A wallet address is a string of characters that identifies a destination for funds on a blockchain. It is derived from a public key or from a script describing the conditions for spending, and it can be shared openly so others can send payments. Every crypto wallet creates addresses, and every on-chain transfer names one as its recipient.
An address plays a role similar to a bank account number but with important differences: anyone can create one without permission, its full transaction history is visible on a public block explorer, and payments sent to a mistyped but valid address normally cannot be recovered. Each blockchain has its own format, so a Bitcoin (BTC) address and an Ethereum (ETH) address look quite different.
Wallet address in plain terms
A wallet address works like a numbered post-office box with a slot in the door. You can print the box number on your invoices, and anyone who knows it can drop an envelope through the slot. Only the person with the key can open the box and take the envelopes out.
Giving out the box number is safe; giving out the key is not. The catch is that the box numbers are long and look random, so a single wrong character sends the envelope to someone else's box, and there is no post office to call. That is why addresses carry built-in spelling checks and why careful users copy, paste and then check them before sending.
How addresses are created
The process starts with a private key. Elliptic-curve maths produces the public key from it, and the public key is then put through one or more hash functions to make a shorter fingerprint. That fingerprint is encoded in a readable alphabet, often with a version prefix and a checksum so that typing mistakes are caught. Because the steps run only one way, an address reveals nothing usable about the private key. Wallets that follow the hierarchical deterministic standards can derive a fresh address for every payment from a single seed phrase.
Bitcoin address formats
Bitcoin has several address types, each matching a way of locking unspent transaction outputs (UTXOs):
| Format | Starts with | Defined in | Notes |
|---|---|---|---|
| Pay-to-Public-Key-Hash (P2PKH) | 1 | Original Bitcoin software | Base58Check encoding of a public-key hash; the oldest common format. |
| Pay-to-Script-Hash (P2SH) | 3 | BIP-16 | Pays to the hash of a script, used for multi-sig wallets and wrapped SegWit. |
| Native SegWit (bech32) | bc1q | BIP-173 | Introduced with Segregated Witness (SegWit); lower-case only, with stronger error detection. |
| Taproot (bech32m) | bc1p | BIP-350 | A revised bech32 encoding used for Taproot outputs. |
Each format and its encoding was set out through the Bitcoin Improvement Proposal (BIP) process. Bitcoin's testnet uses different prefixes, such as tb1 for bech32, so test coins cannot be confused with real ones.
Ethereum addresses and EIP-55 checksums
An Ethereum address is the last 20 bytes of the Keccak-256 hash of the public key, written as 40 hexadecimal characters after the prefix 0x. Plain hexadecimal has no checksum, so in 2016 Vitalik Buterin proposed EIP-55, which encodes a checksum in the mix of upper- and lower-case letters. Software that supports EIP-55 can warn when a single character has been changed, while older all-lower-case addresses still work.
The same format is used across Ethereum-compatible blockchains, so one address can hold funds on several networks; sending tokens on the wrong network is a common and sometimes costly mistake. An address can belong to an externally owned account (EOA) controlled by a key, or be a contract address controlled by code. Services such as the Ethereum Name Service (ENS) map readable names like alice.eth to these hexadecimal strings, and payment requests often carry an address as a QR code.
Privacy and security issues
Because every address's history is public, reusing one address for many payments makes it easy to link activity to a person, a concern discussed under blockchain's privacy paradox. Blockchain analytics firms cluster addresses that appear to share an owner, and attackers use small unsolicited payments in a dusting attack to help with that clustering.
Other address-based threats include clipboard malware that swaps a copied address for the attacker's, and the wallet address poisoning scam, in which scammers send tiny transfers from an address that matches the first and last characters of one the victim uses, hoping it will be copied from the history later. Some addresses are deliberately unspendable, such as a burn address used to destroy tokens. Checking the full address on a hardware device's screen, sending a small test payment first, and using saved address books are standard defences.