A Bitcoin key is not a password. It is one very large number that you keep secret, plus a second number derived from it that you can publish anywhere.
The pair has one useful property, and the whole system rests on it: the secret number can produce a signature over a message, and anybody holding the public number can check that signature is genuine, without ever learning the secret. Spending bitcoin is producing such a signature. Everything the network does with your coins is a check that one is valid.
Two numbers, one direction
A private key is a randomly chosen number, 256 bits long. That is all it is. No server issues it and no registry records it. A wallet picks one at random, and it is yours because nobody else picked it. Where that randomness comes from is a subject of its own, and it is the one place a key can be made guessable: generating one by hand from dice rolls shows what is actually being chosen.
The public key is calculated from the private key by an operation on an elliptic curve. Bitcoin uses a particular curve, secp256k1, and the calculation takes a fraction of a millisecond on any phone.
Running it backwards is the interesting part. Recovering a private key from a public key means solving what mathematicians call the discrete logarithm problem on that curve, and no published method does it in any workable amount of time. Cheap forwards, hopeless backwards. That one-way relationship is the asymmetry the name refers to, and it is why you can hand out the public half and keep the private half.
Signing, and checking a signature
Signing takes two inputs: the message, which for Bitcoin is a transaction, and the private key. Out comes a signature, which is another number, specific to that exact message and that exact key. Change one byte of the message and the signature no longer matches it.
Checking takes three inputs: the message, the signature and the public key. Out comes yes or no. The private key is not involved in the check and never leaves the signer.
Bitcoin used ECDSA signatures on their own until 2021, when BIP 340 added Schnorr signatures as part of Taproot. Both schemes do the same job described here.
The honest reading of a valid signature is narrower than people assume. It is evidence that whoever produced it held the private key. It says nothing about who that person was, or whether they were supposed to have the key. We will come back to that.
What the chain actually stores
An address is not a public key. For a pay to witness public key hash output, defined in BIP 141, what goes on the chain is a 20 byte hash of the public key. Hashing is one-way in the same spirit as key derivation: anything goes in, a short fixed-length value comes out, and there is no route back.
The public key itself appears only in the transaction that spends the coin, at which point the coin has already moved. That detail is small and it matters later.
A payment, end to end
Alice pays Bob. Her wallet builds a transaction that spends an output she controls and assigns the amount to a condition only Bob can satisfy. It signs the transaction with her private key. It broadcasts the result to whatever peers it is connected to.
Every node that receives the transaction runs the same check independently: does this signature verify against the public key the spent output committed to? A node that gets a no drops the transaction and does not pass it on. A node that gets a yes relays it, and eventually a miner includes it in a block.
There is no authority anywhere in that picture. Nobody approves the payment. Each node answers a maths question and acts on the answer.
What people get wrong
Bitcoin does not encrypt anything. A key pair can be used two ways. One is encryption: anyone encrypts with the public key and only the holder of the private key can decrypt. The other is signing. Bitcoin uses only signing. Every transaction on the chain is in the clear and always has been, which is why anyone can audit the supply.
An address is not a public key, as above, and neither one is a private key. Publishing an address is safe. Publishing a private key hands over the coins.
A seed phrase is not a private key either. It is the input a wallet uses to derive many private keys, which is why one backup covers every address a wallet will ever generate.
"Quantum computers will break this" needs to be made specific. Shor's algorithm, run on a machine with enough stable qubits, would solve the discrete logarithm problem and so recover a private key from a public key. No machine anywhere near that size is known to exist. NIST published its first post-quantum signature standards, FIPS 204 and FIPS 205, on 13 August 2024; Bitcoin has none of them, and no proposal to add one has been activated. What does follow from all this is the narrow point above about exposure: an output that publishes its public key before it is spent is in a different position from one that publishes only a hash, which is the argument in the draft proposal for a quantum resistant output type.
What the maths does not do for you
Verification answers exactly one question: was this signature produced by the holder of that private key? It has nothing to say about whether the holder was you.
Somebody who copies your private key produces signatures that every node on the network accepts as valid, because they are valid. There is no fraud department, no reversal and no appeal. That is the tradeoff the design makes: it removes the intermediary who could freeze a payment, and it removes the intermediary who could unwind a theft, and those are the same intermediary.
So the security of your coins is not really a cryptography problem. The cryptography holds. It is a question of who can reach the key, which is what choosing a wallet and what self-custody actually requires are about.