<p>You should try using BIP32 to generate addresses.</p>

<p>There's a node.js implementation here: <a href="http://cryptocoinjs.com/modules/currency/hdkey/" rel="nofollow">http://cryptocoinjs.com/modules/currency/hdkey/</a></p>

CC BY-SA 3.0
2015-04-21T22:58:37.913Z
2015-04-21T22:58:37.913Z
Nick ODell
<p>Output the address with Javascript, crawlers cannot see that. e.g. document.WriteLn(addressHere);  Hiding the page behind a POST will stop most crawlers but not all.</p>

<p>Alternatively you could do some simple obfuscation, e.g. split the address in two and ask the user to combine it, or leave off the '1'/'3' prefix and ask users to add that manually. Kinda like when people list their email address as userATdomainDOTcom.</p>

<p>Alternatively, you could use a payment processor that pays out in bitcoin e.g. snapcard.io</p>

CC BY-SA 3.0
2014-11-22T17:37:28.737Z
2014-11-22T17:37:28.737Z
George
<p>I ended up on this page because I was looking for a solution so that my public bitcoin address would not be indexed by <em>search engine bots</em>.</p>

<p>I have found a <strong>solution</strong> to that.</p>

<p>The idea is to serve the <em>bitcoin addresses</em> via <strong>js or ajax</strong>, and <strong>disallow</strong> the <em>access to the file</em> to the bots by using a <code>robots.txt</code> rule.</p>

<p>You write your html (template) with <em>placeholders</em> for the bitcoin adress(es).
And either use a <em>plain js file</em> holding adresses in variables or make an <em>ajax call</em> to get addresses (generated on the fly may be) via <em>json</em>, and display (via js) the adresses on the page in the browser.</p>

<p>But you add a <code>Disallow</code> rule to your <code>robots.txt</code> to forbid the bots to <strong>download</strong> either the <em>js</em> or the <em>ajax url</em>.</p>

<p>This has been tested with <strong>GoogleBot</strong> and works fine. (explicitly tested in <em>Search Console</em> with "<em>Explore like Google</em>" feature).
All <strong>well-behaved bots</strong> that follow <code>robots.txt</code> should not be able to see the addresses and could not render the page properly.</p>

<p>This doesn't work for bots that don't care about <code>robots.txt</code> or ignore it to render the page.</p>

CC BY-SA 4.0
2018-07-30T19:07:07.967Z
2018-07-30T19:07:07.967Z
solsTiCe
<p>One time keys are standard practice on some exchanges. E.g. when you top up the exchange wallet the receiving address is recycled after it receives one transaction. You can generate receiving addresses on the fly, there is no need to pre-generate them.</p>

<p>You need to put receiving addresses behind something which stops the crawler. If you only target web crawlers, putting the payment page behind HTTP POST form is enough. If you want to stop malicious visitors you need to have CAPTCHA before the visitor can get the payment address.</p>

<p>Also you might want to make sure that there are no log entries of QR codes and such. This is best accomplished by generating the QR code image on the client side using JavaScript. <a href="https://github.com/miohtama/bitcoinaddress.js" rel="nofollow">Here is an example library for it</a>. Some popular solutions, like Google's QR code generator, have QR code content in URL, thus leaving log entries containing the address.</p>

CC BY-SA 3.0
2014-10-23T11:50:19.477Z
I hate captcha's, so does everyone else, so that's out. Using an Exchange is also no longer an option. Form method=post sounds like the only option then for hiding the key? So, what library do we use then for what I am trying to accomplish..
ken Code
CC BY-SA 3.0
2014-10-23T12:02:04.220Z
bitcoinaddress.js also displays everything on the page in plain text, not good. see my question above for why etc thanx :)
ken Code
CC BY-SA 3.0
2014-10-23T12:30:39.657Z
There is no difference if you display it as plain text, QR image or voice clip with some lady reading every character. You need to give the public address out if you want to receive anything to it and thus, it really doesn't matter which method you use as all of them are equally secure.
Mikko Ohtamaa
CC BY-SA 3.0
2014-10-23T12:33:26.057Z
Here is one JavaScript based multisig wallet as open source https://github.com/bitpay/copay/
Mikko Ohtamaa
CC BY-SA 3.0
2014-10-23T12:35:42.357Z
I disagree. Displaying the public key as an image in a compiled jpeg would be more secure than displaying it as raw copy-able clear plain text on the page. Most people will just scan the qr code before they will copy/paste a key...
ken Code
CC BY-SA 3.0
2014-10-23T12:41:39.677Z
@kenCode: Unfortunately that is not true. Both are copyable with a simple right mouse click. Emphasizing the fact that the image is safer would be building your security on wrong principles and undermine your promise of secure service.
Mikko Ohtamaa
CC BY-SA 3.0
2014-10-23T13:44:28.413Z
google can read svg files, even raw text on a pdf, but i do not see google reading the text that is drawn onto an image as of yet. (ie: captchas) i just can't think of an easier way to show the public key. maybe skip showing the text of the key altogether and just show qr codes from now on? that might make the customer on the website a bit suspicious tho, not sure if they are sending money to the correct address. i personally read the first 5 or 6 chars myself just to make sure it matches what my wallet is about to send btc to. so, how do we hide that key text from google et al? ideas?
ken Code
CC BY-SA 3.0
2014-10-24T05:57:12.390Z
Just make your payment page not accessible by Google and other bots using CATPCHA, as explained in the answer
Mikko Ohtamaa
CC BY-SA 3.0
2014-10-23T11:33:07.100Z
2014-10-23T11:33:07.100Z
Mikko Ohtamaa
<p>Rather than having a single, fixed address, I want to generate a new address on my website every time a user request comes in.</p>

<p>I'm concerned about google or another web crawler indexing my website and tying my Bitcoin address to my website address.</p>

<p>I've thought about pregenerating the addresses, storing them in a database, and only showing one to each user. I think there's probably a better way.</p>

<p>I use node.js, so a solution using bitcoinjs or another node.js package would be preferable.</p>

<p>I would prefer to use multisignature addresses.</p>

<p>I would rather not depend on blockchain.info or an exchange - it introduces a single point of failure.</p>

CC BY-SA 3.0
2014-10-23T15:00:04.037Z
PS: Are you OK with having the private keys to the addresses stored on your website?
Nick ODell
CC BY-SA 3.0
2014-10-23T15:13:19.450Z
no. private keys bitaddress/bulkwallet) must be stored locally, the public addresses can be stored in mongodb on the server, hidden from google etc. we built a website for an old man that runs a novelty shop, he doesn't know doodly about tech so this has got to be dumbed down automated for him, yet as anon as possible.
ken Code
<privacy><multi-signature><bitcoinjs><node.js>
Preventing the exposure of public addresses on a website
ken Code
# Preventing the exposure of public addresses on a website

(Asked by: username_0 on 2014-10-23)

Rather than having a single, fixed address, I want to generate a new address on my website every time a user request comes in.

I'm concerned about google or another web crawler indexing my website and tying my Bitcoin address to my website address.

I've thought about pregenerating the addresses, storing them in a database, and only showing one to each user. I think there's probably a better way.

I use node.js, so a solution using bitcoinjs or another node.js package would be preferable.

I would prefer to use multisignature addresses.

I would rather not depend on blockchain.info or an exchange - it introduces a single point of failure.

**Tags:** privacy, multi-signature, bitcoinjs, node.js

> **Comments:**
> **username_1**: PS: Are you OK with having the private keys to the addresses stored on your website?  
> **username_0**: no. private keys bitaddress/bulkwallet) must be stored locally, the public addresses can be stored in mongodb on the server, hidden from google etc. we built a website for an old man that runs a novelty shop, he doesn't know doodly about tech so this has got to be dumbed down automated for him, yet as anon as possible.  

---

## 4 answers

### Answer by username_1 on 2015-04-21. Score: 1

You should try using BIP32 to generate addresses.

There's a node.js implementation here: <http://cryptocoinjs.com/modules/currency/hdkey/>


---

### Answer by username_2 on 2014-11-22. Score: 0

Output the address with Javascript, crawlers cannot see that. e.g. document.WriteLn(addressHere); Hiding the page behind a POST will stop most crawlers but not all.

Alternatively you could do some simple obfuscation, e.g. split the address in two and ask the user to combine it, or leave off the '1'/'3' prefix and ask users to add that manually. Kinda like when people list their email address as userATdomainDOTcom.

Alternatively, you could use a payment processor that pays out in bitcoin e.g. snapcard.io


---

### Answer by username_3 on 2018-07-30. Score: 0

I ended up on this page because I was looking for a solution so that my public bitcoin address would not be indexed by *search engine bots*.

I have found a **solution** to that.

The idea is to serve the *bitcoin addresses* via **js or ajax**, and **disallow** the *access to the file* to the bots by using a `robots.txt` rule.

You write your html (template) with *placeholders* for the bitcoin adress(es).
And either use a *plain js file* holding adresses in variables or make an *ajax call* to get addresses (generated on the fly may be) via *json*, and display (via js) the adresses on the page in the browser.

But you add a `Disallow` rule to your `robots.txt` to forbid the bots to **download** either the *js* or the *ajax url*.

This has been tested with **GoogleBot** and works fine. (explicitly tested in *Search Console* with "*Explore like Google*" feature).
All **well-behaved bots** that follow `robots.txt` should not be able to see the addresses and could not render the page properly.

This doesn't work for bots that don't care about `robots.txt` or ignore it to render the page.


---

### Answer by username_4 on 2014-10-23. Score: 0

One time keys are standard practice on some exchanges. E.g. when you top up the exchange wallet the receiving address is recycled after it receives one transaction. You can generate receiving addresses on the fly, there is no need to pre-generate them.

You need to put receiving addresses behind something which stops the crawler. If you only target web crawlers, putting the payment page behind HTTP POST form is enough. If you want to stop malicious visitors you need to have CAPTCHA before the visitor can get the payment address.

Also you might want to make sure that there are no log entries of QR codes and such. This is best accomplished by generating the QR code image on the client side using JavaScript. [Here is an example library for it](https://github.com/miohtama/bitcoinaddress.js). Some popular solutions, like Google's QR code generator, have QR code content in URL, thus leaving log entries containing the address.

> **Comments:**
> **username_0**: I hate captcha's, so does everyone else, so that's out. Using an Exchange is also no longer an option. Form method=post sounds like the only option then for hiding the key? So, what library do we use then for what I am trying to accomplish..  
> **username_0**: bitcoinaddress.js also displays everything on the page in plain text, not good. see my question above for why etc thanx :)  
> **username_4**: There is no difference if you display it as plain text, QR image or voice clip with some lady reading every character. You need to give the public address out if you want to receive anything to it and thus, it really doesn't matter which method you use as all of them are equally secure.  
> **username_4**: Here is one JavaScript based multisig wallet as open source https://github.com/bitpay/copay/  
> **username_0**: I disagree. Displaying the public key as an image in a compiled jpeg would be more secure than displaying it as raw copy-able clear plain text on the page. Most people will just scan the qr code before they will copy/paste a key...  
> **username_4**: @username_0: Unfortunately that is not true. Both are copyable with a simple right mouse click. Emphasizing the fact that the image is safer would be building your security on wrong principles and undermine your promise of secure service.  
> **username_0**: google can read svg files, even raw text on a pdf, but i do not see google reading the text that is drawn onto an image as of yet. (ie: captchas) i just can't think of an easier way to show the public key. maybe skip showing the text of the key altogether and just show qr codes from now on? that might make the customer on the website a bit suspicious tho, not sure if they are sending money to the correct address. i personally read the first 5 or 6 chars myself just to make sure it matches what my wallet is about to send btc to. so, how do we hide that key text from google et al? ideas?  
> **username_4**: Just make your payment page not accessible by Google and other bots using CATPCHA, as explained in the answer  

---

