Live prices are currently unavailable — the exchange feed could not be reached and no recent cached reading is held.

Bitcoin Data GuideBitcoin Reference

Wallet Architecture

Watch-Only Wallets

A watch-only wallet tracks a balance and can build a transaction, but it holds no key capable of signing one. It is the same key structure as a full wallet with the signing half removed, and it is what makes it possible to monitor funds on a device that never touches the secret.

The idea

A wallet does two separable jobs. It watches the chain for outputs that belong to it, and it signs transactions that spend them. The first job needs only public information: the scripts to watch and the ability to read the chain. The second needs the private keys. A watch-only wallet performs the first job and not the second, which means it can be run on a device that never holds a secret.

The arrangement is possible because of the key hierarchy described on the derivation page. An extended public key names a position in the tree and can derive every public key beneath it, so a watch-only wallet given that key can generate the same addresses as the full wallet without being able to derive any private key. The two stay in step because they are walking the same tree from different starting points.

This is the mechanism behind the common pattern of keeping the signing key on a dedicated device and the watching key on a phone or a desktop. The watching device can show a balance and prepare a transaction; the signing device approves it. The secret never has to be present on the device that is online.

What an extended public key reveals

An extended public key is not a secret in the way a private key is, but it is not public information either. Anyone who holds it can derive every address beneath it and can therefore see every payment the wallet has received and every output it controls. Handing an extended public key to a third party is handing them a complete history of that branch of the wallet, which is a privacy decision rather than a security one.

What the extended public key does not do is allow spending. Deriving a private key from a public key is the problem the cryptography is built to make infeasible, and the hardened derivation rule described on the derivation page exists to stop a leaked extended public key from being used to derive the private keys of its siblings. The distinction between what the key reveals and what it enables is the whole point of the watch-only arrangement.

There is one caveat worth stating. If a wallet uses non-hardened derivation for the branch whose extended public key is shared, and a child private key from that branch is later exposed, the parent private key can be recovered from the two together. That is why the convention is to harden the upper levels of the tree, and why a watch-only setup should follow the standard path conventions rather than inventing its own.

Where the arrangement is used

The most common use is the hardware-wallet pattern: the signing key lives on a dedicated device, and a watch-only wallet on a general computer or phone provides the interface. The online device can prepare a transaction and display its details, and the offline device signs it after the user confirms. The secret is only ever present on the device that is not connected to the network.

A second use is monitoring. An organisation that holds funds under a multisig arrangement can give a watch-only view to someone who needs to see the balance without giving them any ability to move it. The same property that makes the arrangement useful for a single holder makes it useful for separating the roles of watching and spending across people.

The descriptor covered on the descriptor page is what makes these arrangements portable. A watch-only wallet needs to know exactly which scripts to watch, and a descriptor states that precisely. Without one, the watching device would have to guess the script type, which is the same guess that produces an empty balance during a restore.

Sources and references

The description of the extended key, the hardened derivation rule and the watch-only arrangement is taken from BIP 32 and the Bitcoin Core descriptor documentation.

  • The extended public key and hardened derivation. Bitcoin, BIP 32: Hierarchical Deterministic Wallets: defines the extended key format, the public derivation function and the hardened rule that limits what a leaked public key exposes.
  • The descriptor a watch-only wallet needs. Bitcoin Core, Support for Output Descriptors in Bitcoin Core: documents the script description that a watching wallet uses to identify the outputs it should track.
  • The multisig arrangement a watch-only view can monitor. Bitcoin, BIP 11: M-of-N Standard Transactions: defines the multisig output type that a watching role can track without holding a signing key.

Related reading