# Extended public keys (xpub)

An xpub can generate every receiving address of a wallet account without being able to spend. Learn its uses and why you should keep it private.

Canonical page: https://mybitcoinexplorer.com/learn/extended-public-keys-xpub
Topic: Keys and addresses
Published: 2026-10-29
Updated: 2026-10-30


## A public key that makes more public keys
An extended public key is a public key plus its chain code. With [normal derivation](https://mybitcoinexplorer.com/learn/hd-wallets-bip32), it can produce every child public key, and so every address, below it in the tree.

> Diagram: An xpub generates addresses but can never sign — Seed → Account private key: xprv → (public half)*Account xpub: shareable with care → Addresses: unlimited

## What it's useful for
- **[Watch-only wallets](https://mybitcoinexplorer.com/learn/watch-only-wallets)** that show balances and create receiving addresses, while keys stay on a [hardware wallet](https://mybitcoinexplorer.com/learn/hardware-wallets).
- **Merchants** generating a fresh address per invoice on a server that holds no keys.
- **Multisig setups**, where co-signers exchange xpubs.

## The prefixes
| Prefix | Usually for |
|---|---|
| xpub | Legacy, or generic |
| ypub | Nested SegWit |
| zpub | Native SegWit |

Descriptors now replace these prefixes as a clearer way to say which script type applies.

## Keep it private
An xpub can't spend, but anyone with it can see **every** past and future address and balance of that account. Treat it as sensitive.


## A real use: accepting payments safely
A shop can put only its xpub on the web server that shows customers payment addresses. If the server is hacked, attackers can see payments but can't take any coins, because the private keys live elsewhere.

## Watch-only on MyBitcoinExplorer
Our dashboard watchlists use individual addresses rather than xpubs, so you can monitor exactly what you choose without revealing your whole account. See [Watch-only wallets](https://mybitcoinexplorer.com/learn/watch-only-wallets).


## Key takeaways

- An xpub derives all public keys and addresses of an account.
- It can't sign, so it powers watch-only wallets.
- Leaking an xpub exposes your whole account history.

## Common questions

### Is it safe to give my xpub to a website?

It can't spend your coins, but it reveals all your addresses and balances to that site.

### What's an xprv?

The extended private key. It can spend everything below it: guard it like your seed.

### Is an xpub the same as a public key?

It's a public key plus a chain code, so it can derive many child public keys.

### Can an xpub be used to steal bitcoin?

Not on its own, but combined with any one child private key it can expose the whole account, so treat it as sensitive.

## Related lessons

- [Watch-only wallets](https://mybitcoinexplorer.com/learn/watch-only-wallets)
- [HD wallets (BIP 32)](https://mybitcoinexplorer.com/learn/hd-wallets-bip32)
- [Derivation paths](https://mybitcoinexplorer.com/learn/derivation-paths)
- [Address reuse and privacy](https://mybitcoinexplorer.com/learn/address-reuse-and-privacy)