<p>A Bitcoin address is not <em>necessarily</em> a single-use token. Addresses can absolutely be reused. However, it's good practice to use a new address for each transaction, for reasons of privacy and security.</p>

<p>The privacy element was outlined in the <a href="https://bitcoin.org/bitcoin.pdf" rel="nofollow noreferrer">Bitcoin whitepaper</a> (section 10):</p>

<blockquote>
  <p>As an additional firewall, a new key pair should be used for each transaction to keep them from   being   linked   to   a   common   owner.</p>
</blockquote>

<p>The security benefit is that a Bitcoin address is a hash of a public key or a script, which means that if the elliptic curve cryptography used in Bitcoin is broken (allowing signatures to be generated for <strong>known</strong> public keys), we still have the hashing algorithms (SHA-256 and RIPEMD-160) helping to obscure the script or public key until a transaction is published. To spend the coins associated with an address, one must publish the original public key or script, but if you use a new address each time, the new address will have a corresponding public key or script that has not been pulished. Thus it would not be vulnerable to such attacks until you go to spend.</p>

<p>I would interpret the statement <em>"A Bitcoin address is a single-use token."</em> to say that a Bitcoin address <em>may be used</em> as a single-use token, and you should not assume that if someone once gave you an address, that will always be the address to pay to them. You should expect that there might be a different address each time.</p>

<p><strong>Edit:</strong> Yes, reusing the same address provides a lot of convenience because you don't have to keep track of many different keypairs, and it makes things easier/cleaner if you can send your change back to the same address instead of a new one. (<strong>Edit:</strong> Note, as chytrik points out, good wallet software will handle key generation and storage for you, so this should not be an actual concern unless you are making your own transactions by hand, writing your own software, etc.) When you use a new address each time, you may accumulate lots of small amounts of bitcoin at different addresses that you can't recombine without associating those addresses. (<strong>Edit:</strong> I feel that this comment is worth reading and thinking about, BUT as chytrik pointed out, <strong>the privacy risk of reusing addresses is much worse than the risk from recombining UTXOs</strong>. I sort of intended this to say something like, "You're probably going to be losing some anonymity either way, so take that into consideration along with convenience when threat modeling and choosing a method." But I wasn't very clear about the level of risk in either situation.) It's definitely a convenience factor.</p>

<p>There are also obvious advantages to having a persistent address. It's much easier to use if you aren't specifically requesting payment from someone. For example, if you want to list an address on your website for people to donate to you, it wouldn't be very useful to have that address constantly changing. Some people also generate "vanity addresses" (see e.g., <a href="https://en.bitcoin.it/wiki/Vanitygen" rel="nofollow noreferrer">Vanitygen</a>) which may have taken a lot of work to create, and they may not want that work to go to waste by switching to a new address.</p>

CC BY-SA 4.0
2019-02-07T17:16:30.273Z
Thank you. And in case of creating a BTC wallet a key pair will be generated. We can then generate **several addresses** for this **single wallet**. Does it mean that for **all** generated addresses in a **single** wallet, there is only a **single public key and private key** that have been generated at time of generating the wallet? Thanks
Questioner
CC BY-SA 4.0
2019-02-07T17:21:16.600Z
Each address corresponds to **one** public key/private key pair, so when you're generating several addresses for a single wallet, you are generating a new private key each time. The wallet is just the place you store your private keys, however many of those there are.
Vecna
CC BY-SA 4.0
2019-02-07T17:32:06.043Z
To elaborate a little bit, the public key comes from the private key (through elliptic curve multiplication), and the address is a hash of the public key (or a script in the case of pay-to-script-hash addresses). So they're one-for-one. One public key per private key, and one address per public key. [Mastering Bitcoin](https://github.com/bitcoinbook/bitcoinbook/blob/develop/ch04.asciidoc) has an in-depth explanation, of keys and addresses.
Vecna
CC BY-SA 4.0
2019-02-08T01:02:25.610Z
Good answer, except for the '**Edit**' paragraph, I respectfully disagree with most of what you wrote there. Good wallet software will take care of address management, the user should be unbothered by the particulars of it. re: *"When you use a new address each time, you may accumulate lots of small amounts of bitcoin at different addresses that you can't recombine without associating those addresses."* this doesn't make sense: you're saying that having many small UTXOs could lead to de-anonymizing address grouping... but the other option (address reuse) is even worse for privacy!
chytrik
CC BY-SA 4.0
2019-02-08T18:14:53.353Z
You're absolutely right on both counts. I'm going to edit my post again to clarify these points. Thank you!
Vecna
CC BY-SA 4.0
2019-02-07T16:52:11.630Z
2019-02-08T18:24:32.000Z
2019-02-08T18:24:32.000Z
Vecna
<p>While in Bitcoin wiki (<a href="https://en.bitcoin.it/wiki/Address#A_Bitcoin_address_is_a_single-use_token" rel="nofollow noreferrer">Link to the page</a>) is <strong>explicitly</strong> mentioned:</p>

<blockquote>
  <p>"<em>A Bitcoin address is a <strong>single-use</strong> token.</em>"</p>
</blockquote>

<p>We therefore expect that every address would be belonged to only a single transaction since addresses are one-time use token.</p>

<p>However, in any Bitcoin transaction explorer website such as e.g. following example, we can see that several transactions belong to a single address, meaning that several transactions have been performed using a single address.</p>

<p><strong>example:</strong></p>

<p><a href="https://live.blockcypher.com/btc/address/3Gfuha9cM3sH3D6Ae2t6f81SEiMNLhmQvN/" rel="nofollow noreferrer">https://live.blockcypher.com/btc/address/3Gfuha9cM3sH3D6Ae2t6f81SEiMNLhmQvN/</a></p>

<p>In above example, the address: <code>3Gfuha9cM3sH3D6Ae2t6f81SEiMNLhmQvN</code> has performed <strong>2,005 transactions</strong> (at the time of writing this question). I chose the address randomly. </p>

<ul>
<li>How can we interpret the statement of <em>"A Bitcoin address is a <strong>single-use</strong> token"</em> ?</li>
</ul>

<p><strong>Edit:</strong> In a first view, it seems that <strong>unlike</strong> mentioning explicitly (in both Bitcoin original paper and Bitcoin wiki) the statement that a Bitcoin address should be used one time for every transaction; however, in practice, it <strong>is NOT obliged</strong> that a Bitcoin address is used <strong>unlimitedly</strong> for <strong>infinite transactions</strong>. It is <strong>maybe</strong> because of <strong>difficulties</strong> to hold too many key pairs securely. Assuming for example for above selected address, the owner has to keep <strong>2,005 key pairs</strong> in a safe location. Or is there <strong>other reason</strong> to allow an address to be used unlimitedly?</p>

<transactions><address><public-key><terminology>
If Bitcoin addresses are a single-use token, how several transactions belong to a single address? (Edited)
Questioner
# If Bitcoin addresses are a single-use token, how several transactions belong to a single address? (Edited)

(Asked by: username_0 on 2019-02-07)

While in Bitcoin wiki ([Link to the page](https://en.bitcoin.it/wiki/Address#A_Bitcoin_address_is_a_single-use_token)) is **explicitly** mentioned:

> "*A Bitcoin address is a **single-use** token.*"

We therefore expect that every address would be belonged to only a single transaction since addresses are one-time use token.

However, in any Bitcoin transaction explorer website such as e.g. following example, we can see that several transactions belong to a single address, meaning that several transactions have been performed using a single address.

**example:**

<https://live.blockcypher.com/btc/address/3Gfuha9cM3sH3D6Ae2t6f81SEiMNLhmQvN/>

In above example, the address: `3Gfuha9cM3sH3D6Ae2t6f81SEiMNLhmQvN` has performed **2,005 transactions** (at the time of writing this question). I chose the address randomly.

* How can we interpret the statement of *"A Bitcoin address is a **single-use** token"* ?

**Edit:** In a first view, it seems that **unlike** mentioning explicitly (in both Bitcoin original paper and Bitcoin wiki) the statement that a Bitcoin address should be used one time for every transaction; however, in practice, it **is NOT obliged** that a Bitcoin address is used **unlimitedly** for **infinite transactions**. It is **maybe** because of **difficulties** to hold too many key pairs securely. Assuming for example for above selected address, the owner has to keep **2,005 key pairs** in a safe location. Or is there **other reason** to allow an address to be used unlimitedly?

**Tags:** transactions, address, public-key, terminology


---

## 1 answers

### Answer by username_1 on 2019-02-07. Score: 2 | Accepted answer

A Bitcoin address is not *necessarily* a single-use token. Addresses can absolutely be reused. However, it's good practice to use a new address for each transaction, for reasons of privacy and security.

The privacy element was outlined in the [Bitcoin whitepaper](https://bitcoin.org/bitcoin.pdf) (section 10):

> As an additional firewall, a new key pair should be used for each transaction to keep them from being linked to a common owner.

The security benefit is that a Bitcoin address is a hash of a public key or a script, which means that if the elliptic curve cryptography used in Bitcoin is broken (allowing signatures to be generated for **known** public keys), we still have the hashing algorithms (SHA-256 and RIPEMD-160) helping to obscure the script or public key until a transaction is published. To spend the coins associated with an address, one must publish the original public key or script, but if you use a new address each time, the new address will have a corresponding public key or script that has not been pulished. Thus it would not be vulnerable to such attacks until you go to spend.

I would interpret the statement *"A Bitcoin address is a single-use token."* to say that a Bitcoin address *may be used* as a single-use token, and you should not assume that if someone once gave you an address, that will always be the address to pay to them. You should expect that there might be a different address each time.

**Edit:** Yes, reusing the same address provides a lot of convenience because you don't have to keep track of many different keypairs, and it makes things easier/cleaner if you can send your change back to the same address instead of a new one. (**Edit:** Note, as username_2 points out, good wallet software will handle key generation and storage for you, so this should not be an actual concern unless you are making your own transactions by hand, writing your own software, etc.) When you use a new address each time, you may accumulate lots of small amounts of bitcoin at different addresses that you can't recombine without associating those addresses. (**Edit:** I feel that this comment is worth reading and thinking about, BUT as username_2 pointed out, **the privacy risk of reusing addresses is much worse than the risk from recombining UTXOs**. I sort of intended this to say something like, "You're probably going to be losing some anonymity either way, so take that into consideration along with convenience when threat modeling and choosing a method." But I wasn't very clear about the level of risk in either situation.) It's definitely a convenience factor.

There are also obvious advantages to having a persistent address. It's much easier to use if you aren't specifically requesting payment from someone. For example, if you want to list an address on your website for people to donate to you, it wouldn't be very useful to have that address constantly changing. Some people also generate "vanity addresses" (see e.g., [Vanitygen](https://en.bitcoin.it/wiki/Vanitygen)) which may have taken a lot of work to create, and they may not want that work to go to waste by switching to a new address.

> **Comments:**
> **username_0**: Thank you. And in case of creating a BTC wallet a key pair will be generated. We can then generate **several addresses** for this **single wallet**. Does it mean that for **all** generated addresses in a **single** wallet, there is only a **single public key and private key** that have been generated at time of generating the wallet? Thanks  
> **username_1**: Each address corresponds to **one** public key/private key pair, so when you're generating several addresses for a single wallet, you are generating a new private key each time. The wallet is just the place you store your private keys, however many of those there are.  
> **username_1**: To elaborate a little bit, the public key comes from the private key (through elliptic curve multiplication), and the address is a hash of the public key (or a script in the case of pay-to-script-hash addresses). So they're one-for-one. One public key per private key, and one address per public key. [Mastering Bitcoin](https://github.com/bitcoinbook/bitcoinbook/blob/develop/ch04.asciidoc) has an in-depth explanation, of keys and addresses.  
> **username_2**: Good answer, except for the '**Edit**' paragraph, I respectfully disagree with most of what you wrote there. Good wallet software will take care of address management, the user should be unbothered by the particulars of it. re: *"When you use a new address each time, you may accumulate lots of small amounts of bitcoin at different addresses that you can't recombine without associating those addresses."* this doesn't make sense: you're saying that having many small UTXOs could lead to de-anonymizing address grouping... but the other option (address reuse) is even worse for privacy!  
> **username_1**: You're absolutely right on both counts. I'm going to edit my post again to clarify these points. Thank you!  

---

