A wallet address is not a private key; it is a value derived from it. This is for anyone who sends or receives crypto and needs to know which string is safe to share.
The short version: an address is where assets are sent; a private key is what authorizes assets to leave. You can publish an address. You must never publish a private key. If someone has only your address, they can send you money but cannot touch what you hold. If someone has your private key, they have everything at that address and can move it without asking.
The one-way derivation
The mechanism is one-way. On Ethereum and zkSync Era, a wallet starts with a private key: a random 256-bit scalar on the secp256k1 curve. From that key, the wallet computes a public key by elliptic curve multiplication. Then it hashes the public key with Keccak-256 and keeps the final 20 bytes. Prepend 0x, and that is the address.
The derivation only goes one way. The address can be computed from the private key instantly. The private key cannot be computed from the address. That asymmetry is the whole security model. A public address is a commitment you can share; the private key is the secret that lets you produce a valid signature.
What a transaction actually signs
When you send ETH or an ERC-20 token, your wallet does not move anything by itself. It builds a transaction: nonce, recipient, value, data, gas limit, max fee, and chain id. Then it signs that exact payload with the private key. The signature is the proof that the sender controls the address.
The network does not need your private key. It recovers a sender address from the signature and compares it with the transaction's from field. If they match, the transaction is valid. The private key never appears on the ledger; the signature does. That is why a hardware wallet can sign a transaction without ever exposing the key.
Token approvals are keyed to addresses
ERC-20 transfers work the same way, with one extra layer. The token contract keeps a mapping of allowances, keyed by owner address and spender address. When you approve a DEX to spend a token, you sign an approval transaction. That transaction tells the token contract: this spender address may move up to this amount from this owner address.
The approval is attached to the address, not to the key. The DEX's contract later calls transferFrom, and the token contract checks the allowance mapping. If the owner address approved the spend, the transfer succeeds. The DEX never sees the private key, and it never needs it. It only needs the allowance recorded under the address.
On zkSync Era, a DEX like SyncSwap runs on this same approve-and-transferFrom model. The address you connect is the address that signs the approval; the private key never leaves your wallet. What does that approval transaction look like when you click the button? SyncSwap's interface answers that.
Not every address has a private key
Not every address has a private key. A contract address is an address, but no private key corresponds to it. The funds at it are controlled by code, not by a key. Sending to a contract is sending to whatever rules that code enforces.
This is also the basis of account abstraction. On zkSync Era, an account can be a smart contract that defines its own signature checks, spending limits, or recovery rules. The address is still an identifier; the thing that authorizes movement is whatever the contract accepts. That makes the split between identifier and authorization explicit.
What confusing them costs
Confusing the two is expensive. If you send an address to someone, you have given them a destination. If you send a private key to someone, you have given them the account. The first is like giving your postal address; the second is like handing over the deed.
A private key is not a password. A password sits beside an account and can be reset by the service. A private key is the account's root of control; there is no forgot-password flow on a blockchain. If you lose it, no one can reset it. If you share it, no one can undo the transfer.
An address is 40 hex characters after 0x. A raw private key is 64 hex characters. If a 64-character string is about to go into an address field, stop. Mixed-case addresses exist for a reason: the case encodes a checksum, so a mistyped character fails before the transaction is broadcast. That is an attention tax, not a security feature. It catches typos, not theft of a key.
The practical rule follows: paste addresses into address fields, sign with private keys, and never let a private key leave the wallet. Getting this straight saves you the most expensive lesson in crypto, the one taught by a leaked key or a paste into the wrong field.
The verdict is simple: keep addresses public, keep private keys private, and understand that an address is a label, not a lock. The lock is the key — or, for contract accounts, the code the key triggers.