Definition
A watch-only wallet holds only public key material, typically an extended public key (xpub) or a full output descriptor, and no private keys whatsoever. Because Bitcoin addresses are derived from public keys, this is enough to generate receive addresses, scan the chain for incoming and outgoing payments, display balances, and even construct unsigned transactions. What it cannot do is sign, so it cannot move funds. That separation is precisely the point.
Pairing watch-only with cold storage
The classic use is monitoring cold storage from an everyday device. You export the public key or descriptor from an offline signer and import it into a watch-only wallet on your phone or desktop. Now you can check that a payment arrived or draft a spend without ever bringing private keys near an online machine. The unsigned transaction is then carried to the offline signer for approval.
Descriptors make watch-only reliable
An xpub alone tells software which keys exist but not which address types to derive. A modern output descriptor (BIP380) encodes the script type, derivation path, and key origin, so a restored watch-only wallet reproduces exactly the right addresses, including SegWit and Taproot. This avoids the old problem of a watch-only wallet showing the wrong addresses or missing funds after an import.
This is the read side of the Air-Gapped Signing workflow; see also Descriptor Wallet for how the public keys are described.
In Simple Terms
A watch-only wallet holds only public key material, typically an extended public key (xpub) or a full output descriptor, and no private keys whatsoever. Because…