What Is an xPub Key? How One Key Generates Unlimited Bitcoin Addresses

Most merchants never think about why their crypto payment processor never reuses an address. The answer is xPub keys — and understanding them explains why non-custodial payments are possible at all.

The Problem Non-Custodial Payments Had to Solve

When you accept card payments, a processor handles everything — they hold credentials, generate tokens, and move money. You trust them. With crypto, the whole point is that you do not have to trust anyone. But that raises an obvious question: if your payment processor never touches your private keys, how does it know which addresses to watch for incoming payments?

The answer is the extended public key, universally called an xPub key. It is one of the most important concepts in Bitcoin — and almost nobody outside of developer circles knows it exists.

What a Regular Public Key Does

In Bitcoin, every wallet address is derived from a private key. The private key is secret — it is what lets you spend funds. The public key is derived from the private key using elliptic curve cryptography. It is safe to share, because there is no known mathematical path from public key back to private key.

A standard Bitcoin address is essentially a hashed version of a public key. Share the address, receive funds. Simple. But if you only have one public key, you only have one address — and reusing the same address for every payment is terrible for privacy and makes your transaction history completely public.

What an xPub Key Is

An extended public key (xPub) is a public key plus a piece of extra data called a chain code. Together, they form a parent key that can mathematically derive a virtually unlimited sequence of child public keys — and therefore a virtually unlimited sequence of child addresses.

You do not need the private key to do this. The xPub alone is enough to generate every address in the sequence. This is the core insight of BIP32, the Bitcoin Improvement Proposal that defined hierarchical deterministic wallets in 2012.

An xPub lets anyone generate your receive addresses without ever being able to spend your funds.

An xPub key looks like this:

xpub6CUGRUonZSQ4TWtTMmzXdrXDtypWKiKrhko4egpiMZbpiaQL2jkwSB1icqYh2cfDfVxdx4df189oLKnC5fSwqPfgyP3hooxujYzAu3fDVmz

It is a long base58-encoded string. Anyone who has it can watch your incoming transactions. Nobody who has it can move your money.

How Child Address Derivation Works

Starting from an xPub, a wallet derives child addresses using a deterministic formula defined in BIP32. You provide an index — 0, 1, 2, 3, and so on — and the algorithm produces a unique public key for each one. That key maps to a unique Bitcoin address.

The derivation path looks like this:

m / purpose' / coin_type' / account' / change / index

For a typical Bitcoin receive address under BIP44:

m/44'/0'/0'/0/0   → first receive address
  m/44'/0'/0'/0/1   → second receive address
  m/44'/0'/0'/0/2   → third receive address

The apostrophes denote hardened derivation — those steps require the private key and are used to separate accounts. The final two segments (change and index) use only the xPub, which is

Why This Is Useful for Merchants

When you connect a crypto payment processor to your wallet using an xPub key, here is what happens:

You export the xPub from your wallet (hardware or software) and paste it into the processor.
For each new order, the processor derives the next unused address in the sequence.
The processor monitors those addresses for incoming transactions.
When payment arrives, it notifies your server via webhook.
The funds land directly in your wallet — the processor never held them.

The processor has zero ability to move your funds at any point. It can only watch. This is what non-custodial means in practice — not a vague promise, but a specific technical guarantee backed by the xPub architecture.

Privacy: Why Fresh Addresses Matter

Bitcoin's blockchain is fully public. If you reuse a single address, every payment you have ever received is visible to anyone with your address. Suppliers, customers, and competitors can all see your revenue. Address reuse is one of the most common privacy mistakes in crypto.

Because xPub-derived wallets generate a new address for every transaction, each payment is isolated. Linking them together requires chain analysis — which is possible but significantly harder, and out of reach for casual observers.

What You Should Not Share

An xPub key is not the same as a private key, but it is not entirely harmless either:

Do share: Your xPub with your payment processor. That is its purpose.
Do not share: Your xPub publicly. Someone with your xPub can see every address you have ever generated and will generate, linking all your transactions together.
Never share: Your seed phrase or private key. Ever. With anyone.

The xPub is a read-only view of your wallet's address space. Treat it like you would treat a read-only database credential — it is fine to give to a system that needs it, but not fine to post on the internet.

xPub vs Other Extended Key Formats

You may also encounter ypub and zpub keys. These are the same concept — extended public keys — but encoded differently to indicate which address format the wallet uses:

xpub — Legacy P2PKH addresses (starting with 1)
ypub — P2SH-wrapped SegWit addresses (starting with 3)
zpub — Native SegWit (Bech32) addresses (starting with bc1)

Most modern wallets use zpub for Bitcoin and expose native SegWit addresses by default. If your payment processor asks for an xpub but your wallet exports a zpub, some tools can convert between them.

The Bottom Line

The xPub key is what makes trustless crypto payments possible. It separates the ability to receive funds from the ability to spend them — giving payment infrastructure exactly the access it needs and nothing more. Every time a crypto merchant generates a fresh address for a new order without giving up control of their wallet, an xPub key is working behind the scenes.

If you are evaluating crypto payment processors, the first question to ask is whether they support xPub integration. If they do not, they are holding your funds — and that is a different risk model entirely.