A watch-only wallet lets you monitor Bitcoin addresses, balances and transactions without placing the private keys that can spend those coins on the monitoring device. It can show incoming payments and, if configured with the correct wallet descriptor or extended public key, generate receiving addresses. It cannot independently authorize an outgoing Bitcoin payment. The Blockstream watch-only setup guide explains how its app imports public wallet information while retaining signing authority elsewhere. The key trade-off is privacy: public information cannot normally steal your coins, but an extended public key can expose far more of your transaction history than one receiving address.
A watch-only setup is useful when you store keys on a hardware wallet, monitor a business treasury, or need payment visibility from a phone without putting signing secrets on that phone. It can also be abused in scams: seeing a large balance in a watch-only app is not proof you control that money.
Quick safety summary
- A watch-only wallet can monitor public Bitcoin activity but cannot sign a spend by itself.
- Import only a public address, xpub or public-only descriptor—never a seed phrase, xprv or private key.
- Verify receiving addresses and spending details on the real signing device.
- A visible balance is not proof of ownership; control sufficient to satisfy the wallet’s signing policy is the relevant test.
What is a watch-only wallet?
A watch-only wallet is a wallet interface configured with public information rather than the private keys needed to sign transactions. In Bitcoin, it can track one address or an entire deterministic wallet account. Its purpose is observation, not custody of signing secrets. The BlueWallet product documentation specifically supports imported public addresses and extended public keys; it also describes how compatible hardware wallets can sign a prepared transaction separately.
The phrase “wallet” can be misleading because some watch-only configurations know very little. One Bitcoin address identifies activity involving that one address. An account-level extended public key or output descriptor may allow software to derive a sequence of external receiving addresses and change addresses. Those are very different levels of visibility.
For a normal Bitcoin payment, the network requires a valid signature or another satisfying witness/script condition. A device that holds only suitable public account data does not possess the key needed to make such a signature. Even if it can compose an unsigned transaction, another signer must authorize it before broadcast.
What can you do with a watch-only wallet?
The core activities are checking balances, tracking confirmations, reconciling deposits and, with account-level data, deriving receive addresses. Some apps can prepare a partially signed Bitcoin transaction (PSBT) to be signed by a separate device. This is a workflow capability, not a way around the missing private key.
| Capability | One public address | Account xpub / descriptor | Signing wallet |
|---|---|---|---|
| View transactions for imported address | Yes | Yes, for derived addresses | Yes |
| Automatically discover other wallet addresses | No | Usually, within the imported account structure | Yes |
| Track change outputs from the account | No, unless imported separately | Usually, when descriptor/path is correct | Yes |
| Generate new receiving addresses | No | Often | Yes |
| Prepare unsigned spending transaction | Software-dependent | Software-dependent | Usually |
| Sign and authorize a spend by itself | No | No | Yes |
| Reveal recovery phrase from public data | No | No | Depends on signer design |
| Leak useful financial history if shared | Yes | Potentially much more | Yes |
Scroll the table horizontally to see all columns.
“Usually” matters because not every application accepts every Bitcoin script type, descriptor or derivation path. A one-address import and a complete multisignature descriptor are not interchangeable.
Public address vs xpub vs wallet descriptor
The most important setup decision is what public information to import. Each option gives a different level of coverage and creates a different privacy exposure.
A single address lets the app show payments to that address and its transaction history. It does not reveal all other addresses the wallet may use. This is appropriate when someone only needs to monitor one invoice address, not an entire account.
An extended public key (often called xpub, ypub or zpub in wallet interfaces) enables derivation of many child public keys under a hierarchical deterministic account. The underlying system is described in Bitcoin Improvement Proposal 32. Such a key cannot ordinarily authorize spending without private material, but it can expose a complete cluster of addresses to whoever receives it. An xpub derives only non-hardened descendants: an account export does not automatically reveal other hardened accounts or unrelated imported keys. BIP32 also warns that a parent xpub combined with a leaked non-hardened descendant private key can expose the parent extended private key; never share child private keys.
An output descriptor identifies scripts and derivation details needed to describe a wallet account more precisely. BIP 380 standardizes descriptor syntax, and related Bitcoin Core documentation explains how descriptors support wallet import and recognition. For multisignature or Taproot setups, correct policy data can matter more than pasting an old-style xpub alone. Descriptors can contain WIF private keys or xprvs: use the signer’s public-only export, not just anything labeled “descriptor.” A valid checksum detects transcription errors; it does not authenticate the wallet or prove the descriptor is public-only.
Why the derivation path and change branch matter
Bitcoin wallets usually separate receiving addresses from internal change addresses. If an app imports only the receiving branch, its balance may be incomplete after a transaction returns change to an internal branch. A complete account import must cover both branches, whether through separate receive/change descriptors or a supported multipath descriptor. Also check the address scan range or gap limit; account data alone does not guarantee discovery of every used address.
For example, suppose a wallet received 0.08 BTC and later spent 0.03 BTC with a 0.0001 BTC miner fee. The original UTXO is consumed. The wallet may produce 0.03 BTC to the recipient and 0.0499 BTC in change. An address-only watcher following the original receiving address can fail to display the new spendable change correctly; a complete account watch configuration can identify the change output.
BTC-Pulse’s Bitcoin change-output guide explains why Bitcoin does not simply decrement a wallet balance. Its coin-selection article also shows why looking at just one address can hide the UTXO picture.
How to create a watch-only Bitcoin wallet
Do not begin by searching for a random “wallet checker” site. Use a legitimate application’s documented watch-only import. The following process describes concepts common to BlueWallet, Blockstream and Sparrow; menu labels vary by version.
Step 1: secure the real signing wallet
Confirm that the existing hardware or offline wallet is working and that its recovery backup is protected. A watch-only copy does not replace the signer or its recovery phrase. If the original signer is lost and no valid backup exists, importing an xpub will not restore spending access.
Step 2: export only public account information
Find the signer application’s export for an account descriptor or extended public key. Verify that you are exporting a public value, not a seed phrase, xprv or ordinary private key. A private extended key can expose an entire derived key tree and must never be imported into a supposed watch-only website.
For a narrow one-address task, exporting just the address can minimize unnecessary disclosure. For full wallet monitoring, an appropriate descriptor is usually more informative.
Step 3: import into a trusted watcher
In BlueWallet, tap the add-wallet icon (+), choose Import wallet, then paste or scan a public address or xpub/ypub/zpub. Offline spending requires a compatible separate signer.
In Blockstream on iOS, open the relevant wallet, then Settings → Wallet Details. Singlesig users export public extended keys or output descriptors; multisig users generate a watch-only username and password. The Android guide uses the asset’s three-dot menu → Watch-only → account selection → Copy output descriptor; its illustrated asset is L-BTC, so confirm the procedure for your actual network and wallet type. To add the watcher, open Home → Wallet icon → Set Up a New Wallet → Get Started → Set Up Watch Only. Use the supported public-data import for singlesig; for multisig select Set up with username and password, choose the correct network and enter the generated credentials. Configure each wallet separately. Those credentials expose accounts and transaction history: keep them private and update them regularly from full-access mode.
BitBox’s Sparrow guide recommends the descriptor option: in BitBoxApp select the Bitcoin account → Account info → View account details and copy the public wallet descriptor. In Sparrow choose File → New Wallet → Create Wallet, then Script Policy → Edit next to Descriptor, paste it, click OK and Apply, choose file-password protection and wait for the history scan. Its alternative extended-key method requires the matching script type and Keystores → xPub / Watch Only Wallet. If Remember wallet is disabled, connect and unlock the BitBox02 before export. A watch-only import does not itself enable signing.
Follow the exact procedure for your wallet type. A multisignature wallet may require more policy data than a single xpub. Do not copy an unfamiliar QR code without understanding whether it represents public or secret data.
Step 4: verify receiving addresses on the signer
Before using a newly generated receiving address for any payment, compare it with the address shown by the real hardware device. The BitBox instructions explicitly recommend address verification on the BitBox02 screen. A compromised watching device could show an attacker-controlled address even if the underlying private keys are safe.
Step 5: reconcile history and change
Compare balances, a few transaction identifiers and the next receiving address with the signing wallet. If histories disagree, inspect network selection, account type, derivation path, descriptor checksum and whether the change branch was imported. A mismatch is a reason to stop and diagnose, not to enter a seed phrase into the watching app.
Signing a payment with a watch-only configuration
A watcher may prepare a transaction while leaving signature creation to a hardware wallet. The usual round trip is:
Watch-only app builds unsigned transaction → signer displays details → user verifies recipient, amount, fee and change → signer authorizes → signed transaction returns → watcher broadcasts
BIP 174 specifies the Partially Signed Bitcoin Transaction format that enables compatible software and signing devices to exchange unsigned and partially signed transactions. The exact QR, USB or file workflow depends on hardware support. A multisignature policy requires the necessary signing threshold, not merely one valid signer.
A watch-only configuration is therefore not necessarily “receive only.” It may be able to coordinate spending, but it cannot complete a spend on its own. This is a useful distinction when a wallet has both monitoring and PSBT functions.
Privacy risks: an xpub is not a secret key, but it is sensitive
Sharing a Bitcoin address reveals its public activity. Sharing an account xpub can reveal many derived addresses, including future receive and change addresses. Anyone with that data may aggregate balances, infer savings behavior or follow payments over time.
The privacy cost can be significant for a business. Giving an accounting vendor a complete xpub may expose transactions with customers who were never part of the vendor’s assignment. Using a hosted watcher also means the server may learn addresses queried by the app, depending on its architecture.
Connecting an appropriate wallet to your own Bitcoin node can reduce disclosure to a third-party indexer. BTC-Pulse’s full-node guide describes independent verification and the privacy benefits of querying infrastructure you control. No watcher can undo information already public on the chain, however.
A good policy is least privilege: give an employee an invoice address when they need one invoice, not the treasury account’s entire descriptor. Reserve xpub exports for software and people who truly need account-level visibility.
Watch-only wallet scams: seeing coins does not mean owning them
One of the clearest scam patterns is a stranger selling or “recovering” a watch-only wallet showing a high BTC balance. The app may display genuine blockchain coins, but the buyer receives only public viewing data. The scammer then asks for a payment to unlock, activate or extract the funds.
The mechanism is straightforward: anyone can watch a public address, including addresses controlled by other people. A screenshot is not proof of ownership. An xpub also is not a transferable spending claim.
Other red flags include a supposed wallet support representative requesting your seed phrase, an unfamiliar extension telling you to import an xprv, or a fabricated “activation fee” that must be deposited before the wallet will send. Blockstream’s explanation of watch-only mode is explicit about the absence of spending access without a signer.
Never pay someone for access to a watch-only balance. Ask instead whether you control the original private keys and can independently verify receiving and signing on trusted hardware. A claim that a public key can be “upgraded” into the private key should be treated as fraudulent.
How to diagnose a missing or incorrect balance
A watcher showing zero does not prove coins were stolen. Nor does a positive balance prove you can spend them. Use this sequence:
| Symptom | Likely cause | Safer next check |
|---|---|---|
| One address shows funds but full account appears empty | Different derivation or address type | Compare descriptor and signer settings |
| Old receives appear but new change disappears | Missing internal branch | Check account descriptor rather than only xpub path |
| Correct balance but Send is disabled | Intentional watch-only mode | Use original signer or supported PSBT workflow |
| Receiving address differs from hardware screen | Import configuration problem or compromise | Do not receive; verify signer and path |
| Someone offers to sell a funded watch-only wallet | No proof of signing authority | Do not pay; reject the offer |
| Balance differs across explorers | Indexing lag, chain/network mismatch or interpretation | Verify transaction IDs and block confirmations |
| Mobile watcher prompts for recovery words | Wrong import mode or malicious software | Stop; use verified vendor documentation |
Scroll the table horizontally to see all columns.
The decision tree should end in either a verified account match or a paused transaction. Trying random recovery words or sending a test payment to prove an unknown address is yours can cause irreversible loss.
Watch-only vs custodial, hot and hardware wallets
These terms describe different dimensions, which is why they often get mixed together. “Hot” refers to signing keys on an internet-connected device; “hardware” refers to a dedicated signer; “custodial” describes who controls the keys; “watch-only” describes a view without the keys.
A hardware wallet can be paired with a watch-only app. An exchange account may show balances, but that is not the same as a self-custody watch-only view: the exchange can record a customer balance in its own database and controls the onchain assets under its custody model.
A watch-only configuration reduces the impact of compromising the monitoring device, but it cannot remove errors in signing, malicious destination addresses, leaking xpub data or losing the recovery backup. Security depends on the entire workflow, not on one toggle.
Frequently asked questions
Can a watch-only wallet withdraw Bitcoin?
Not by itself. It lacks signing authority. Some apps can compose a transaction for an offline signer, and the signed transaction can then be broadcast.
Is a watch-only wallet safe?
It can improve separation of duties because private keys remain on another device. Public-account exports still present privacy risks, and a malicious interface can show false addresses. It should not be treated as a replacement for secure signing.
Can I recover a wallet with only an xpub?
You can reconstruct some public monitoring information, not the private keys. Recovery of spending control requires the appropriate original signing secret or recovery process.
Does a watch-only wallet receive actual money?
Coins are recorded by the Bitcoin network, not held in the viewing software. A payment to an address may be real, but only whoever controls the relevant signing conditions can spend it.
What is the difference between an address and an xpub?
An address generally identifies one payment destination. An account-level xpub can derive many public keys, offering broader tracking but also exposing more history.
Does watch-only work with Ethereum?
Anyone can follow a public Ethereum address in an explorer or portfolio app without the private key. That resembles watch-only monitoring, but Bitcoin-specific xpubs, descriptors and PSBT signing workflows do not transfer unchanged to Ethereum.
BTC-Pulse Take
A watch-only wallet is most useful when its limited privileges are deliberate. Put signing material on trusted hardware, give a monitoring app only the public information needed for its task, and verify receive and spend details on the signing device. Public keys can be safe from a theft perspective without being private.
The most common confusion is assuming that a visible balance conveys ownership. It does not. The right test is independent control of a valid signer, not a screenshot. Keep an account descriptor private enough to protect financial history, and treat unsolicited “funded watch-only wallet” offers as scams.
This is educational material, not personalized security or financial advice. Software versions and wallet-specific procedures change; confirm instructions with the relevant vendor before moving funds.
Sources
- Blockstream watch-only setup — Blockstream watch-only setup
- Blockstream watch-only mode — Blockstream watch-only mode
- BlueWallet watch-only documentation — BlueWallet watch-only documentation
- BitBox watch-only Sparrow instructions — BitBox watch-only Sparrow instructions
- BIP32 hierarchical deterministic wallets — BIP32 hierarchical deterministic wallets
- BIP380 output descriptors — BIP380 output descriptors
- BIP174 partially signed Bitcoin transactions — BIP174 partially signed Bitcoin transactions
- Sparrow official documentation — Sparrow official documentation
