ENTROPÍA

xpub vs ypub vs zpub: what the difference is and why it matters

It looks like a formatting detail. It isn't: that prefix is the field that decides whether your backup gives you your wallet back or gives you an empty one.

The prefix on a master public key encodes which address type that branch will derive. It is not the same key written differently — it is the same key plus an instruction on how to use it.

What each one means

There is a fourth type, Taproot (bc1p, BIP-86), which generally is not identified by its own prefix but by the descriptor.

Source for the central point: Electrum's documentation on extended-key version bytes.

Why this wrecks restores

Here is the uncomfortable part. The same key can be written in more than one script type, and each one produces a different, perfectly valid address. In Bitcoin Core's descriptor syntax those four paths are written pkh(), sh(wpkh()), wpkh() and tr().

So a single key yields four addresses that are all "yours", and three of them can read zero.

Nothing fails and nothing warns you. The software runs exactly the calculation you asked for, at the wrong door, and shows you the result without a single error message.

That is why "my seed restored and the wallet is empty" is almost never lost money: it is the wrong branch. And it is why writing down only the twelve words is not enough — you are missing the line that says which of the four.

How to find out which one is yours, without risking anything

If you run a node, Bitcoin Core answers this without exposing any secret: getdescriptorinfo parses the descriptor and returns its checksum and the hasprivatekeys field, and deriveaddresses prints exactly the addresses that descriptor will produce. If they match what your wallet shows, that is your branch.

If you don't run a node, the same test works in the browser. The ceremony derives address zero from your extended public key and the type you pick, and matches it against the first address your wallet shows. Under two minutes, never asks for the seed, and the page declares connect-src 'none': it cannot send a byte anywhere, and that is in the headers.

One warning worth stating

An extended public key cannot sign, but it is not harmless: it reveals every address in that account — the full history and all future balances. Do not publish it. Handing it to a service hands over your entire ledger.

And watch the inverse: a descriptor can carry private material inside — wherever it accepts an xpub, Bitcoin Core also accepts an xprv. If what you are holding starts with xprv, that one can sign: it is the wallet, not a fact about the wallet.

Keep reading