<p>The reason for not sending back to (one of the) previous addresses, is privacy. Not just your privacy - perhaps you don't care - but the privacy of everyone using the system. Reusing addresses this way makes it blatantly obvious which of the output is the real output and which is change, meaning that transaction graph analysis becomes a lot easier.</p>

<p>Wallet backups going out of date is a very good counter-argument to this. Security and privacy are often hard to combine. It's also the reason why for example Multibit and Bitcoin Wallet for Android up to now do reuse addresses for change.</p>

<p>However, a solution that has the advantages of both exists. Deterministic wallets (in particular BIP32) allow generation of new change addresses (including the ability to detect them when recovering from a backup), without revealing this to everyone in the world. In addition, they do support selective disclosure to people with whom you want to share your wallet's history.</p>

CC BY-SA 3.0
2014-01-23T19:39:15.140Z
2014-01-23T19:39:15.140Z
Pieter Wuille
<p>Why over complicate things with additional private and public keys that are hidden from the user and make it possible for backed up wallets to go out of date?  Why can't the change address just be the address that started the transaction?</p>

<client><change>
Why doesn't a change address just point back to the address that sent the transaction?
evermore
# Why doesn't a change address just point back to the address that sent the transaction?

(Asked by: username_0 on 2014-01-23)

Why over complicate things with additional private and public keys that are hidden from the user and make it possible for backed up wallets to go out of date? Why can't the change address just be the address that started the transaction?

**Tags:** client, change


---

## 1 answers

### Answer by username_1 on 2014-01-23. Score: 5 | Accepted answer

The reason for not sending back to (one of the) previous addresses, is privacy. Not just your privacy - perhaps you don't care - but the privacy of everyone using the system. Reusing addresses this way makes it blatantly obvious which of the output is the real output and which is change, meaning that transaction graph analysis becomes a lot easier.

Wallet backups going out of date is a very good counter-argument to this. Security and privacy are often hard to combine. It's also the reason why for example Multibit and Bitcoin Wallet for Android up to now do reuse addresses for change.

However, a solution that has the advantages of both exists. Deterministic wallets (in particular BIP32) allow generation of new change addresses (including the ability to detect them when recovering from a backup), without revealing this to everyone in the world. In addition, they do support selective disclosure to people with whom you want to share your wallet's history.


---

