Chain code

Half of every extended key is not a key at all. BIP-32 splits a 512-bit hash into a 256-bit key and a 256-bit chain code, and an xpub string carries both, 111 characters in total. If you ever hand out an xpub, you are handing out the chain code with it, and that is what lets the recipient derive your future addresses.

How it works

A chain code does its work inside one HMAC call. Deriving a child runs HMAC-SHA512 with the parent chain code as the key and the parent public key plus a four byte index as the message. The 64 byte result splits down the middle: the left 32 bytes are added to the parent private key modulo the curve order to give the child private key, and the right 32 bytes become the child's own chain code, which it will use for its own children.

The point of the salt is who gets to walk the tree. A public key on its own derives nothing, because the derivation function will not run without the matching chain code. That is why an extended public key is not simply a public key with a longer name. It is a public key plus its chain code, and handing that pair to someone converts one point on a curve into an unlimited, enumerable branch of addresses you have not used yet.

BIP-32 documents the sharp edge that follows. If an attacker holds your extended public key and also gets hold of one non-hardened child private key, subtracting the derived offset recovers the parent private key, and with it every sibling and every descendant. Hardened derivation exists to cut that path: at a hardened step the hashed message contains the parent private key rather than the public one, so no amount of public material lets anyone climb upward.

Where you see it

You never type a chain code, and no consumer wallet displays one on its own. It travels inside an extended key. Base58Check strings beginning xpub or xprv decode to 78 bytes laid out as 4 bytes of version, 1 byte of depth, a 4 byte parent fingerprint, a 4 byte child number, the 32 byte chain code, and finally the 33 byte key, which is why an xpub runs to 111 characters of text.

Developer tooling is where the field becomes visible as a field. Bitcoin Core's deriveaddresses RPC works on descriptors that embed extended keys, libraries such as python-bip32 return the chain code as a separate attribute, and a signing device exporting an account for a watch-only setup is exporting exactly this pair.

The right level of caution is the one you would apply to a complete transaction history, not the one you would apply to a password. A chain code cannot sign, so on its own it loses you nothing. In the hands of an analytics firm, a cloud backup, or anyone who pasted an xpub into a support ticket, it exposes every payment on that branch, past and future, and there is no way to revoke the access afterward.

Chain code vs private key

A chain code and a private key are both 32 random-looking bytes, and only one of them can spend. The private key produces signatures. The chain code produces nothing except more derivation, which is precisely why people underrate it: because it cannot move money, extended public keys get pasted into shared spreadsheets, bug reports and phone apps by people who would never do the same with a key. The result is a permanent window onto their finances rather than a theft, and the two failures deserve different names.