Permissionless

Generating a bitcoin address is arithmetic performed on your own device, not a request to a registry, and there is no step at which the network checks who you are. This is the sharpest difference between bitcoin and the accounts you already have. It is also routinely oversold, because almost everything built around bitcoin, starting with the exchange you buy from, does ask permission.

How it works

Permissionless is a consequence of how bitcoin identifies owners: by keys, not by people.

A wallet creates a private key by generating a large random number offline. The matching address is derived from it mathematically, and the network learns the address exists only when coins arrive at it. There is no registration message, no directory, and nothing to approve or reject. The same is true of the other roles: downloading Bitcoin Core and syncing the chain makes you a node without asking anyone, and pointing hardware at a pool makes you a miner. Bitcoin has been running under those terms since the genesis block on January 3, 2009.

What the network does police is the rules. A transaction must be validly signed, must spend outputs that exist, and must pay a fee high enough for someone to relay and mine it. Those constraints apply identically to a first-time buyer and to a corporate treasury, and they are the only gatekeeping the base layer performs.

Permissionless is not the same as consequence-free, and the distinction is easy to demonstrate. The US Treasury sanctioned the Tornado Cash smart contract addresses in August 2022, and the code kept working the entire time, because nothing about a sanction stops a network from processing transactions. Treasury removed the addresses from the sanctions list in March 2025 after a federal appeals court ruled that immutable smart contracts were not property that could be designated. The protocol was never the thing that could be switched off; people and companies were.

Where you see it

Permissionlessness is most visible at the boundary where it stops, which is usually the exchange.

Buying is a permissioned act nearly everywhere. Kraken, Coinbase, Bitpanda, Luno, and every other regulated venue verify identity before they let fiat in, and they can and do decline customers by country. Of the 231 countries this site covers, 11 ban bitcoin outright and another handful restrict it heavily, and those rules bite at exactly this boundary, on the banks and the platforms, because that is where the permission layer lives.

Holding and sending are where the property reappears. Once coins are in a wallet whose keys you control, no company approves your outgoing payment, no daily limit applies, and no account can be closed. That is why the withdrawal step matters more than which exchange you pick: it is the moment you move from a permissioned system to a permissionless one.

It shows up in the smaller details too. Nobody grants you a receiving address, so you can generate a fresh one for every payment, which is the standard privacy practice. Nobody has to approve your node, so you can verify your own balance instead of asking a server for it. Nobody can stop you inheriting coins, which is also why inheritance planning is entirely your responsibility.

Permissionless vs no-KYC exchange

Permissionless describes bitcoin's protocol; a no-KYC exchange is a business choosing, or claiming, not to verify identity. The protocol's property is permanent and applies to everyone. A platform's policy is temporary, jurisdiction-dependent, and frequently reversed under pressure, sometimes retroactively for existing customers. Treating a no-KYC service as though it inherits the base layer's guarantees is how people end up with funds stuck at a company that has just discovered compliance, or that never intended to return them.