Change Address

A change address is a blockchain address, controlled by the sender's own wallet, that receives the leftover value from a transaction on a blockchain that uses unspent transaction outputs (UTXOs), such as Bitcoin, Litecoin and Bitcoin Cash. Because each output on these chains must be spent in full, a payment that uses more value than needed produces a second output carrying the remainder back to the sender. That remainder is the change, and the address it goes to is the change address.

Most modern wallets create a new change address for each transaction automatically, drawing it from the same seed phrase as the user's other addresses, so the funds remain under the user's control. Users usually never see these addresses directly, which is why change addresses sometimes confuse people who check their transactions on a blockchain explorer and see money apparently going to an unknown address.

Paying with bitcoin is a bit like paying with banknotes that cannot be torn. If you owe a shopkeeper 30 and only have a 100 note, you hand over the whole note and get 70 back. On a blockchain, there is no shopkeeper to give you change, so your wallet writes the transaction in two parts: 30 to the shop, and 70 back to you.

Instead of putting your 70 back into the same pocket the 100 came from, your wallet usually puts it in a brand-new pocket, the change address. Both pockets belong to you and are covered by your recovery words, but someone watching from outside cannot easily tell which of the two outputs was the payment and which was your change.

When a wallet builds a transaction, it follows a few steps:

1. Select inputs. The wallet chooses one or more of the user's UTXOs whose combined value covers the payment and the fee.
2. Create the payment output. An output is created to the recipient's address for the exact amount.
3. Create the change output. The difference between the inputs and the payment, minus the network fee, is sent to a change address.
4. Sign and broadcast. The wallet signs with the relevant private keys and sends the transaction to the network.

Wallets that follow the hierarchical deterministic (HD) design described in Bitcoin Improvement Proposal 32 and later proposals keep a separate "internal" chain of addresses reserved for change, so they can be recovered from the seed. If the change would be very small, below the "dust" level at which it costs more to spend than it is worth, wallets often add it to the fee instead.

Using a new change address each time makes it harder for observers to link transactions together. If change went back to the sender's original address, anyone could see which output was the payment and track the sender's remaining balance. Even with new addresses, blockchain analytics firms use heuristics to guess which output is change, such as:

• Round numbers. A payment is more likely to be a round amount like 0.05 BTC, so the odd amount is probably change.
• Address types. If one output uses the same address format as the inputs and the other does not, the matching one is likely change.
• Later spending. If an output is later spent together with the sender's other coins, it is likely to have been change.

Privacy techniques such as CoinJoin and careful coin selection are used to defeat these guesses. Address reuse, by contrast, weakens privacy, as discussed under Blockchain's Privacy Paradox.

Problems with change addresses usually come from using older or unusual software. In Bitcoin's early years, some users who restored only certain private keys from backups lost the change sent to addresses their backup did not cover; HD wallets largely solved this. Users who build transactions manually can forget to include a change output, in which case the whole remainder goes to miners as a fee, a mistake that has occasionally cost people large sums. Importing a single paper-wallet key into a modern wallet and spending part of it can also leave the change in an address the paper wallet does not hold. Users of hardware wallets are usually shown only the recipient output to confirm, with the device checking that the change address belongs to the same wallet. Account-based blockchains such as Ethereum do not use change addresses, because balances are updated directly rather than spent as whole outputs.