What is a public key? Public vs private keys explained simply

A public key is one half of a matched pair of keys used in modern cryptography. You can publish it, email it or print it on a website, and that is safe by design: the public key can only lock things and check signatures. The other half, the private key, stays secret and is the only thing that can unlock what the public key locked or create a valid signature. This guide explains what a public key looks like, what it is used for, how it differs from a private key, and the practical rules for handling both.

The short answer

A public key is a long number, usually shown as a block of letters and digits, that is mathematically linked to a private key. The link works in one direction only. Anyone who has the public key can:

• Encrypt a message so that only the owner of the matching private key can read it.
• Verify a digital signature, proving that a message or file was signed by the private key and has not been changed since.

Knowing the public key does not let anyone work out the private key in any realistic amount of time. That one-way property is what makes the scheme useful. Our article on how public-key encryption works walks through the mechanism step by step.

A useful analogy: the open padlock

Imagine you hand out open padlocks to anyone who asks. A friend can put a letter in a box and snap your padlock shut. Once it is closed, even the friend cannot reopen it; only your key can. The padlock is the public key: giving it away costs you nothing. The key on your keyring is the private key: if you lose it, nobody can open the boxes, and if someone copies it, they can open them all.

The analogy covers encryption. Signatures work the other way round: you use the private key to make a mark that only you could have made, and anyone with the public key can check it.

What a public key looks like

Public keys are binary data, so they are shown in text-friendly encodings. Some common forms:

• SSH public key: one line starting with the algorithm name, for example ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA... user@laptop.
• PEM format: a block between -----BEGIN PUBLIC KEY----- and -----END PUBLIC KEY-----, used by TLS libraries and many APIs.
• PGP key: a longer block used for encrypted email and software signing, usually identified by a short fingerprint.

Because full keys are long, people compare fingerprints instead: a short hash of the key such as SHA256:Qa3f.... If two fingerprints match, the keys match.

Public key vs private key

	Public key	Private key
Who has it	Anyone	Only the owner
Used to	Encrypt, verify signatures	Decrypt, create signatures
Safe to share	Yes	Never
If lost	Copy it again from the private key	Encrypted data and identity are lost
If leaked	No harm	Attacker can impersonate you and read your messages

The pair is generated together. The private key is created first from random numbers, and the public key is calculated from it. You can always recreate a public key from its private key, but not the reverse.

Where you use public keys every day

• HTTPS websites. Every site with a padlock sends a certificate containing its public key. Your browser uses it to set up an encrypted connection and checks the certificate’s signature to confirm the site’s identity. See how HTTPS certificates work.
• SSH logins. Developers put their public key on a server; the server lets in whoever can prove they hold the matching private key, with no password typed. Our guide to SSH keys shows how.
• Messaging apps. End-to-end encrypted chats exchange public keys between phones, so messages can be read only on the devices that hold the private keys.
• Software updates. Operating systems and app stores check the publisher’s signature with a public key before installing an update. See how software updates work.
• Passkeys. A passkey is a key pair: the website stores only your public key, so a stolen database contains nothing an attacker can log in with.

The hard part: trusting a public key

The mathematics is rarely what breaks. The weak point is making sure a public key really belongs to the person or site you think it does. If an attacker gives you their public key while claiming it is your bank’s, you will encrypt your data for the attacker.

Systems solve this in different ways. HTTPS relies on certificate authorities that sign site keys. SSH shows you a server’s fingerprint on the first connection and warns you if it ever changes. Messaging apps let you compare “safety numbers” in person. Whichever method is used, the rule is the same: a public key is only as trustworthy as the way you obtained it.

Practical rules

• Share public keys freely, but get other people’s keys from a trusted source and compare fingerprints when it matters.
• Never send a private key by email, chat or issue tracker. If you did, generate a new pair and remove the old public key everywhere it was installed.
• Protect private keys with a passphrase or keep them in hardware such as a security key or the phone’s secure chip.
• Prefer modern algorithms: Ed25519 or ECDSA for signatures, RSA only with 3072 bits or more.
• Keep a backup of private keys that protect data you cannot afford to lose, such as encrypted archives.

Frequently asked questions

Can someone hack me if they have my public key?

No. A public key is designed to be published. The risk comes only from a leaked private key or from trusting a fake public key.

Is a public key the same as a password?

No. A password is a shared secret that both you and the server know. With a key pair, the server holds only the public key and never sees your secret, which is why keys are safer than passwords.

How long is a public key?

It depends on the algorithm. An Ed25519 public key is 32 bytes, about 68 characters in SSH format. An RSA 3072 key is roughly 400 bytes.

Can I use the same key pair everywhere?

You can, but separate pairs per device or purpose limit the damage if one is lost and make it easy to revoke access for a single laptop.

In short: a public key is the shareable half of a key pair. It encrypts and verifies; its private partner decrypts and signs. Publishing the public key is safe. Guarding the private key and confirming that a public key really belongs to its claimed owner are what keep the system secure.