How Bitcoin Addresses Are Generated From Private Keys

Understanding how Bitcoin generates addresses from private keys is fundamental to grasping Bitcoin's security model. This process involves multiple cryptographic operations that ensure your Bitcoin is secure. Let's break it down step by step.

The Complete Process Overview

The journey from private key to Bitcoin address involves several transformations:

Private Key (256 bits)
    ↓ [ECDSA secp256k1]
Public Key (512 bits uncompressed or 264 bits compressed)
    ↓ [SHA-256]
SHA-256 Hash (256 bits)
    ↓ [RIPEMD-160]
RIPEMD-160 Hash (160 bits)
    ↓ [Base58Check encoding]
Bitcoin Address (P2PKH)

Each step is irreversible—you cannot derive a private key from an address.

Step 1: Private Key Generation

What is a Private Key?

A Bitcoin private key is simply a random 256-bit number. More specifically:

• Range: 1 to n-1 (where n ≈ 1.158 × 10^77)
• Curve: secp256k1 elliptic curve parameter
• Bits: 256 bits = 32 bytes

Example Private Key

Hexadecimal:

E9873D79C6D87DC0FB6A5778633389F4453213303DA61F20BD67FC233AA33262

Decimal:

105552613717729056777169557423064973562079224458282471330770649850863373377122

This number must be: - Cryptographically random - Within the valid range - Kept absolutely secret

Step 2: Generate Public Key (ECDSA)

Elliptic Curve Multiplication

Bitcoin uses the secp256k1 elliptic curve. The public key is calculated by:

Public Key = Private Key × G

Where: - G is the generator point (a fixed point on the curve) - × represents elliptic curve point multiplication - Result is a coordinate pair (x, y)

The Mathematics

The secp256k1 curve equation:

y² = x³ + 7 (mod p)

Where p is a very large prime number.

Properties: - Given private key, calculating public key is easy - Given public key, finding private key is computationally infeasible - This one-way property is Bitcoin's core security

Public Key Formats

Uncompressed Public Key (65 bytes)

Format: 04 + x-coordinate (32 bytes) + y-coordinate (32 bytes)

Example:

04
50863AD64A87AE8A2FE83C1AF1A8403CB53F53E486D8511DAD8A04887E5B2352
2CD470243453A299FA9E77237716103ABC11A1DF38855ED6F2EE187E9C582BA6

Compressed Public Key (33 bytes)

Since the curve equation allows calculating y from x, we only need x-coordinate plus a prefix indicating y's parity: - 02 if y is even - 03 if y is odd

Example:

0250863AD64A87AE8A2FE83C1AF1A8403CB53F53E486D8511DAD8A04887E5B2352

Benefits of Compression: - Saves 32 bytes in transactions - Reduced blockchain space - Lower transaction fees - Same security level

Modern wallets use compressed public keys by default.

Step 3: Hash the Public Key (SHA-256)

Apply the SHA-256 hash function to the public key:

SHA256(public_key) → 256-bit hash

Example: Using our compressed public key:

Input:  0250863AD64A87AE8A2FE83C1AF1A8403CB53F53E486D8511DAD8A04887E5B2352
SHA-256: 0B7C28C9B7290C98D7438E70B3D3F7C848FBD7D1DC194FF83F4F7CC9B1378E98

Why SHA-256? - Produces 256-bit output - Cryptographically secure - Used throughout Bitcoin protocol - Resistant to collision attacks

Step 4: Hash Again (RIPEMD-160)

Apply RIPEMD-160 hash to the SHA-256 result:

RIPEMD160(SHA256(public_key)) → 160-bit hash

Example:

Input:    0B7C28C9B7290C98D7438E70B3D3F7C848FBD7D1DC194FF83F4F7CC9B1378E98
RIPEMD-160: F54A5851E9372B87810A8E60CEBB2F9B6542F567

Why RIPEMD-160? - Reduces hash to 160 bits (20 bytes) - Shorter addresses (easier to use) - Additional security layer - Different algorithm than SHA-256 (defense in depth)

This double-hashing is called Hash160 in Bitcoin terminology.

Step 5: Add Network Byte

Add a version/network byte prefix:

• 0x00 for Main Network (P2PKH address starting with '1')
• 0x05 for Main Network (P2SH address starting with '3')
• 0x6F for Test Network (P2PKH address starting with 'm' or 'n')

Example (mainnet P2PKH):

Version byte: 00
Hash160:      F54A5851E9372B87810A8E60CEBB2F9B6542F567
Combined:     00F54A5851E9372B87810A8E60CEBB2F9B6542F567

Step 6: Calculate Checksum

To catch typos, Bitcoin adds a 4-byte checksum:

1. Double SHA-256 the versioned hash:

SHA256(SHA256(00F54A5851E9372B87810A8E60CEBB2F9B6542F567))

1. Take first 4 bytes of the result:

Checksum: C7F18FE8

1. Append to versioned hash:

00F54A5851E9372B87810A8E60CEBB2F9B6542F567C7F18FE8

Purpose: - Detects typos in addresses - Prevents sending to invalid addresses - Error correction capability

Step 7: Base58Check Encoding

Convert the binary data to a human-readable format using Base58:

Base58 Alphabet (excludes 0, O, I, l to avoid confusion):

123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz

Encoding Process: 1. Convert hex to decimal 2. Divide by 58 repeatedly, tracking remainders 3. Map remainders to Base58 characters 4. Add leading '1' for each leading 0x00 byte

Final Result:

1PMycacnJaSqwwJqjawXBErnLsZ7RkXUAs

This is your Bitcoin address!

Different Address Types

Bitcoin has evolved to support multiple address formats:

Legacy P2PKH (Pay-to-Public-Key-Hash)

Starts with: 1
Example: 1PMycacnJaSqwwJqjawXBErnLsZ7RkXUAs

Generation:

Version: 0x00
Hash160 + Base58Check encoding

Pros: - Universal compatibility - Widely understood

Cons: - Larger transaction size - Higher fees - No native SegWit benefits

P2SH (Pay-to-Script-Hash)

Starts with: 3
Example: 3J98t1WpEZ73CNmYviecrnyiWrnqRhWNLy

Generation:

Version: 0x05
Script hash instead of public key hash

Use Cases: - Multi-signature wallets - Wrapped SegWit addresses - Complex scripts

SegWit P2WPKH (Bech32)

Starts with: bc1q
Example: bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4

Generation: - Uses Bech32 encoding (not Base58) - Version byte: 0x00 (witness version 0) - Hash160 of public key - Better error detection

Advantages: - ~40% lower transaction fees - Better error detection (checksum) - All lowercase (easier to read/QR) - Native SegWit support

Taproot P2TR (Bech32m)

Starts with: bc1p
Example: bc1p5cyxnuxmeuwuvkwfem96lqzszy6k3unv250x00e0f25p7x5hjn4qk0ec3q

Generation: - Bech32m encoding - Schnorr signatures - Witness version 1

Benefits: - Enhanced privacy - More efficient multi-sig - Smart contract capabilities

Code Example: Simplified Generation

Here's pseudocode showing the process:

def private_key_to_address(private_key_hex):
    # Step 1: Private key (already have)
    private_key = bytes.fromhex(private_key_hex)

    # Step 2: Generate public key (ECDSA)
    public_key = ecdsa_multiply(private_key, G_POINT)
    public_key_compressed = compress_public_key(public_key)

    # Step 3 & 4: Double hash
    sha256_hash = sha256(public_key_compressed)
    ripemd160_hash = ripemd160(sha256_hash)

    # Step 5: Add network byte
    versioned_hash = b'\x00' + ripemd160_hash

    # Step 6: Calculate checksum
    checksum = sha256(sha256(versioned_hash))[:4]

    # Step 7: Base58 encode
    address_bytes = versioned_hash + checksum
    address = base58_encode(address_bytes)

    return address

Security Implications

One-Way Function

Each step is computationally irreversible:

Cannot derive: - ❌ Private key from public key (ECDSA discrete log problem) - ❌ Public key from address (hash function preimage resistance) - ❌ Private key from address (combined impossibility)

Can easily compute: - ✅ Public key from private key - ✅ Address from public key - ✅ Full chain from private key

Why This Security Works

1. Elliptic Curve: Breaking requires solving discrete logarithm problem
2. Hash Functions: Finding collisions is computationally infeasible
3. Multiple Layers: Even if one hash function breaks, multiple protection layers remain

Attack Complexity

To compromise a Bitcoin address, an attacker would need to: - Break ECDSA (reverse public key calculation) - OR find SHA-256 preimage - OR find RIPEMD-160 preimage

Each is individually considered impossible with current technology.

Practical Implications

Address Reuse

Bad Practice:

Transaction 1: Receive at 1ABC... (reveals public key)
Transaction 2: Receive at 1ABC... (reuses address)

Why It Matters: - Privacy reduction (links transactions) - If ECDSA ever breaks, reused addresses at risk - Best practice: Use new address per transaction

Deterministic Wallets (HD Wallets)

Modern wallets use BIP32/BIP44:

Master Seed (12-24 words)
    ↓
Master Private Key
    ↓
Child Private Keys (billions possible)
    ↓
Child Public Keys
    ↓
Addresses

Benefits: - Backup one seed phrase - Generate unlimited addresses - Derive keys deterministically - Better privacy through address rotation

Common Misconceptions

❌ "Addresses are encrypted private keys"

Reality: Addresses are cryptographic hashes, not encrypted anything.

❌ "You can decrypt an address to get the private key"

Reality: Hash functions are one-way. No decryption is possible.

❌ "All addresses starting with '1' are the same type"

Reality: They're all P2PKH, but can be from compressed or uncompressed public keys.

❌ "Changing address format changes your private key"

Reality: Same private key can generate multiple address types.

Verification Tools

Check Your Understanding

Given a private key, you can verify the generation process:

1. Online Tools (for education only, never real keys):
2. Bitaddress.org (offline mode)

3. ian.sh/rawtx (address generation)

4. Programming Libraries:

5. Python: bitcoin, ecdsa
6. JavaScript: bitcoinjs-lib

7. Go: btcd/btcec

8. Command Line:

9. Bitcoin Core (bitcoin-cli)
10. OpenSSL for raw cryptography

FAQ

Q: Can two different private keys generate the same address?
A: Theoretically yes (hash collision), but probability is negligible (~1 in 2^160).

Q: Why use both SHA-256 and RIPEMD-160?
A: Defense in depth. If one algorithm is compromised, the other provides security.

Q: Is my address linked to my identity?
A: Not directly. Bitcoin is pseudonymous, not anonymous. Addresses don't contain identity information.

Q: Can I generate a custom/vanity address?
A: Yes, by generating many private keys until finding one whose address matches your pattern. Computationally expensive but possible.

Q: What happens if I make a typo in an address?
A: The checksum will fail validation, and most wallets will reject it before sending.

Conclusion

Bitcoin address generation is a carefully designed process that:

✅ Ensures Security - Multiple cryptographic layers
✅ Enables Privacy - Addresses don't reveal private keys
✅ Prevents Errors - Checksum catches typos
✅ Maintains Efficiency - Compressed keys save space
✅ Supports Evolution - Multiple address formats for new features

Understanding this process helps you appreciate: - Why private keys must be kept secret - Why address reuse is discouraged - How Bitcoin achieves security without central authority - The elegance of Bitcoin's cryptographic design

The irreversibility of each step is what makes Bitcoin secure—your private key generates your address, but your address can never reveal your private key.

Related Articles

• What is a Bitcoin Private Key?
• Bitcoin Private Key Formats Explained
• The Mathematics Behind Bitcoin
• Can Someone Guess Your Bitcoin Private Key?
• Bitcoin Security Best Practices

Explore our interactive Bitcoin key explorer to see address generation in action and understand the cryptographic process firsthand.