Definition
An x-only public key is the 32-byte key format introduced by BIP340 for Schnorr signatures and used throughout Taproot. Instead of recording both coordinates of a curve point, or the usual 33-byte compressed form with a leading sign byte, it stores only the x-coordinate and drops the prefix entirely. This trims four extra bytes off every key relative to legacy compressed encoding.
The even-Y convention
Each valid x-coordinate corresponds to two points on the curve, one with an even y-coordinate and one with an odd y. BIP340 resolves the ambiguity with a simple rule: the y-coordinate is always taken to be even. An x-only public key is therefore equivalent to a compressed public key prefixed by the byte 0x02. Choosing even-Y gives the greatest compatibility with existing key-generation systems, since standard compressed formats already signal y-coordinate parity.
Reconstructing the point
Verifiers rebuild the full point using the lift_x function: it checks that the x value is below the field prime, computes the corresponding y on the curve, returns the point whose y is even, and fails if no such point exists. This lets a verifier recover everything needed to check a signature from just 32 bytes.
The format depends on the underlying secp256k1 structure and the fact that the curve lives over a prime finite field, where square roots and parity are well-defined. For sovereign users, smaller keys mean smaller, cheaper, more private Taproot transactions.
In Simple Terms
An x-only public key is the 32-byte key format introduced by BIP340 for Schnorr signatures and used throughout Taproot. Instead of recording both coordinates of…