No logins, no accounts, no company keeping a list of who owns what. Instead you prove a coin is yours by answering a question that only one number in the universe can answer — without ever revealing that number.
How do you prove you wrote something, to someone who has never met you and never will?
A handwritten signature is a poor model for this. It looks the same on every document, anyone who has seen it can copy it, and it proves nothing about the page it sits on. A digital signature has three jobs instead, and it does all three at once:
Only you can produce it. It requires a secret you have never shared.
Anyone can check it. No secret is needed to verify — that is the surprising part.
It is welded to one exact message. Change a single character and the signature stops working.
Sign something below. The mathematics running here is the same curve Bitcoin uses, executed in your browser.
Notice what you did not have to do. You never sent your secret anywhere. The verifier never learned it. And they still walked away certain that whoever holds that secret approved this exact sentence.
If everybody can check your signature, why can't they work backwards and forge one?
You have two keys, and they are not interchangeable. Your private key is just a number — pick any whole number below roughly 1077 and you have one. Your public key is calculated from it by a procedure that is quick to run forwards and hopeless to run backwards.
This is the same shape of trick as a fingerprint, but with an extra power. A hash throws information away permanently. This throws it away in a way that still lets you prove you know the original.
Add one to your private key and the public key becomes something unrecognisable. There is no warmer or colder, no getting close. That is what makes guessing useless: you would have to land on the exact number, and there are more of them than there are atoms in a very large number of universes.
Where does the impossibility actually come from?
From a curve, and one strange rule for moving around on it. The curve Bitcoin uses is written y² = x³ + 7, and it looks like this:
The rule for "adding" two points is deliberately odd: draw a straight line through them, find where it hits the curve a third time, and flip that point over the horizontal axis. That is the answer. It looks arbitrary. It is not — this rule has exactly the properties that make the rest of the system work.
Now the important part. Start at an agreed point called G and add it to itself over and over. Two hops, three hops, a thousand. Your private key is the number of hops. Your public key is where you land.
Anyone can see where you landed. Working out how many hops it took is called the discrete logarithm problem, and nobody knows how to do it.
One honest correction before you get too attached to that smooth picture. The real thing is not a smooth curve — it is a scatter of separate dots.
That is because mathematicians made the numbers wrap around. Past a certain size they start again from zero, the way a clock goes from 12 back to 1. The curve is not chopped into pieces by this; it is folded, and it stays a single connected object underneath. But once it is folded up, points that used to sit side by side end up scattered across the picture, which is exactly what you want. Anyone looking at where you landed learns nothing about how you got there.
Here is a deliberately tiny version, wrapping at 97, so that all of its points fit on one screen:
Drag it slowly. One extra hop sends you somewhere completely unrelated — the dots never march in order. With only 79 dots you could of course just check every one of them. Bitcoin's curve has about 1077.
You signed the same message twice in section one and got two different signatures. Why?
Because every signature needs a fresh throwaway number, generated at the moment of signing and never used again. Cryptographers call it the nonce — a number used once.
Here is the whole recipe in plain terms. You take your throwaway number and hop that many times around the curve; where you land gives you the first half of the signature, r. Then you mix together the message, your private key and that same throwaway number to get the second half, s.
The mixing is arranged so that a verifier holding only your public key can check the two halves fit together. If they do, the signer must have known the private key. There is no other way to make the numbers agree.
| Ingredient | Who knows it | What happens if it leaks |
|---|---|---|
| Private key | You alone, forever | Your coins are gone |
| Nonce | You, for one instant | Your private key can be calculated |
| Public key | Everyone | Nothing — it is meant to be public |
| Signature (r, s) | Everyone | Nothing, if the nonce was truly fresh |
Read the second row again. A number that exists for a fraction of a second, that most people have never heard of, sits at exactly the same level of danger as the key itself. That has gone wrong in public more than once.
What actually happens if the throwaway number gets reused?
In 2010, a group of researchers announced they had extracted the master signing key for the PlayStation 3. Sony's code had not generated a fresh nonce for each signature. It used the same one every time. That single shortcut let anyone with two signed files calculate the key that Sony's entire console security depended on.
It happened again in 2013, this time with real money. A flaw in Android's random number generator caused Bitcoin wallets on affected phones to repeat nonces. Coins were drained from wallets whose owners had done nothing wrong.
You do not have to take this on faith. Below are two different messages signed with the same private key. Switch the selector below to reuse the nonce, then extract the key yourself.
They do not need to break anything to find one. Every signature ever made is published on the blockchain, and r is right there in plain sight. So the hunt is nothing more than a search for duplicates:
Download the chain and extract every signature. There are well over a billion of them.
Put every r value into a lookup table. This is the same operation a spreadsheet performs when you ask it to highlight duplicate rows.
Read off any r that appears twice. Each hit is a wallet whose private key can now be calculated.
That scan is a few hours of ordinary computing on a laptop, and it only has to be done once — after that you watch new blocks as they arrive. Researchers have run exactly this scan on Bitcoin's history and found thousands of vulnerable keys, along with evidence that other people had already been quietly harvesting them.
The recovery itself, once a duplicate is spotted, is the part you just watched: four modular operations, no search, no guessing. That is the uncomfortable asymmetry here. Attacking the curve directly would take longer than the universe has existed. Attacking a repeated nonce takes less time than reading this sentence.
Which is why modern wallets do not roll dice for the nonce at all. They derive it deterministically from the message and the private key, so the same wallet signing the same message always produces the same nonce — and two different messages can never share one. If you have ever wondered what your wallet software is actually for, this is a large part of the answer.
If ECDSA works, why replace it?
Partly for a historical reason: ECDSA was a workaround. The cleaner scheme, invented by Claus Schnorr, was under patent when Bitcoin launched. The patent expired, and in 2021 the Taproot upgrade added Schnorr signatures to Bitcoin.
The practical difference is that Schnorr's arithmetic is linear — signatures can be added together. Several people can sign the same transaction and the result collapses into one signature that looks exactly like an ordinary single-signer one.
The privacy consequence matters more than the bytes saved. Under the old scheme, a wallet requiring three approvals announced that fact to the world forever. Under Schnorr it is indistinguishable from one person spending their own coins — a company treasury, a lightning channel and an individual all look the same on the chain.
The demonstration above uses the simplest form of key aggregation, which is fine for illustration but not safe to deploy as-is: a participant who chooses their key after seeing everyone else's can cheat. Real implementations use MuSig2, which adds extra rounds to close that hole.
You may have heard that quantum computing does not really endanger Bitcoin. That is half right.
Against fingerprints — the hashing that protects mining and addresses — the best known quantum attack only takes a square root off the work, which is nowhere near enough. Hashing is in reasonable shape.
Signatures are the other half, and they are genuinely exposed. Shor's algorithm does not shave the problem down, it dissolves it. Finding the number of hops, the thing nobody knows how to do today, becomes routine on a large enough quantum computer. Every elliptic curve signature scheme is affected, including Schnorr.
But notice what an attacker needs first: your public key. And Bitcoin, by a design decision made long before anyone worried about this, often does not publish it.
| What the world can see | Status |
|---|---|
| Your address | |
| Your public key | |
| Exposure to Shor's algorithm |
An address is a fingerprint of your public key, not the key itself. Until you spend, there is nothing on the chain for Shor to work on. The moment you spend, your public key is published permanently — and any coins left at that address are sitting behind a lock that a future quantum computer could pick.
So the practical advice is unglamorous and available today: do not reuse addresses. Spend everything from an address in one go and let the change land somewhere fresh. Every decent wallet already does this automatically.
Estimates for when a machine of the necessary size might exist vary widely and move with the research. The consensus direction of travel is clear enough: signature schemes will need to be replaced eventually, hashing likely will not, and the migration is a live area of standards work rather than an emergency.
Your private key is the whole thing. Not a password protecting an account somewhere — there is no account. The number is the ownership. Anyone holding it is you, as far as the network can ever tell.
The maths is not usually what fails. Nobody has broken the curve. They broke a random number generator, or a backup, or a person. Sony lost its master key to a shortcut in ordinary code.
Use wallet software that others have audited. Deterministic nonces, address rotation and safe key storage are exactly the unglamorous details that go wrong when written from scratch.
Don't reuse addresses. It costs nothing, improves your privacy today, and keeps your public key off the chain for whatever arrives later.