Most explanations of Monero either stop at "it's private" or leap straight into elliptic curve arithmetic. There is a useful middle level: enough detail to understand why Monero behaves the way it does — why you cannot look up a balance, why transactions are large, why syncing takes so long, why a view key is a meaningful thing to hand over.
This walks through the three mechanisms in the order a transaction uses them.
The problem being solved
A blockchain is a public database that strangers agree on. That agreement requires everyone to verify every transaction. The obvious way to make verification possible is to make everything visible — which is what Bitcoin does, and it works.
The cost is that the ledger is permanent, public, and searchable forever. Anyone with your address can see your balance and every payment you have ever made or received. Businesses expose their revenue to competitors, employees expose their salaries, and any coin ever associated with a crime carries that association forever.
Monero's design question is: can the network verify a transaction is valid without learning who sent it, who received it, or how much it was for?
The answer is yes, and it takes three separate constructions because there are three separate fields to hide.
1. Stealth addresses — hiding the receiver
Start with the receiver, because it explains the most surprising property of Monero.
When you share a Monero address, it is not a location on the blockchain. It is a pair of public keys — a public view key and a public spend key — packed into one string.
When someone pays you, their wallet does this:
- Generates a random one-time secret for this transaction.
- Combines that secret with your two public keys to derive a brand-new one-time address that has never existed before.
- Sends the funds to that one-time address, and publishes a small piece of data (a transaction public key) that lets you — and only you — recognise it.
Your published address never appears on the blockchain. Not once. Pay the same person a hundred times and you create a hundred unrelated one-time addresses, and nobody examining the chain can tell they belong to the same recipient.
This is why balance lookup is impossible
Here is the consequence people find genuinely disorienting. There is no index from your address to your money, because your address is not on the chain.
To find your funds, your wallet takes your private view key and tests every transaction on the blockchain, one at a time, asking: does this output derive to an address I control? Almost always no. Occasionally yes, and that one is yours.
That is not a slow implementation of a lookup. It is the only way, by construction. No index exists to build, and if one could be built the privacy would be gone. Every "why is my wallet syncing" question in Monero traces back to this single design fact, and so does the entire existence of light wallet servers.
View tags: a small optimisation added in 2022 attaches a one-byte hint to each output. A wallet can reject the overwhelming majority of outputs after checking a single byte, instead of doing the full derivation every time. It made scanning several times faster without weakening anything meaningful — but the fundamental "check everything" model is unchanged.
View key and spend key are different powers
This split matters more than almost anything else in Monero:
- The view key can see incoming payments. It cannot spend.
- The spend key can spend. It is the one that actually controls the money.
That separation is what makes view-only wallets, auditability, and light wallet servers possible at all. It is also the exact thing you should understand before handing a view key to any third party — it is permanent read access to everything you receive.
2. Ring signatures — hiding the sender
Hiding the receiver is not enough. If the network can see which output you are spending, and that output was created by an earlier transaction, the graph reassembles itself.
So when you spend, your wallet does not point at your output. It builds a ring: your real input plus fifteen decoys pulled from other transactions on the chain, for a ring size of sixteen. It then produces a signature proving that the owner of one of these sixteen outputs authorised this spend — without revealing which one.
The verifier can confirm the signature is valid. It cannot determine which ring member produced it. To any observer there are sixteen equally-formed candidates.
Preventing double-spends without identifying anyone
This creates an obvious problem. If nobody knows which output was spent, what stops you spending the same output sixteen times?
The answer is the key image: a value derived deterministically from the output's private key. The same output always produces the same key image, and no other output can produce it — but the key image reveals nothing about which output it came from.
Every transaction publishes its key image. Nodes keep a list of every key image ever seen and reject repeats. Double-spending becomes impossible while the spender stays hidden. It is an elegant piece of design and it is why Monero can have both properties at once.
The honest limitation
Sixteen is a real anonymity set, but it is a finite one. The decoys come from the chain's own history, chosen by an algorithm that mimics real spending patterns. An adversary who can identify some ring members as their own — by flooding the chain with their own outputs — shrinks your effective set.
This is the main known structural weakness, and it is why the long-term direction is full-chain membership proofs, which would replace the ring of sixteen with a proof of membership in the set of all outputs that have ever existed. That work has been in development and audit for some time. We cover the practical impact in is Monero traceable.
3. RingCT — hiding the amount
The third field. This one seems impossible at first: how does the network confirm that inputs equal outputs if it cannot see either?
Ring Confidential Transactions, mandatory since 2017, use cryptographic commitments. A commitment is a value that binds you to a number without revealing it — you cannot change your mind later, and nobody can read it.
The useful property is that these commitments are additive. Add up the commitments to the inputs, add up the commitments to the outputs plus the fee, and if the two sums match, the amounts balance. The network verifies conservation of value without learning a single number.
Why range proofs exist
One gap remains. If amounts are hidden, what stops someone constructing an output with a negative value, which would let the sums balance while creating money from nothing?
A range proof accompanies each output, proving the hidden amount falls within a valid range — no negatives, no overflow. Early range proofs were enormous; the introduction of Bulletproofs in 2018 and Bulletproofs+ in 2022 shrank them dramatically, cutting transaction sizes and fees by an order of magnitude. If you remember Monero transactions being expensive, that is what changed.
The acknowledged trade-off: because amounts are hidden, Monero's total supply cannot be audited by simply adding up the ledger the way Bitcoin's can. A hypothetical inflation bug could in principle be exploited invisibly. This is a genuine cost of the design, not a detail to skip past. It is mitigated by heavy review of the value-conservation code and by community-run supply verification efforts — but it is a real trade-off, and anyone claiming Monero has no downsides is not being straight with you.
Putting a transaction together
With all three in place, sending Monero looks like this:
- Your wallet picks outputs you own that cover the amount, using your spend key.
- For each, it builds a ring of sixteen and produces a ring signature, plus a key image to prevent reuse.
- It derives one-time stealth addresses for the recipient and for your own change.
- It commits to the amounts with RingCT and attaches range proofs.
- It broadcasts the result — and thanks to Dandelion++, the transaction is relayed along a randomised path before general broadcast, making the originating IP harder to pin down.
What lands on the chain: a transaction of a certain size, at a certain time, paying a certain fee, with sixteen possible sources per input, unreadable destinations, and encrypted amounts.
What it costs
Everything above has consequences, and they explain nearly every complaint people have about Monero.
Transactions are larger. Sixteen ring members and range proofs mean a Monero transaction is several times the size of a Bitcoin one. Bulletproofs+ helped enormously, but the floor is higher.
Scanning is slow. No index means checking every transaction against your view key. A wallet restoring years of history has real work to do — which is why restore heights exist and why getting one wrong hides your money.
Light wallets require a trust decision. A phone cannot scan the whole chain. Something has to, which means either you run a server or someone holds your view key. There is no third option that preserves both convenience and secrecy.
Hardware wallet support is harder. More complex signing means a smaller ecosystem of compatible devices.
These are not oversights. They are the price of the properties, and the design consistently chooses privacy when the two conflict.
The other design choices
Two more decisions worth knowing, since they follow the same philosophy:
Dynamic block size. Monero has no fixed block size limit. Blocks grow when demand rises, subject to a penalty that prevents abuse. There is no fee market crisis by design, because there is no artificial scarcity of block space.
Tail emission. After the main emission curve completed, Monero switched to a permanent small fixed reward per block. This is deliberate and controversial: it means Monero is mildly inflationary forever. The reasoning is that a security budget funded purely by fees is a fragile long-term assumption, and paying miners a predictable amount is worth a small, decreasing percentage of dilution.
RandomX. The proof-of-work algorithm is designed to run well on ordinary CPUs and badly on specialised hardware, keeping mining accessible to individuals. We cover the practical side in mining Monero at home.
The short version
- Stealth addresses hide the receiver. Your address never touches the chain, which is why balances cannot be looked up and why wallets must scan.
- Ring signatures hide the sender by mixing your input with fifteen decoys; key images stop double-spends without unmasking anyone.
- RingCT hides amounts using additive commitments, with range proofs preventing negative values.
- All three are mandatory on every transaction — there is no transparent mode, which means there is no smaller, more suspicious anonymity set to fall into.
- The costs are real: bigger transactions, slow scanning, a light-wallet trust decision, and an unauditable supply.
Every wallet you use is an interface to this machinery. If you want to see it from the other side — what a server can observe when it scans on your behalf — read how light wallets work. If you want to run the machinery yourself, our self-hosting guide covers the whole stack.