Watch-Only Wallets: Monitoring Without the Keys
Track a cold storage balance without exposing a key. What an extended public key reveals, and why sharing one is a privacy decision.
A watch-only wallet solves a narrow problem well: checking a balance without exposing anything that could spend it. For anyone holding funds in cold storage, it is the difference between checking casually and getting the hardware out.
What It Holds
An ordinary wallet holds keys that can authorise transfers. A watch-only wallet holds only public material.
That material takes one of two forms. Individual addresses, added one at a time, which is simple and does not scale. Or an extended public key, from which every address in a branch of the tree can be derived, which is how a real account is watched.
With an extended public key the wallet can generate the full sequence of addresses, including change addresses, and therefore show a complete balance and history without any ability to spend.
What It Cannot Do
It cannot sign. Signing requires the private key, which it does not have, and no amount of interaction with the wallet produces one.
It can build an unsigned transaction: a complete description of a proposed transfer, ready to be signed elsewhere. That is the useful half of a split setup.
The Air-Gapped Pattern
This is where watch-only wallets earn their place.
One device is connected and holds only public material. It sees the chain, shows balances, and constructs unsigned transactions. It is the one exposed to the network.
A second device holds the keys and never connects to anything. It receives an unsigned transaction by a channel such as a scanned code or a removable card, signs it, and returns the signed version the same way.
The connected device broadcasts what comes back.
Neither device ever holds both network access and a key. Compromising the connected one reveals a balance; it does not move funds. See cold storage for the wider setup this fits into.
The Privacy Cost
An extended public key is not a spending key and it is not harmless.
From it, anyone can derive every address in that branch. That means the entire balance, every transaction in or out, and every future address the account will use, visible indefinitely without any further access.
For a personal holding, that is a substantial disclosure to make to a piece of software, a synchronisation service, or anyone who gains access to the device holding it.
| What you share | They can spend | They can see |
|---|---|---|
| One address | No | Activity at that one address |
| Extended public key | No | Entire account balance and history, past and future |
| Private key or recovery phrase | Yes | Everything |
Treat an extended public key as sensitive even though it cannot spend. Where the purpose is to let someone else check a balance, sharing a single address discloses far less.
How the Wallet Gets Its Data
A watch-only wallet has to ask something about the chain, and what it asks reveals what it is watching.
A wallet querying a public server tells that server which addresses it cares about. That links those addresses to each other and to the network address making the request, which is a meaningful privacy leak even though no keys are involved.
Connecting to your own node removes this entirely, because the queries go to infrastructure you control. Some wallets use query methods designed to obscure which specific addresses are of interest, which is a middle path.
For a large holding, running a node is a reasonable step. For a small one, the convenience usually wins, and knowing the trade-off is being made is the point.
Setting One Up
Export the extended public key from the wallet or hardware device holding the funds. Devices normally offer this explicitly, often as a scanned code, and it is distinct from anything involving the recovery phrase.
Import it into the watch-only wallet. Confirm that the addresses shown match ones you recognise from the original wallet, because a mismatch usually means the derivation path differs; see derivation paths.
Check that the balance matches before relying on the setup.
What People Get Wrong About This
The first mistake is treating an extended public key as public in the ordinary sense. It cannot spend and it exposes everything else.
The second is exporting the recovery phrase when the extended public key was what was needed. Those are different exports and only one is safe to put on a connected device. A recovery phrase goes into the wallet or device it belongs to and nowhere else.
A third is assuming a watch-only setup is anonymous. The queries it makes are informative to whoever answers them.
A fourth is importing the wrong branch and concluding funds are missing, when the addresses shown are simply a different part of the tree.
And the last is expecting it to sign. It is watch-only by design, and a wallet that offers to spend from a watch-only import is not what it claims to be.
Where It Fits
Watch-only wallets pair naturally with hardware wallets and with any long-term holding that should not be touched routinely. The habit they enable is checking without handling, and reducing how often keys are exposed is most of what practical key security amounts to.
Common questions
What is a watch-only wallet?
A wallet loaded with public information only: addresses, or an extended public key from which addresses can be derived. It displays balances and history and can construct unsigned transactions, but it holds nothing capable of authorising a transfer.
Is it safe to put an extended public key on a phone?
It cannot move funds, so the financial risk is low. The privacy cost is real: that key derives every address in its branch, so anyone with it sees the whole balance and transaction history for that account, now and in future, without any further access.
Can a watch-only wallet send anything?
Not on its own. It can build an unsigned transaction, which then has to be signed by the device or wallet holding the keys. That split is the basis of air-gapped setups, where the watching device never touches a key and the signing device never touches a network.
Why not just check a block explorer?
For a single address that works. A watch-only wallet handles an account with many addresses, aggregates the balance, labels transactions and tracks change addresses, which is laborious to do by hand and easy to get wrong.
Does watching an address reveal anything to others?
It can. A wallet that queries a public server for balances tells that server which addresses interest you, which links them together and to your network address. Wallets that connect to your own node avoid this, and some use privacy-preserving query methods.
Read next
- Custodial vs Non-Custodial Wallets: Key Differences Compare custodial and non-custodial wallets: who holds keys, recovery options, control trade-offs, and what each approach does not protect against.
- How to Choose a Crypto Wallet: A Practical Guide Learn how to choose a crypto wallet based on your needs. Compare wallet types, security trade-offs, and what each approach does not protect against.
- How to Recover a Crypto Wallet: Seed Phrases and Moving Devices Learn what seed phrase recovery actually restores, what it misses, and how to move wallets safely between devices.
- Public and Private Keys: How the Pair Works Understand the public-private key pair: what each key does, how addresses derive from public keys, and what signing proves. Essential for crypto security.
- How Hardware Wallets Work: Keys, Signing, and Limits Hardware wallets keep private keys offline and sign transactions on-device. Learn the mechanism, what it protects, and what it doesn't.