Crypto With Block

Lessons / How Blockchain Works

Keys and Signatures: How You Prove It's Yours

Crypto has no password. Learn how a private key and a digital signature prove ownership, and what to check before you sign anything.

9 min read Free lesson Fact-checked Nov 2026

How you prove it's yours

Hi, I'm Block. Here's something strange about crypto. There's no login screen. No username, no password, no forgot-password link. So how does the network know a coin is yours? In this lesson: the two keys behind every wallet, how a signature proves it's you, and why the moment you sign matters more than any password.

No bank in the middle

At a bank, you prove who you are to the bank. It checks your password, and if you forget it, the bank resets it. A blockchain has no bank in the middle. Nobody checks a password, because there's nobody to ask. Instead, you prove you control a secret, using math that anyone can check.

That secret is called a private key. And it isn't a word you make up. It's a number, picked at random by your wallet. Think of it less like a password and more like one ticket drawn from an unimaginably large drum. Nobody chose it, so nobody can guess it from knowing you.

Your private key is a random number, not a word you chose.

How large is that drum? There are roughly two to the power of two hundred fifty-six possible private keys. Written out, that's a number seventy-eight digits long. No computer could ever try them all, which is why nobody can stumble onto yours, as long as it was made truly at random.

Random is what makes it unguessable.

From that private key, your wallet does some one-way math to create a second key, called the public key. Then it runs the public key through a hash, the digital fingerprint from the last lesson, and the result becomes your address. Every step goes one way only.

Private key, public key, address. One way only.

Here's what that looks like on Ethereum, for example. A private key is sixty-four characters long. An address is zero x, followed by forty characters, taken from the hash of the public key. They look like random strings, and that's the point. Neither one tells anyone who you are.

Random strings that don't say who you are.

Now the important part. Going forward is easy. Going backward is effectively impossible. Anyone can see your address, and once you've sent a transaction, your public key too. But nobody can work backward from either one to your private key. That's what lets you share one and guard the other.

Share your address. Never your private key.

A good way to picture it is a mailbox with a slot. Your address is the slot. Anyone in the world can drop something in. Your private key is the only key that opens the box. Giving out your address is safe. Giving out the key gives away everything inside.

Address: hand it out. Key: never.

The password is local

So where does a password come in? Your wallet app may ask for one, or a PIN, or your face. But that only unlocks the app on your own device, where your key is stored. The network never sees that password. Anyone with the key itself can skip your password entirely, on their own device.

Your app password guards the device. The key guards the coins.

And the recovery phrase, those twelve or twenty-four words? It's a human-friendly backup of your keys. Each word comes from a fixed list of two thousand and forty-eight words, and the wallet can turn the phrase back into your keys. So anyone with your phrase can rebuild your keys on their own device.

Your recovery phrase is your keys.

That's also why one phrase can restore a whole wallet with many addresses in it. The wallet uses the phrase as a starting point and calculates every key from it, the same way, every time. Lose the phrase and you lose them all. Leak it and you leak them all.

One phrase unlocks every account in the wallet.

How signing works

Now the clever part: signatures. When you send crypto, your private key doesn't go anywhere. Your wallet uses it to sign the transaction, right there on your device. Then only the signed transaction goes out to the network, where any computer on it can check the signature. The key stays home. Only the signature travels.

The key stays home. Only the signature travels.

Think of an old wax seal on a letter. A digital signature is a seal only your private key can make. Anyone can check it, using your public key, and know it came from the matching private key. But checking the seal never reveals the key that made it.

Anyone can check the seal. Nobody can copy it.

And here's where it beats a handwritten signature. A digital signature is tied to the exact transaction it signs. Change the amount, or one character of the address, and the signature no longer checks out. It can't be cut out and pasted onto a different payment.

Change one character and the signature fails.

When your transaction reaches the network, every computer checking it asks the same question. Does this signature match the public key these coins are locked to? If yes, it's accepted. If not, it's thrown out. No account, no login, no help desk. Just a check anyone can run.

No login. Just a check anyone can run.

In fact, Bitcoin's original design paper describes a coin as a chain of digital signatures. Each owner signs the coin over to the next owner's key, and anyone can follow the signatures back through its history. Ownership isn't a name in a database. It's the latest valid signature in the chain.

Ownership is the latest valid signature.

Owning means signing

So owning crypto really comes down to one thing. Controlling the key that can sign for it. As far as the network is concerned, whoever can produce the signature owns the coins. It doesn't know your name. It only knows who can sign.

The network only knows who can sign.

Two ways in

Look at that last line, because it's the whole security lesson. The network can't tell whether you meant to sign. So attackers don't try to beat the math. They go after you, in one of two ways: get your key, or get you to sign their transaction.

The first way is the blunt one. A fake wallet page, a fake support agent, a fake giveaway, all asking for your private key or recovery phrase. No real app or company ever needs them, because signing happens in your wallet. Type your key into a website, and you've handed over your signature.

Your key never goes into a website.

The second way is quieter. You connect your wallet to a site, and a request pops up asking you to sign. It looks routine, like a login. But what it really grants is permission for someone else to move your tokens. We'll cover these permissions in their own lesson.

Security people call this blind signing. You approve something your screen can't show you clearly, often a wall of code instead of plain words, because you trust the page that asked. If you can't read what you're signing, don't sign it.

Can't read it? Don't sign it.

This isn't only a beginner's problem. In twenty twenty-five, one of the world's biggest crypto exchanges lost about one and a half billion dollars in a single transaction. That wallet needed several staff members to approve every transfer, and it still happened. The FBI linked the theft to North Korean hackers.

How did it happen? Attackers broke into a developer's computer at the wallet service the exchange used, and slipped bad code into its website. When staff went to approve a routine transfer, the page showed the normal transaction. But the data they actually signed handed control of the wallet to the attackers.

The keys weren't stolen. The signatures were.

Investigators found the signing devices showed different details from the web page, but in a form that was hard to read, so the signers trusted the website instead. The lesson for all of us: trust what your wallet's own screen says, not the page around it.

Trust your wallet's own screen, not the web page.

So here's my checklist before signing anything. Did I start this, or did a message send me here? Is this the real site, typed or bookmarked? Does the wallet's own screen show plain words I understand? Do the amount and the address match what I expect? If any answer is no, reject it. Rejecting costs nothing.

Any doubt? Reject. It costs nothing.

This is also why many people keep their keys on a hardware wallet. The private key stays on that small device, and the signing happens inside it. You check the details on its own screen and press a button to approve. Even a computer full of malware can't sign without you.

Check it on the device. Press to approve.

No reset, no undo

And one more thing that surprises people. With no password and no bank in the middle, there's also no reset and no undo. Lose your key and your backup, and nobody can restore access. Sign a bad transaction, and nobody can reverse it. That's the trade: total control, and total responsibility.

Total control means total responsibility.

Which means anyone who offers to reset your keys, reverse a transaction, or recover your coins for a fee is selling something that can't exist. Here's how it usually shows up. Nobody can sign for coins without the key. Not support, not a hacker for hire, not anyone.

Keys and signatures

Here's the whole lesson in four lines. Your private key is a giant random number. Your address comes from it, one way only. A signature proves you hold the key without revealing it. And a signature means yes, so read before you sign. There's no password. There's only what you sign.

No password. Only what you sign.

Sources

Education only. Not financial advice.

Education only. Not financial, investment, tax or legal advice. Block, our on-screen presenter, is AI-generated, voice included; the research and scripts are ours.