Glossary / Addresses & keys
Key fingerprint
- What is a key fingerprint?
- A key fingerprint is the first 32 bits of the Hash160 of a public key, printed as eight hex characters, and wallets use it to label which key a derivation path starts from.
Specified in BIP-32.
A fingerprint is a fixed width label for a key, and its width is part of the format rather than a display choice. BIP-380 requires exactly 8 hex characters inside a descriptor's brackets, and its own test vectors reject a seven character fingerprint, a nine character one, and one carrying a letter outside hex. When a wallet refuses to import your descriptor, count that field first.
How it works
BIP-32 gives an extended key two identities of different lengths, and a fingerprint is the short one. The identifier is the Hash160 of the serialized public key, RIPEMD-160 over SHA-256, with the chain code ignored, and only the first 32 bits of that identifier are called the fingerprint. The other 128 bits are not thrown away: BIP-32 says the full 160 bit identifier could be used internally, while the short form only serves as a fast way to detect parent and child nodes, so software must be willing to deal with collisions.
Consistency between a fingerprint field and the key around it is a validity rule, not a convention. A master key has no parent and writes 0x00000000 in its parent fingerprint field, and BIP-32's fifth test vector, the set covering keys that must be recognized as invalid, lists both an xprv and an xpub carrying zero depth with a non-zero parent fingerprint. Software that imports either string without complaint is not following the spec, which is worth knowing before you hand it a restore.
Where you see it
Key fingerprints live in two machine readable formats above all, output script descriptors and partially signed bitcoin transactions, and in both they sit immediately in front of a derivation path.
BIP-380 puts key origin information in square brackets ahead of the key and is strict about the width: exactly 8 hex characters, then the hardened and unhardened steps. Its invalid expression list names three failures of that one field, deadbef at seven characters, deadbeeef at nine, and gaaaaaaa opening with a letter that is not a hex digit. All three are rejected outright, so a mistyped fingerprint costs you an import error rather than a wallet quietly watching the wrong branch.
BIP-174 pairs a 4 byte fingerprint with a path written as 32 bit little endian integers, and for the global extended public key entry the count of those integers must match the depth the xpub itself declares. That count is what lets a signer line a quoted path up against the key it was handed, instead of taking the label on trust.
On a device screen the same eight characters answer one question: which seed is this. They give away nothing spendable, because a truncated hash cannot be turned back into a key or an address. They are still an identifier, so two descriptors carrying the same eight characters are a visible link between those two branches.
Key fingerprint vs bitcoin address
A key fingerprint and a bitcoin address begin at the same hash and stop being comparable immediately afterwards. BIP-32 notes that an extended key's identifier corresponds exactly to the data used in traditional bitcoin addresses, then advises against writing that identifier in base58, because it would be read as an address and wallet software is not required to accept payment to the chain key itself. A fingerprint keeps 4 of the identifier's 20 bytes and is written in plain hex, so it is too short to be mistaken for a payment destination even by accident. Eight hex characters in a descriptor say which key a path began at; an address says where coins are allowed to go.