Definition
Extended public key, almost always written as an xpub, is a BIP32 public key bundled with its chain code. From it, software can derive an unlimited sequence of child public keys and therefore every receive address in that branch of the wallet — all without any private key present. This is what powers watch-only wallets, hardware-wallet companion apps, and merchant point-of-sale systems that need fresh addresses but must never touch spending keys. The asymmetry is the whole design: the xpub can generate addresses forever, yet cannot sign a single spend.
What the prefix tells you
The leading characters encode the script (address) type via version bytes registered in SLIP-0132. On Bitcoin mainnet: xpub maps to legacy P2PKH (BIP44, m/44'/0'), ypub to wrapped SegWit P2WPKH-in-P2SH (BIP49, m/49'/0'), and zpub to native SegWit bech32 P2WPKH (BIP84, m/84'/0'). The underlying key material is identical — only the intended address encoding differs — but feeding a zpub into a wallet expecting an xpub produces addresses your other software never derived, a classic cause of "missing funds" support tickets where the coins are safe but invisible. Modern tooling increasingly sidesteps the ambiguity by wrapping the key inside an output descriptor, which states the script type explicitly so nothing has to be guessed from a prefix.
Where sovereign users rely on it
The xpub is the workhorse of serious self-custody setups. A hardware wallet exports its xpub once, and from then on the desktop or phone app builds a complete watch-only view — balances, history, fresh receive addresses — while the private keys never leave the signing device. A node runner points a self-hosted server at an xpub and gets payment detection with zero spending exposure. Miners can hand a pool or payout system an xpub-derived address stream instead of reusing one address. And multisig coordination is really an exchange of xpubs: each cosigner contributes one, and the wallet derives the shared addresses from the set. In every case the pattern is the same — give the online, hackable machine only the key that can watch, and keep the key that can spend in cold storage.
One operational detail worth knowing is the gap limit: wallet software scans derived addresses in order and stops looking after a run of consecutive unused ones — commonly twenty. A payment made to an address far beyond the gap can be invisible to a fresh restore until the scan window is widened, another classic "lost funds" scare with a configuration fix. Watch-only setups that hand out many addresses (donation pages, invoicing systems) should raise the gap limit deliberately.
Privacy caveat
An xpub is read-only for spending but is highly revealing: anyone holding it can compute your entire address history and watch every payment you receive on that branch, forever. There is no revoking it — once leaked, that branch's privacy is permanently gone, even for addresses you have not used yet. Treat an xpub as sensitive material. Share it only with services you genuinely trust, prefer a dedicated account (a separate derivation branch) for any third party that needs one, and remember that pasting an xpub into a random web-based balance checker hands your full financial history on that wallet to an unknown server. Self-hosting the software that consumes your xpub — your own node, your own block explorer — is the clean answer, keeping surveillance-grade data on hardware you control.
The xpub is a direct product of BIP32 HD wallets, and understanding it is the difference between using self-custody tools and actually knowing what they leak. Pair careful xpub hygiene with deliberate coin control and the watch-only pattern becomes one of Bitcoin's best sovereignty tools.
In Simple Terms
Extended public key, almost always written as an xpub, is a BIP32 public key bundled with its chain code. From it, software can derive an…