Bitcoin addresses are cryptic strings of numbers and characters. They are used by large corporations, public exchanges, groups of special interest, and individuals alike. But what is a Bitcoin address? For just using it you may not need to know. If you're interested, follow through this brief overview to understand where it comes from, why it is virtually uncrackable, and how you can make your own valid Bitcoin addresses at home.

What is a Bitcoin Address

A Bitcoin address is a unique identifier denoting a value holding point on the Bitcoin blockchain. The information the blockchain contains about an address is true for all participants. It can be used as the source or destination of transactions that move funds from or to that address.

There are three Bitcoin address types currently in use:

• P2PKH ("Pay-To-PubKey-Hash") addresses: The most common type still, used for a very long time throughout Bitcoin's lifecycle.
  Example: 1FfmbHfnpaZjKFvyi1okTjJJusN455paPH
  These addresses always start with a "1". They are between 26 and 36 characters long, and are alphanumeric.
  
  
• P2SH ("Pay-To-Script-Hash") addresses: Allows to set up preconditions for transactions to go through. This can range from requiring multiple signatures, providing a password, or other completely unique requirements. Sending funds to this type of address is approximately 25% cheaper than when using P2PKH addresses.
  Example: 3P14159f73E4gFr7JterCCQh9QjiTjiZrG
  P2SH addresses always start with a "3". They are ~34 characters long, and are alphanumeric.
  
  
• P2WPKH ("Pay-To-Witness-Public-Key-Hash") / Bech32 / Native SegWit addresses: These basically works like P2PKH addresses, except that the signature part moves from the previous "scriptSig" part of a transaction to a "witness input" part. In correct terminology, P2WPKH now uses "SegWit", which was introduced to Bitcoin in 2017, fixing the problem of transaction malleability. The main difference to P2PKH is that the witness now is not included anymore when hashing and signing a transaction. Sending funds to this type of address is approximately 35% cheaper than when using P2PKH addresses.
  Example: bc1qqkpgky6lkxg8k2maftd68yh7ayu7qz5es0rdq3
  P2WPKH addresses always start with "bc1q". They are up to 36 characters long, and are alphanumeric.

There is a new address type currently being adopted:

• P2TR ("Pay-To-Taproot") addresses: This type of address is currently being adopted by the Bitcoin ecosystem. The main focus of Taproot addresses is to add privacy, security and flexibility aspects that allow better scalability of the Bitcoin network. You can track the progress of this process here.
  Example: bc1pazfrw4ndsqmk5yh69yjr5lfafg4fv8c1tsc06e
  P2TR addresses always start with "bc1p". They are 26-35 characters long, and are alphanumeric.

Practical Example: From Private Key to P2PKH

To give you an example of how your P2PKH address forms from your private key, I will run you through the process of transforming the latter to the former:

• Decide on your private key. Private keys are practically random strings consisting of 256 bits (or 32 bytes). How you arrive at this string does not matter that much, but it is important that it is sufficiently random or unique to not collide with someone else's private key.
  Example: 1160eb92b6ffa17ac77e5e41a495660c30319cb0059fe315eed0a5ee8d6b2455
  
  
• Calculate the secp256k1 value ("Elliptic Curve Cryptoraphy") as the public key. You apply the ECDSA signature algorithm to the private key of your choice. There are many ECDSA algorithms, and Bitcoin uses secp256k1. The result is a 64 byte integer, consisting of two concatenated 32 byte integers. This is your public key. To try it out, you can quickly create ECDSA keys with this tool.
  Example: 04521ba7b3210f521d6c0bbda177ac7f274456f53ff25d26bdc7a3469ae5eb4163709f8e28c307418c24a01bdd753c91c8ef8fc578d805c3463d225771fd23b14e
  
  
• Derive the Bitcoin address. To arrive at the respective (much shorter) P2PKH address, we apply a series of algorithms to the public key:
  Public address = RIPEMD160(SHA256(Public key))
  First we run the public key through SHA256, which yields a 32 byte hash value. We then apply RIPEMD160 to that hash value to arrive at the public BTC wallet address: 1PmZKHhD7AhmKsBWQB8WxtRLVKZyLWawQn. You can safely share this address with your peers. To convert public keys to addresses, you can use this neat online tool.

Why your Private Key is safe (for now)

The addresses above illustrate that the key space is immensely large. Randomly guessing private keys takes up significant amounts of time and processing power. To showcase what that means, here are some numbers:

• A private key consists of 32 bytes, which is 256 bits. This yields a number of unique combinations of 2^256 = 1.1579209e+77 (e+77 means: 77 times you multiply this number by 10). That is the private key search space.
  
  
• Now computers are fast. Assuming someone has the entire blockchain available offline and can extract all addresses that have funds in them. They know which addresses are worthwhile to check for - so whenever they produce an address from a guessed private key, they compare it to this list. Furthermore, let's assume that this check virtually consumes no time (which became possible with the application of Bloom Filters).
  
  
• Let's be generous and assume that every generation of a BTC address from private key (including generation of a private key) takes only 1 nanosecond. This results in: Total time to check key search space = Size of search space * 1ns = 3.66930826e+60 years
  
  So if someone would want to check every possible key of the entire search space, they would need a lot of time to do so. There is a certain chance for collisions between private keys mapping to smaller addresses, but the probability is so immensely small, you can neglect it.

Address Cracking Projects

Nevertheless, there are projects alive that try to simplify, speed up and enable BTC address cracking. Two notable ones are:

• brainflayer: A single-threaded CPU address cracker using Bloom Filters to look for any valuable address, also featured here.
• BitCrack: A GPU supported private key search accepting a list of addresses you would like to check for. Does not use Bloom Filters.

Some websites generate random private keys for you and look up their balance, just in case:

• Brain Wallet Cracker: Brian wallets used mnemonic phrases as private keys, which is a terrible choice in terms of uniqueness and privacy. This led to a large drain of wallets in 2016.
• Keys.lol: Lists random private BTC and ETH addresses and keys and checks for balance and transaction count on them.
• Private Keys: Generates a set of private keys and looks up their current balance and transaction count.

Conclusion

Right now before Quantum Computers reveal each and every of our secrets, your BTC funds are safe. There are occasional reports of someone cracking a wallet, offering a service for recovering private keys (in case you lost yours), or threatening to drain funds from anyone's BTC wallet. These are usually fake, scam or exaggerated. There exist services that try to recover your key if you still have your encrypted wallet.dat file. They usually ask for clues, and will want a portion of the recovered funds if successful - but these use tools that face the same issues as described above, independent from how elaborate they are.

Fun fact: You can even buy (or sell!) locked wallet.dat files on the internet. Based on how much you would need to spend to unlock one, you'll want o reconsider whether that's worth your time, money, and energy though.