<p>False, as you've described it here, because <strong>private and public keys work a little differently than that</strong>.  The underlying math is tricky, but I'll try and give a common sense explanation in everyday language instead.</p>

<p><strong>Imagine that there was a special metal called Cryptonium, harder than anything else on earth and completely indestructible.</strong>  No one else knows it exists, much less how to make things out of it.  Let's also say you had a special machine which could make plaques out of Cryptonium, with raised letters on them saying whatever you wanted.  <em>Obviously, you would keep the existence of this plaque-making machine a closely guarded secret</em>.  You probably wouldn't even want anyone to know it was you that owned it.  But you still want to share this exciting discovery with the world, so you secretly produce a message that says "Behold, a new and indestructible metal!"  Then, late at night, you sneak into the middle of town and put the Cryptonium plaque up in the town square.</p>

<p>The next day, everyone gathers in the town square to wonder at this amazing new plaque.  They take turns bashing at it with the hardest, sharpest, heaviest things they can find, and the plaque remains perfectly unscratched.  "Sure enough," they figure, "it's indestructible."</p>

<p>You decide to use the secret machine to write more things, helping out the townspeople and gradually earning a reputation as a trustworthy and reliable source, <em>even though nobody knows who you are.</em>  But a few months later something terrible happens.  New plaques start showing up in town during the night, and they are <strong>fakes!!</strong>  Someone else is taking advantage of your reputation to spread false and misleading messages!  They don't have your special machine of course--they're making their plaques out of platinum, and it's only <em>almost</em> indestructible.  But the two metals look the same, and the townspeople don't know the difference.  What will you do?</p>

<p>You could announce yourself to the townspeople, show them the machine, and tell them the new plaques are fakes.  They might believe you, but your machine wouldn't be a secret anymore.  So instead you do something really clever.  <strong>You use the machine to make a small, square plaque in the shape of a hammer's head.</strong>  On the plaque, you put the message "This hammer will destroy all fake plaques." Then, you attach a handle to the hammer head you've made and leave it in the middle of town the next night.</p>

<p>Now, the townspeople can simply use the hammer to break all the fake platinum plaques.  Sure enough, the false and misleading messages are all easily destroyed, while the ones you've produced are able to withstand the hammer's force.  Your reputation is preserved, and <em>your secret was never revealed</em>.  Together the hammer, the secret machine, and the plaques form an unbeatable system that lets you send messages which could only have come from you--<strong>without</strong> revealing who you really are.  Not bad, hey?</p>

<p>In many ways <strong>public key cryptography works like our imaginary Cryptonium metal</strong>.  It's made up of three parts, and it gives other people a way to be certain a message came from you without you having to reveal your identity or your secret way of making messages.  Like the Cryptonium system, <strong>you need all three components to make the system work.  These three parts are your public key, your private key, and your signatures</strong> (which you can make as many of as you like, signing all different messages.)  In our story, the private key is like the secret machine, the public key is like the hammer, and the signatures are like the plaques.  In reality public key cryptography is more complex than I've described here, and if you want to learn more about it you can check out <a href="https://www.khanacademy.org/math/applied-math/cryptography" rel="nofollow">this course from Khan Academy</a>.  However this example should be good enough to understand how private and public keys are used in Bitcoin.</p>

<p>First, <strong>nobody else ever sees your private key</strong>. Instead, like the secret machine, you use your private key to make <em>signatures</em> (like the plaques) that people can be certain came from you.  Each person (and each bitcoin address) has <strong>both</strong> a public and a private key, which share a special mathematical relationship, and the <em>public</em> key (like the hammer) is what other people can use to verify your signatures are real.  When you send a Bitcoin transaction, you don't give away your secret machine--you only use it to make a <em>message</em> saying who you're giving the bitcoins to.  This signed message, or signature, couldn't have come from anyone else except the owner of the address, so then everyone knows the transaction is real.</p>

<p>Second, <strong>private keys don't come from miners--they come from <em>you</em></strong>.  You're the one who secretly chooses a random private key (the Bitcoin software does this for you), and that private key was used to figure out your address (which is basically a version of your public key) before anyone ever sent it some bitcoins.  Miners never have it to begin with.  They only see your transactions (signatures) and your receiving address (public key).</p>

<p>Finally, just to confuse things a little bit, <strong>you have to use up a whole transaction at one time</strong>.  So if someone sent you 10 bitcoins, and you want to send someone else 5 of them, you actually send out a transaction that takes all 10 that you received, sends 5 to the other person's address, and 5 to another address of your own (this is called the "change" from your transaction).  Bitcoin does this so that other people can't tell which part of the transaction is what you sent and which part is the change (nobody knows which addresses belong to the same person).  It helps protect your privacy.  But if you wanted to, you could send the change back to the same address, because your private keys are still safe.  You'd just have to use a different client than the default Bitcoin client, because it doesn't have a way to do that.  <strong>All of this happens behind the scenes, which is why your balance still shows as 5 bitcoins after you do this</strong>.  Bitcoin stores all your different addresses and private keys in something called a <em>wallet</em>, and the balance is the total bitcoins owned by the wallet.  So it keeps everything simple up front!</p>

<p>Make sense?  Hope it wasn't too long, but I wanted to try and make the public/private key thing more clear.</p>

CC BY-SA 3.0
2013-04-30T20:31:17.797Z
Really nice layman explanation!
Pieter Wuille
CC BY-SA 3.0
2013-04-29T05:49:18.027Z
2013-04-30T18:40:14.700Z
2013-04-30T18:40:14.700Z
eMansipater
<p>No. Transactions work by <a href="http://en.wikipedia.org/wiki/Elliptic_Curve_DSA" rel="nofollow noreferrer">ECDSA</a> signing.</p>
<p>Basically, you write up a transaction and you <em>sign</em> it with your private key. Anyone who has your public key, the message, and the signature can easily verify that the owner of said public key is the one who signed the message (on the other hand, forging a signature is extremely difficult)</p>
<p>Transactions can have multiple inputs: In such a case a signature from each input key is required.</p>
<p>They also can have multiple outputs. Generally, a transaction depletes <em>all</em> the money in the inputs. All the change is fed back to the inputs, so a  transaction may have the inputs A(balance 10 BTC) and B(balance 15 BTC), with a 20 BTC output to C(owned by someone else), and a 5 BTC output back to A. Most clients by default create &quot;change addresses&quot; (or give you the option to do so). In such cases, a new address D is created to receive the change of the transaction, and the new address is added to your wallet (this keeps you a bit more anonymous. Your sender keys may be connected to your identity if there was some non-anonymous exchange involved in the transaction. The change key won't necessarily be connected with you)</p>
<p>Any bitcoins not accounted for in a transaction are considered as &quot;transaction fees&quot; and are an extra incentive for the miner to collect.</p>
<p>See also: <a href="https://bitcoin.stackexchange.com/q/9007/1453">Why are there two transaction outputs when sending to one address?</a></p>

CC BY-SA 3.0
2013-04-29T21:37:35.977Z
thats not right. by default, change is returned automatically to a new address.  you have to specifically direct change to an originating address.
joe
CC BY-SA 3.0
2013-04-29T21:39:38.920Z
@joe: That's in the official bitcoin client. The protocol specifies no such thing.
Manishearth
CC BY-SA 3.0
2013-04-29T22:09:14.363Z
i'm not aware of any client that returns change to the originating address by default.
joe
CC BY-SA 3.0
2013-04-29T22:13:58.647Z
@joe: ..so? I never mentioned that in my answer. However, it is an option in some to turn off change addresses.
Manishearth
CC BY-SA 3.0
2013-04-29T22:34:14.707Z
you said a "typical" tx will return the change originating from A back to A.  that's incorrect since by default all clients that i know of send change back to a new address D and most ppl don't bother or even know about returning change back to its originating address.
joe
CC BY-SA 3.0
2013-04-30T02:43:28.393Z
@joe: Fixed, happy? I was talking about the protocol, not the implementation. Change addresses are a feature of the client, not the protocol.
Manishearth
CC BY-SA 3.0
2013-04-30T13:14:40.550Z
@joe AFAIK the android client "bitcoin spinner" returns change to the originating address.
laanwj
CC BY-SA 3.0
2013-04-30T22:21:34.847Z
@wump thats b/c in Spinner there is only one key pair so it's not possible to return change to a different address.
joe
CC BY-SA 3.0
2013-04-29T05:11:38.523Z
2013-04-30T02:42:54.173Z
2020-06-16T11:10:03.350Z
Manishearth
<p>Short answer is No.</p>

<p>no new address is created. Bitcoin simply realizes that the balance of the former private key is deducted by 5 bitcoins.</p>

CC BY-SA 3.0
2013-04-29T04:50:59.857Z
2013-04-29T04:50:59.857Z
user4951
<p>Here is my current understanding of Bitcoin:</p>

<p>I have 10 bitcoins in my wallet.</p>

<p>If I send 5 bitcoins to someone else, I am sending the private key from my wallet to somebody's public key address.</p>

<p>Those are combined into a new transaction that is later confirmed by miners. The miners confirm that I owned the bitcoins by checking my private key, and that the receiver's public key is valid.</p>

<p>Then, the miners create a new private key that is sent to the receiver's wallet.</p>

<p><strong>On a simple True/False basis, is everything I have said right so far?</strong></p>

<p>If so, what happens to the remaining 5 bitcoins in my wallet?  Do they magically get a new private key, or what? How does my wallet know how many I have left, and how do the remaining bitcoins get a new identity?</p>

CC BY-SA 3.0
2013-04-29T03:28:50.433Z
I edited the title to better reflect your question, hope that's okay.  I'll be posting an answer for you in a second.
eMansipater
CC BY-SA 3.0
2013-04-29T03:29:41.290Z
possible duplicate of [Understanding a transaction input and outputs](http://bitcoin.stackexchange.com/questions/9007/understanding-a-transaction-input-and-outputs)
Stephen Gornick
CC BY-SA 3.0
2013-04-29T03:31:31.953Z
Related: http://bitcoin.stackexchange.com/q/1629/153
Stephen Gornick
CC BY-SA 3.0
2013-04-29T03:38:14.497Z
I don't think this is a duplicate of either of those, nor do I think it's a bad question.  I think it's a simple matter of needing to know how public and private keys work in Bitcoin.  Please don't downvote--it's hardly user4710's fault they aren't versed in the details of public key cryptography.  My answer will be up shortly.
eMansipater
CC BY-SA 3.0
2013-04-29T08:58:42.493Z
-1 not voting to close, but the way it is worded is so confused that I don't think it's a good thing to have such a question, until it has been edited to something better (which may help future visitors, instead of confusing them).
o0'.
CC BY-SA 3.0
2013-04-29T16:40:28.167Z
@Lohoris what did you find confusing about it?
eMansipater
CC BY-SA 3.0
2013-04-29T17:26:12.717Z
@eMansipater pretty much everything, it would need a complete re-word, from scratch, to become a good post, IMHO.
o0'.
CC BY-SA 3.0
2013-04-29T17:32:03.660Z
It's very readable for me.  Do you mean just because of all the wrong assumptions?  That, for me, *is* the question.
eMansipater
CC BY-SA 3.0
2013-04-29T20:56:55.003Z
@Lohoris I've edited the question.  Does my edit take care of your concerns?  If not I feel like you are just saying it's a bad question because of the low level of understanding demonstrated.  Lack of understanding should never be considered a crime on Stack Exchange--only failure to express that lack of understanding as a useful, answerable question.  This one seems like a perfectly reasonable misconception, asked clearly.  Don't bite the newbs, people!  _Users_ of this stack exchange shouldn't have to be cryptographers before they're allowed to ask questions.
eMansipater
CC BY-SA 3.0
2013-04-30T08:22:29.933Z
@eMansipater ok now it's clearer. I guess it was the combination of bad writing + noob question that prevented me from understanding what he was asking. No problem with noob questions, I just wasn't able to understand _what_ he was talking about.
o0'.
<wallet><private-key><public-key>
Is a private key used up when part of the bitcoins it controls are sent?
user4710
# Is a private key used up when part of the bitcoins it controls are sent?

(Asked by: username_0 on 2013-04-29)

Here is my current understanding of Bitcoin:

I have 10 bitcoins in my wallet.

If I send 5 bitcoins to someone else, I am sending the private key from my wallet to somebody's public key address.

Those are combined into a new transaction that is later confirmed by miners. The miners confirm that I owned the bitcoins by checking my private key, and that the receiver's public key is valid.

Then, the miners create a new private key that is sent to the receiver's wallet.

**On a simple True/False basis, is everything I have said right so far?**

If so, what happens to the remaining 5 bitcoins in my wallet? Do they magically get a new private key, or what? How does my wallet know how many I have left, and how do the remaining bitcoins get a new identity?

**Tags:** wallet, private-key, public-key

> **Comments:**
> **username_1**: I edited the title to better reflect your question, hope that's okay.  I'll be posting an answer for you in a second.  
> **username_2**: possible duplicate of [Understanding a transaction input and outputs](http://bitcoin.stackexchange.com/questions/9007/understanding-a-transaction-input-and-outputs)  
> **username_2**: Related: http://bitcoin.stackexchange.com/q/1629/153  
> **username_1**: I don't think this is a duplicate of either of those, nor do I think it's a bad question.  I think it's a simple matter of needing to know how public and private keys work in Bitcoin.  Please don't downvote--it's hardly username_0's fault they aren't versed in the details of public key cryptography.  My answer will be up shortly.  
> **username_3**: -1 not voting to close, but the way it is worded is so confused that I don't think it's a good thing to have such a question, until it has been edited to something better (which may help future visitors, instead of confusing them).  
> **username_1**: @Lohoris what did you find confusing about it?  
> **username_3**: @username_1 pretty much everything, it would need a complete re-word, from scratch, to become a good post, IMHO.  
> **username_1**: It's very readable for me.  Do you mean just because of all the wrong assumptions?  That, for me, *is* the question.  
> **username_1**: @Lohoris I've edited the question.  Does my edit take care of your concerns?  If not I feel like you are just saying it's a bad question because of the low level of understanding demonstrated.  Lack of understanding should never be considered a crime on Stack Exchange--only failure to express that lack of understanding as a useful, answerable question.  This one seems like a perfectly reasonable misconception, asked clearly.  Don't bite the newbs, people!  _Users_ of this stack exchange shouldn't have to be cryptographers before they're allowed to ask questions.  
> **username_3**: @username_1 ok now it's clearer. I guess it was the combination of bad writing + noob question that prevented me from understanding what he was asking. No problem with noob questions, I just wasn't able to understand _what_ he was talking about.  

---

## 3 answers

### Answer by username_1 on 2013-04-29. Score: 7

False, as you've described it here, because **private and public keys work a little differently than that**. The underlying math is tricky, but I'll try and give a common sense explanation in everyday language instead.

**Imagine that there was a special metal called Cryptonium, harder than anything else on earth and completely indestructible.** No one else knows it exists, much less how to make things out of it. Let's also say you had a special machine which could make plaques out of Cryptonium, with raised letters on them saying whatever you wanted. *Obviously, you would keep the existence of this plaque-making machine a closely guarded secret*. You probably wouldn't even want anyone to know it was you that owned it. But you still want to share this exciting discovery with the world, so you secretly produce a message that says "Behold, a new and indestructible metal!" Then, late at night, you sneak into the middle of town and put the Cryptonium plaque up in the town square.

The next day, everyone gathers in the town square to wonder at this amazing new plaque. They take turns bashing at it with the hardest, sharpest, heaviest things they can find, and the plaque remains perfectly unscratched. "Sure enough," they figure, "it's indestructible."

You decide to use the secret machine to write more things, helping out the townspeople and gradually earning a reputation as a trustworthy and reliable source, *even though nobody knows who you are.* But a few months later something terrible happens. New plaques start showing up in town during the night, and they are **fakes!!** Someone else is taking advantage of your reputation to spread false and misleading messages! They don't have your special machine of course--they're making their plaques out of platinum, and it's only *almost* indestructible. But the two metals look the same, and the townspeople don't know the difference. What will you do?

You could announce yourself to the townspeople, show them the machine, and tell them the new plaques are fakes. They might believe you, but your machine wouldn't be a secret anymore. So instead you do something really clever. **You use the machine to make a small, square plaque in the shape of a hammer's head.** On the plaque, you put the message "This hammer will destroy all fake plaques." Then, you attach a handle to the hammer head you've made and leave it in the middle of town the next night.

Now, the townspeople can simply use the hammer to break all the fake platinum plaques. Sure enough, the false and misleading messages are all easily destroyed, while the ones you've produced are able to withstand the hammer's force. Your reputation is preserved, and *your secret was never revealed*. Together the hammer, the secret machine, and the plaques form an unbeatable system that lets you send messages which could only have come from you--**without** revealing who you really are. Not bad, hey?

In many ways **public key cryptography works like our imaginary Cryptonium metal**. It's made up of three parts, and it gives other people a way to be certain a message came from you without you having to reveal your identity or your secret way of making messages. Like the Cryptonium system, **you need all three components to make the system work. These three parts are your public key, your private key, and your signatures** (which you can make as many of as you like, signing all different messages.) In our story, the private key is like the secret machine, the public key is like the hammer, and the signatures are like the plaques. In reality public key cryptography is more complex than I've described here, and if you want to learn more about it you can check out [this course from Khan Academy](https://www.khanacademy.org/math/applied-math/cryptography). However this example should be good enough to understand how private and public keys are used in Bitcoin.

First, **nobody else ever sees your private key**. Instead, like the secret machine, you use your private key to make *signatures* (like the plaques) that people can be certain came from you. Each person (and each bitcoin address) has **both** a public and a private key, which share a special mathematical relationship, and the *public* key (like the hammer) is what other people can use to verify your signatures are real. When you send a Bitcoin transaction, you don't give away your secret machine--you only use it to make a *message* saying who you're giving the bitcoins to. This signed message, or signature, couldn't have come from anyone else except the owner of the address, so then everyone knows the transaction is real.

Second, **private keys don't come from miners--they come from *you***. You're the one who secretly chooses a random private key (the Bitcoin software does this for you), and that private key was used to figure out your address (which is basically a version of your public key) before anyone ever sent it some bitcoins. Miners never have it to begin with. They only see your transactions (signatures) and your receiving address (public key).

Finally, just to confuse things a little bit, **you have to use up a whole transaction at one time**. So if someone sent you 10 bitcoins, and you want to send someone else 5 of them, you actually send out a transaction that takes all 10 that you received, sends 5 to the other person's address, and 5 to another address of your own (this is called the "change" from your transaction). Bitcoin does this so that other people can't tell which part of the transaction is what you sent and which part is the change (nobody knows which addresses belong to the same person). It helps protect your privacy. But if you wanted to, you could send the change back to the same address, because your private keys are still safe. You'd just have to use a different client than the default Bitcoin client, because it doesn't have a way to do that. **All of this happens behind the scenes, which is why your balance still shows as 5 bitcoins after you do this**. Bitcoin stores all your different addresses and private keys in something called a *wallet*, and the balance is the total bitcoins owned by the wallet. So it keeps everything simple up front!

Make sense? Hope it wasn't too long, but I wanted to try and make the public/private key thing more clear.

> **Comments:**
> **username_4**: Really nice layman explanation!  

---

### Answer by username_5 on 2013-04-29. Score: 3

No. Transactions work by [ECDSA](http://en.wikipedia.org/wiki/Elliptic_Curve_DSA) signing.

Basically, you write up a transaction and you *sign* it with your private key. Anyone who has your public key, the message, and the signature can easily verify that the owner of said public key is the one who signed the message (on the other hand, forging a signature is extremely difficult)

Transactions can have multiple inputs: In such a case a signature from each input key is required.

They also can have multiple outputs. Generally, a transaction depletes *all* the money in the inputs. All the change is fed back to the inputs, so a transaction may have the inputs A(balance 10 BTC) and B(balance 15 BTC), with a 20 BTC output to C(owned by someone else), and a 5 BTC output back to A. Most clients by default create "change addresses" (or give you the option to do so). In such cases, a new address D is created to receive the change of the transaction, and the new address is added to your wallet (this keeps you a bit more anonymous. Your sender keys may be connected to your identity if there was some non-anonymous exchange involved in the transaction. The change key won't necessarily be connected with you)

Any bitcoins not accounted for in a transaction are considered as "transaction fees" and are an extra incentive for the miner to collect.

See also: [Why are there two transaction outputs when sending to one address?](https://bitcoin.stackexchange.com/q/9007/1453)

> **Comments:**
> **username_6**: thats not right. by default, change is returned automatically to a new address.  you have to specifically direct change to an originating address.  
> **username_5**: @username_6: That's in the official bitcoin client. The protocol specifies no such thing.  
> **username_6**: i'm not aware of any client that returns change to the originating address by default.  
> **username_5**: @username_6: ..so? I never mentioned that in my answer. However, it is an option in some to turn off change addresses.  
> **username_6**: you said a "typical" tx will return the change originating from A back to A.  that's incorrect since by default all clients that i know of send change back to a new address D and most ppl don't bother or even know about returning change back to its originating address.  
> **username_5**: @username_6: Fixed, happy? I was talking about the protocol, not the implementation. Change addresses are a feature of the client, not the protocol.  
> **username_7**: @username_6 AFAIK the android client "bitcoin spinner" returns change to the originating address.  
> **username_6**: @wump thats b/c in Spinner there is only one key pair so it's not possible to return change to a different address.  

---

### Answer by username_8 on 2013-04-29. Score: 0

Short answer is No.

no new address is created. Bitcoin simply realizes that the balance of the former private key is deducted by 5 bitcoins.


---

