35 OF 35 TERMS
A short, checksummed encoding of the conditions for spending — usually a hash of a public key or script. An invoice identifier, not an account.
An address like bc1q… is not a wallet and holds nothing. It encodes the lock that future coins will be bound by. Best practice is to hand out a fresh address for every payment: addresses are free, and reuse stitches your financial history together for anyone watching the chain.
Receiving more than once at the same address — cryptographically allowed, terrible for privacy, and the easiest habit to fix.
Reuse binds every payment you receive into one public cluster and tells every past payer your ongoing balance. HD wallets exist precisely so a fresh address costs nothing. Treat an address like an invoice number: generated per payment, never printed on a business card.
Keeping signing keys on a device that never touches a network — data crosses by QR code or SD card, malware has no route in.
An air-gapped signer turns remote attacks into physical ones: to touch the keys an attacker needs the device in hand. It is not a cure-all — the 2026 Coldcard incident required no contact with the device at all, because the flaw was in the randomness the keys were born from, not in any wire.
Hierarchical deterministic (HD) wallets: one master seed deterministically derives a whole tree of keys, so one backup covers every future address.
Before BIP32, wallets held a keypool of independent random keys and a stale backup silently lost coins. HD derivation fixed that: back up the seed once and every address the wallet will ever create is recoverable. The tree structure also enables watch-only wallets via the xpub.
The standard mapping entropy to a mnemonic sentence from a fixed 2048-word list, with a built-in checksum.
BIP39 takes 128–256 bits of entropy, appends a checksum (entropy ÷ 32 bits), and slices the result into 11-bit chunks, each indexing one of 2048 words. The words add no security of their own — they are a human-friendly container for the entropy, and they are only as good as the randomness that filled them.
A batch of transactions plus a header committing to the previous block — the link that makes the chain tamper-evident.
Each block header contains the hash of its predecessor, so editing any historical transaction changes that block's hash, which breaks the next block's commitment, and so on to the tip. Rewriting history means redoing the proof-of-work for every block since — while the honest network keeps extending the real chain.
A key derived from a human-chosen passphrase — a practice that reliably loses money, because human memory produces a few dozen bits where 256 are needed.
Every phrase a human would choose — song lyrics, Bible verses, "correct horse battery staple" — lives in a space attackers enumerate continuously. Researchers cracking historical brainwallets found coins swept within seconds of funding. The lesson generalises: keys must come from measured randomness, never from anything a mind would produce.
The output a transaction sends back to the spender's own wallet, because UTXOs must be consumed whole.
Like paying a £7 bill with a £10 note, all but exact-match spends produce change. Wallets send it to a fresh internal address, which is why your transaction history shows unfamiliar addresses receiving your own coins — and why chain-watchers work hard to guess which output is the change.
The wallet's choice of which UTXOs fund a payment — a trade-off between fees today, fees later, and how much history the inputs reveal.
Every input added to a transaction costs fee and, under the common-input-ownership heuristic, publicly glues its history to the others. Spending many small UTXOs is expensive and leaky; hoarding one giant UTXO broadcasts your whole balance every time you pay. Good wallets let you choose the coins yourself.
Keys generated and kept entirely offline, signing rarely or never — the deep vault at the far end of the custody spectrum from a phone hot wallet.
Cold storage optimises for attack resistance over convenience: hardware or air-gapped signers, metal seed backups, geographically split copies. Most people are best served by a spectrum — a phone wallet holding pocket money, cold storage holding savings — rather than one setup stretched to do both jobs badly.
A cryptographically secure pseudo-random number generator — an algorithm that stretches a truly random seed into an unpredictable stream. Garbage seed in, predictable keys out.
Operating systems gather entropy from hardware noise and serve it through a CSPRNG like /dev/urandom. The algorithms are excellent; the historical failures are all in the seeding — Debian's 2008 OpenSSL bug, Android's 2013 SecureRandom flaw, and the Coldcard's 2026 counter fallback each fed a fine algorithm a guessable seed.
The route through the BIP32 tree from master seed to a specific key, written like m/84'/0'/0'/0/0.
The BIP44 family of standards gives paths meaning: purpose / coin type / account / chain / index. m/84'/0'/0'/0/0 is the first native-segwit receive address of the first account. Restoring a seed in different software sometimes "loses" coins that are merely sitting on a path the new wallet did not scan.
Generating a seed from physical dice rolls — roughly 99 casino-die rolls for 256 bits — so the randomness is yours to witness, not a chip's to promise.
Each fair d6 roll contributes log₂6 ≈ 2.585 bits, so 50 rolls exceed 128 bits and 99 exceed 256. Good hardware wallets accept dice input and mix it with their own RNG; the paranoid verify the resulting words against an independent offline tool. It is the one entropy source whose honesty you can see with your own eyes.
The network-set threshold a block hash must fall below; retargeted every 2016 blocks so blocks keep arriving roughly every ten minutes.
If the world's miners double their hashpower, blocks briefly arrive faster — until the next retarget doubles the difficulty and the rhythm returns to ten minutes. The issuance schedule is therefore immune to effort: more mining never mints coins faster, it only raises the bar.
Spending the same coin twice — the fraud digital cash could never prevent without a central referee, until proof-of-work ordering solved it.
Digital data copies freely, so what stops a digital pound being paid to two people at once? Before Bitcoin the only answer was a trusted ledger-keeper. Bitcoin's answer is a public ordering of all transactions, secured by energy: whichever spend the chain records first is the real one, and everyone can verify which that was.
The measure of genuine unpredictability in data — for a Bitcoin key, how many fair coin flips of randomness actually went into it.
A Bitcoin private key should carry 256 bits of entropy: the unpredictability of 256 fair coin flips. Every entropy failure in Bitcoin's history — from Android SecureRandom in 2013 to the Coldcard bug of 2026 — is the same story: the key looked random, but far fewer coin flips went in than the format promised, and someone eventually enumerated the shrunken space.
What a transaction bids for block space, in satoshis per virtual byte. Fee = (sum of inputs) − (sum of outputs); miners keep the difference.
Fees pay for scarce bytes, not for value moved: sending £100m costs the same as £10 if the transactions are the same size. When blocks are full, the mempool becomes an auction — transactions bidding too little wait, sometimes for days, until demand ebbs or they are fee-bumped.
Software that downloads and independently verifies every block and transaction against the consensus rules — trusting no one's word, including miners'.
A full node checks every signature, every script, and that no transaction mints coins from nowhere. Run one and nobody can lie to you about your money: an invalid block is rejected whether one miner produced it or all of them did. Hashpower proposes; nodes dispose.
The scheduled 50% cut in new-coin issuance every 210,000 blocks (~4 years), enforcing the 21 million cap.
The subsidy began at 50 BTC per block in 2009 and has halved to 3.125 BTC since April 2024. The geometric series converges just under 21 million coins around the year 2140, after which miners are paid by fees alone. No committee votes on this; every full node enforces it.
A dedicated signing device that keeps private keys off internet-connected computers, displaying and approving each spend on its own screen.
A hardware wallet shrinks your attack surface from "everything on your PC" to one auditable device — but it remains a vendor you are trusting for correct code and honest randomness. Verify firmware signatures, verify addresses on the device screen, and, after 2026, consider supplying your own dice entropy rather than trusting the box's.
The fixed-size fingerprint of any data, from a one-way function: easy to compute, infeasible to reverse, and wildly different if one bit of input changes.
Bitcoin leans on SHA-256 everywhere: block ids, transaction ids, mining, addresses. Feed it the Encyclopædia Britannica or the letter "a" and you get 256 bits either way; change a comma and roughly half the output bits flip. No known method beats guessing for finding an input that produces a chosen output.
Each node's waiting room of valid, unconfirmed transactions — there is no single global mempool, only thousands of similar ones.
A broadcast transaction floods node to node, each validating before relaying. Miners draw from their own mempool, generally highest fee rate first. Until a transaction is mined into a block it is a promise, not a settlement — and a low-fee promise can be outbid or replaced.
A script requiring M of N keys to spend — no single device, location, or mistake can lose or move the coins.
A 2-of-3 across different vendors' hardware in different places survives any one key being burgled, lost, or backdoored — including a vendor's RNG failing, which single-signature Coldcard users had no defence against in 2026. The price is coordination: more devices, more backups, and an inheritance plan your heirs can actually execute.
The counter a miner varies to change the block header's hash on each attempt — billions of guesses per second hunting one below the target.
Mining is not solving a puzzle with cleverness; it is buying lottery tickets with electricity. Each nonce value gives an unrelated hash, and only one below the difficulty target wins. The word also names the per-signature random number in ECDSA, where reusing one famously leaks the private key.
An optional extra secret (the "25th word") mixed into BIP39 seed derivation; every distinct passphrase opens a completely different wallet.
A passphrase means a thief holding your metal backup still cannot spend, and a decoy wallet can sit behind an empty passphrase. The cost is symmetrical: forget the passphrase and your coins are exactly as gone as the thief's would have been. There is no checksum and no error message — a typo silently opens a different, empty wallet.
A 256-bit secret number; whoever knows it can spend the coins locked to its public key. It is never "stored on the blockchain" — only proofs derived from it are.
A private key is just a number between 1 and about 1.16 × 10⁷⁷. Ownership in Bitcoin is nothing more than knowledge of that number: there is no account to freeze, no name attached, and no recovery desk. Sign with it and the network obeys; lose it and the coins are stranded forever.
Evidence, checkable in microseconds, that real energy was burned to produce a block — making the ledger's history expensive to forge.
A valid block hash proves its miner performed, on average, quadrillions of hash attempts. The chain with the most accumulated work is the one nodes follow, so rewriting last week costs more than every honest miner earned since — unforgeable costliness, in Nick Szabo's phrase, anchoring digital records to physical reality.
Partially signed Bitcoin transaction — the standard file format for passing an unsigned or half-signed transaction between wallets and signing devices.
PSBTs are how air-gapped signing works: an online computer drafts the transaction, a hardware wallet or offline machine signs it via SD card or QR code, and the online machine broadcasts. They are also the glue of multisig, letting each cosigner add a signature in turn.
The point on the secp256k1 curve derived from a private key by one-way maths; safe to reveal, impossible (in practice) to reverse.
Multiplying the curve's generator point by your private key gives your public key. Going forwards takes microseconds; going backwards is the elliptic-curve discrete-logarithm problem, infeasible for every computer on Earth combined. That asymmetry — easy one way, impossible the other — is the trapdoor the whole system stands on.
The 12 or 24 BIP39 words encoding the entropy from which every key in a wallet is derived. The words ARE the wallet; the device is disposable.
Twelve words encode 128 bits of entropy plus a 4-bit checksum; twenty-four encode 256 plus 8. Anyone who reads your seed phrase owns your coins from that moment, no device required — and no firmware update can ever repair a seed that was generated badly, as Coldcard owners learned in 2026.
A cryptographic proof, made with a private key, that the key-holder authorised this exact message — without revealing the key itself.
Every Bitcoin spend is a signature over the transaction's details. Nodes verify it against the public key in microseconds. A signature over one transaction proves nothing about any other, which is why a key can sign thousands of spends without ever being exposed — provided its nonces are truly random, another place entropy failures have drained wallets.
Simplified payment verification — a light client checks block headers and proof-of-work but not the transactions inside, trusting that miners are honest.
Described in section 8 of the whitepaper, SPV suits phones: verify a Merkle proof that your transaction sits in a block, and trust the heaviest chain is valid. The trade-off is real — an SPV wallet will happily follow a chain containing invalid transactions if enough hashpower builds on it, where a full node would reject it outright.
A signed message consuming existing UTXOs as inputs and creating new ones as outputs; the only way state ever changes in Bitcoin.
A transaction proves, input by input, that the spender may unlock each coin, then locks the value into fresh outputs. There are no admin overrides, no reversals, and no other operation: the entire monetary history of Bitcoin is a chain of these small, signed state changes.
Unspent transaction output — a discrete, indivisible coin of arbitrary value. A wallet "balance" is just the sum of the UTXOs its keys can spend.
Bitcoin has no accounts and no balances at the protocol level, only outputs waiting to be spent. Pay someone 0.3 BTC from a 1 BTC output and the transaction consumes the whole coin, creating a 0.3 BTC output for them and ~0.7 back to you as change. Wallets hide the coin-picking; the chain records every coin's whole life.
An extended public key — lets software derive every address in an account for watching, without any ability to spend.
Hand your xpub to a watch-only wallet and it can display balances and generate receive addresses while the private keys stay on hardware. Guard it like a bank statement, not a password: it cannot move coins, but it exposes your entire transaction history to whoever holds it.
