitcoin account so they can prepare a return.

They import it, derive the receiving and change branches, and see every transaction that account has ever made, with dates, amounts, and running balance. They cannot spend anything, because signing needs private keys the xpub cannot produce.

They also now know your total holdings permanently, as does anyone who reads that email or breaches their machine. The disclosure is unbounded in time: addresses derived years from now are derivable from the same key today.

Why it matters when you buy

This matters after a purchase, when you move coins to your own wallet and want to check on them without handling keys. Using an xpub in a watch-only wallet is the right tool for that, and treating it as public information is the mistake to avoid. The guide on moving crypto off an exchange covers the withdrawal, and the guide on using a block explorer covers reading the result.

Related terms

• hd wallet: the derivation scheme xpubs belong to
• seed phrase: the root everything derives from
• watch only wallet: the main use for an xpub
• public key: what an extended key wraps
• bip 39: the word list behind the seed
• descriptor wallet: the modern replacement format

Questions

Can someone steal my coins with my xpub?

No. Spending requires private keys, which cannot be derived from an extended public key. The exposure is that they see everything the account holds and has ever done.

Why does my xpub show a zero balance in some tools?

Usually an address type mismatch. Legacy, wrapped segwit, and native segwit use different derivation paths and prefixes, so importing the wrong extended key derives addresses your wallet never used.

Should I give my exchange an xpub?

Only if it explicitly supports one as a withdrawal destination. Most expect a single address, and supplying an extended key where a plain address is wanted usually just fails validation.