Public key and private key: which one you share
A crypto account is not a username and a password but two keys bound by mathematics. A public key can be derived from a private key and never the reverse, and the whole system rests on that one-way relationship. We explain where the address comes from, why it is safe to share, and why a wallet holds authority rather than money.
In brief
A crypto account is not a username and a password. It is two keys bound to each other by mathematics.
The private key signs. The public key verifies that signature. The relationship runs one way only, and Ethereum's own documentation puts it plainly:
"It is possible to derive new public keys from your private key, but you cannot derive a private key from public keys."
You can go from the private key to the public key, never the other way. The whole system rests on that asymmetry.
Where the address comes from
The 0x... address you see is not a third thing; it is derived from the public key. On Ethereum the address is the last 20 bytes of the Keccak-256 hash of the public key.
That is why sharing an address is safe: you cannot walk back from the address to the public key, nor from the public key to the private key.
The sentence that matters most
One line in Ethereum's documentation corrects the most common misunderstanding about wallets on its own:
"You never really hold cryptocurrency, you hold private keys – the funds are always on Ethereum's ledger."
Your wallet does not hold money. The ledger holds the money; your wallet holds the authority to write to that ledger.
The practical consequence: whoever obtains the private key does not ask permission. They sign, and the network treats that signature as valid. There is no desk to call and reverse it, as there would be at a bank.
How this relates to a recovery phrase
The word list you are given when setting up a wallet is not the private keys themselves. It is the seed they are generated from. The same words regenerate the same keys, which is why anyone who sees those words can rebuild the entire account.
Risks
Biggest uncertainty How an address is derived differs by network; the rule described here is Ethereum's.
- A private key is never shared. No legitimate support team, exchange or project asks for it. If someone asks, the request is fake.
- Screenshots and cloud backups are exposure. Putting a key or a on a phone, in email or in cloud storage ties it to the security of that account.
- Address derivation differs by network. The Keccak-256 and last-20-bytes rule here is Ethereum's; Bitcoin takes a different route.
Sources
This article rests on the sources below. Whether each has a permanent copy is stated next to it.
- #1
Tek yönlü türetmenin, adresin açık anahtarın Keccak-256 özetinin son 20 baytından üretilmesinin ve 'varlık değil anahtar tutulur' ifadesinin kaynağı.
ethereum.org· our own copy· archive copy· no screenshot· cited 3 times in the text
Evidence chain: 1 sources
Tweets get deleted, sites go down. Below is whether a durable copy exists for each source.
Sources (1)
- #1
Tek yönlü türetmenin, adresin açık anahtarın Keccak-256 özetinin son 20 baytından üretilmesinin ve 'varlık değil anahtar tutulur' ifadesinin kaynağı.
“It is possible to derive new public keys from your private key, but you cannot derive a private key from public keys.”
ethereum.org/en/developers/docs/accounts/our own copyopen in a new tab - no screenshot captured
- archived copy
- captured on Sep 7, 2026, 10:22 PM
content hash
71efd06d20…572022