The two halves of a key pair have different jobs
A private key is a very large secret number produced by a secure source of randomness. Software derives a public key from it mathematically. Computation in that direction is practical, but no known ordinary method can recover the private key from the public key.
The public key can verify a signature, while the private key creates it. They should not be confused with a username and password. The network has no central list of people and no button for resetting a forgotten key; it merely checks whether the supplied data satisfy the rules of a particular output.
An address is neither an account nor a private key
A Bitcoin address is encoded data that helps the payer's wallet build the correct output condition. Depending on its type, it may be based on a hash of a public key, a script or a Taproot public key. A checksum catches some typing mistakes, but it cannot prove that the address belongs to the person you intend to pay.
An address can receive payments, and safer wallets generate a fresh one for each new payment. Reusing an address makes public payments easier to link and reduces privacy. Publishing a receiving address does not by itself give anybody the power to spend the corresponding outputs.
- the private key remains secret and can create a signature
- the public key allows a signature to be verified
- an address helps construct a payment condition and can be shared with a payer
A signature approves specific data
When spending, a wallet does not broadcast the private key. It uses that key to create a digital signature over precisely defined transaction data. A node can use the public key to check that the signature matches and that the protected portion of the transaction has not been altered.
Bitcoin has historically used ECDSA signatures and also uses the Schnorr signatures defined in BIP 340 for Taproot outputs. The essential idea for an ordinary user is the same: a valid signature proves authorization for the specified instruction; it neither reveals the secret nor grants general permission for arbitrary future payments.
Cryptography cannot prevent every human mistake
If an attacker obtains a private key or recovery words, they can make a valid signature and the network cannot know that it is theft. If a user signs a transaction to the wrong address, the mathematics may regard it as perfectly valid. The destination and amount should therefore be checked on a trusted display.
Wallets commonly manage many keys through a single backup. Seeds, passphrases, hardware wallets and multisignature arrangements will be covered in the later security level. For now, the precise rule is enough: an address is for receiving, a public key is for verification, and secret material is never sent to a stranger or to website support.