What Is an xPub Key? One Key, Unlimited Bitcoin Addresses

What Is an xPub Key? The Short Answer

An xPub key (extended public key) is a public key plus a chain code that can derive an unlimited sequence of Bitcoin addresses — without ever exposing the private key. A payment processor uses your xPub to generate a fresh address for every order and watch for incoming funds, while being mathematically unable to spend anything. That is exactly what makes non-custodial crypto payments possible.

The Problem Non-Custodial Payments Had to Solve

When you accept card payments, a processor handles everything — they hold credentials, generate tokens, and move money. You trust them. With crypto, the whole point is that you do not have to trust anyone. But that raises an obvious question: if your payment processor never touches your private keys, how does it know which addresses to watch for incoming payments?

The answer is the extended public key, universally called an xPub key. It is one of the most important concepts in Bitcoin — and almost nobody outside of developer circles knows it exists.

What a Regular Public Key Does

In Bitcoin, every wallet address is derived from a private key. The private key is secret — it is what lets you spend funds. The public key is derived from the private key using elliptic curve cryptography. It is safe to share, because there is no known mathematical path from public key back to private key.

A standard Bitcoin address is essentially a hashed version of a public key. Share the address, receive funds. Simple. But if you only have one public key, you only have one address — and reusing the same address for every payment is terrible for privacy and makes your transaction history completely public.

What an xPub Key Is

An extended public key (xPub) is a public key plus a piece of extra data called a chain code. Together, they form a parent key that can mathematically derive a virtually unlimited sequence of child public keys — and therefore a virtually unlimited sequence of child addresses.

You do not need the private key to do this. The xPub alone is enough to generate every address in the sequence. This is the core insight of BIP32, the Bitcoin Improvement Proposal that defined hierarchical deterministic wallets in 2012.

An xPub lets anyone generate your receive addresses without ever being able to spend your funds.

An xPub key looks like this:

xpub6CUGRUonZSQ4TWtTMmzXdrXDtypWKiKrhko4egpiMZbpiaQL2jkwSB1icqYh2cfDfVxdx4df189oLKnC5fSwqPfgyP3hooxujYzAu3fDVmz

It is a long base58-encoded string. Anyone who has it can watch your incoming transactions. Nobody who has it can move your money.

How Child Address Derivation Works

Starting from an xPub, a wallet derives child addresses using a deterministic formula defined in BIP32. You provide an index — 0, 1, 2, 3, and so on — and the algorithm produces a unique public key for each one. That key maps to a unique Bitcoin address.

The derivation path looks like this:

m / purpose' / coin_type' / account' / change / index

For a typical Bitcoin receive address under BIP44:

m/44'/0'/0'/0/0   → first receive address
  m/44'/0'/0'/0/1   → second receive address
  m/44'/0'/0'/0/2   → third receive address

The apostrophes denote hardened derivation — those steps require the private key and are used to separate accounts. The final two segments (change and index) use only the xPub, which is why a processor can generate every receive address it needs while holding nothing more than a read-only key.

Why This Is Useful for Merchants

When you connect a crypto payment processor to your wallet using an xPub key, here is what happens:

1. You export the xPub from your wallet (hardware or software) and paste it into the processor.
2. For each new order, the processor derives the next unused address in the sequence.
3. The processor monitors those addresses for incoming transactions.
4. When payment arrives, it notifies your server via webhook.
5. The funds land directly in your wallet — the processor never held them.

The processor has zero ability to move your funds at any point. It can only watch. This is what non-custodial means in practice — not a vague promise, but a specific technical guarantee backed by the xPub architecture. It is the same reason not your keys, not your coins works in your favour here rather than against you.

xPub vs Private Key vs Seed Phrase

Key type	Can receive	Can spend	Safe to give a processor
xPub (extended public key)	Yes	No	Yes
Single public address	One address only	No	Yes, but reuses one address
Private key	Yes	Yes	Never
Seed phrase	Yes	Yes (whole wallet)	Never

Privacy: Why Fresh Addresses Matter

Bitcoin's blockchain is fully public. If you reuse a single address, every payment you have ever received is visible to anyone with your address. Suppliers, customers, and competitors can all see your revenue. Address reuse is one of the most common privacy mistakes in crypto.

Because xPub-derived wallets generate a new address for every transaction, each payment is isolated. Linking them together requires chain analysis — which is possible but significantly harder, and out of reach for casual observers.

What You Should Not Share

An xPub key is not the same as a private key, but it is not entirely harmless either:

• Do share: Your xPub with your payment processor. That is its purpose.
• Do not share: Your xPub publicly. Someone with your xPub can see every address you have ever generated and will generate, linking all your transactions together.
• Never share: Your seed phrase or private key. Ever. With anyone.

The xPub is a read-only view of your wallet's address space. Treat it like you would treat a read-only database credential — it is fine to give to a system that needs it, but not fine to post on the internet.

xPub vs Other Extended Key Formats (ypub, zpub)

You may also encounter ypub and zpub keys. These are the same concept — extended public keys — but encoded differently to indicate which address format the wallet uses:

• xpub — Legacy P2PKH addresses (starting with 1)
• ypub — P2SH-wrapped SegWit addresses (starting with 3)
• zpub — Native SegWit (Bech32) addresses (starting with bc1)

Most modern wallets use zpub for Bitcoin and expose native SegWit addresses by default. If your payment processor asks for an xpub but your wallet exports a zpub, some tools can convert between them.

The Bottom Line

The xPub key is what makes trustless crypto payments possible. It separates the ability to receive funds from the ability to spend them — giving payment infrastructure exactly the access it needs and nothing more. Every time a crypto merchant generates a fresh address for a new order without giving up control of their wallet, an xPub key is working behind the scenes.

If you are evaluating crypto payment processors, the first question to ask is whether they support xPub integration. If they do not, they are holding your funds — and that is a different risk model entirely. CryptoGate is fully xPub-based on Shopify and WooCommerce; create a free account to connect your wallet.

Frequently Asked Questions

What is an xPub key in simple terms?

It is an extended public key that can generate an unlimited list of receive addresses for your wallet without ever being able to spend from them. It lets a service watch for your payments but never move them.

Can someone steal my Bitcoin if they have my xPub?

No. An xPub can only derive addresses and watch transactions. Spending requires the private key, which an xPub does not contain. The worst a leaked xPub does is expose your transaction history.

Is it safe to give my xPub to a payment processor?

Yes — that is its intended use. The processor generates fresh receive addresses and monitors them, but cannot move your funds. This is what makes the integration non-custodial.

What is the difference between xpub, ypub, and zpub?

They are the same extended-public-key concept encoded for different address formats: xpub for legacy addresses, ypub for wrapped SegWit, and zpub for native SegWit (bc1) addresses.

How does an xPub generate unlimited addresses?

It combines a public key with a chain code and feeds an incrementing index into the BIP32 derivation formula. Each index produces a new, unique address, so the supply is effectively unlimited.

Where do I find my xPub key?

Most wallets expose it under account details or wallet information — for example Electrum lists it under Wallet then Information. Hardware wallets export it through their companion app.