Check an xpub or zpub balance privately

An extended public key lets anyone derive every address of your wallet — which is exactly why pasting it into a web "xpub explorer" is a bad idea. Bag does the derivation on your phone, asks a block explorer about individual addresses (through Tor if you want), and shows the balance as net worth in up to three currencies. The key is stored encrypted and never uploaded.

Updated 2026-09-10 · Applies to Bag 1.3 and later on Android and iOS

Bag home screen showing 1.50842 BTC net worth in USD, EUR and GBP with a one-week price chart — Home screen: the watch-only balance shown as net worth in three currencies with the price chart.

xpub vs zpub vs ypub

All three are the same kind of object: a BIP32 extended public key, 78 bytes encoded in Base58Check. The different prefixes were introduced (SLIP-132) so a wallet can tell from the string alone which script type the key is meant for:

Prefix	Standard	Address type	Addresses start with
`xpub`	BIP44 (or any path — the prefix says nothing about it)	Legacy P2PKH, or whatever the wallet chose	`1…`
`ypub`	BIP49	Nested segwit P2SH-P2WPKH	`3…`
`zpub`	BIP84	Native segwit P2WPKH	`bc1q…`

The catch is that the prefix is a convention, not a guarantee. Many wallets export an xpub for a native segwit account and rely on the derivation path (m/84'/0'/0') to tell you the script type. Feed that xpub to a checker that assumes legacy addresses and you get a balance of zero — not because the coins are gone, but because it looked at the wrong addresses. This is why Bag's single-key input insists on a zpub: the prefix and the script type agree, so a wrong address set is impossible.

Why a web xpub explorer is a privacy leak

A single address tells an observer one thing. An xpub tells them everything: every past receive address, every change address, every future address, the full balance and the entire history, forever. Once a website has it, you cannot take it back, and you have no idea whether the site logs it, sells it, or gets breached.

Even a well-meaning explorer sees your IP address alongside your whole wallet, which links the two. And most "xpub balance checker" pages are ad-supported, which means third-party scripts run on the same page as your key.

The only private way to check an xpub balance is the way a real wallet does it: derive the addresses locally, then query addresses — ideally in a way that does not link them to you. That is what Bag does.

How Bag checks a zpub balance

Parse and validate. Bag decodes the Base58Check string, checks the version bytes and checksum, and rejects private keys (zprv, xprv) with a warning before anything is stored.
Derive on-device. Using BIP32 public derivation it walks chain 0 (receive) and chain 1 (change), computing bc1q… addresses one by one. The chain-level key is cached, so each address costs a single elliptic-curve multiply.
Gap-limit scan. Each address is queried on the block explorer. Bag keeps going until it finds 20 consecutive unused addresses on a chain (the standard gap limit), with a hard cap of 1000 per chain so a misbehaving server cannot make it loop forever.
Sum and cache. Balances — confirmed plus anything still in the mempool — are summed, the total is stored encrypted, and the home screen converts it to fiat using Bag's own averaged price feed.

The explorer receives a series of unrelated-looking address lookups. With Route through Tor on, it does not even receive your IP.

Check a zpub balance in Bag

Get the zpub from your wallet
Most wallets show it under the account's details or export menu — look for Extended public key, Master public key or Export xpub, and pick the native segwit / BIP84 account. Sparrow: Settings → Export. Hardware wallets show it in their companion app. It starts with zpub.
Open Wallet & Privacy
Bag → Settings → Wallet & Privacy. Under WALLETS & HOLDINGS tap Add holding and keep the default zpub kind.

Wallet & Privacy sits at the top of Settings.
Label, paste, connect
Enter a label such as Cold Storage, paste the zpub and tap Connect Wallet. The scan runs immediately and the card fills in: BTC, sats, number of used addresses, last scan time.

The scanned wallet card with Scan Now for a manual refresh.
See it as net worth
Back on Home the balance appears in your chosen currencies. Tap the BTC amount to jump to the wallet list. The widget picks the same number up on its next refresh.

Net worth in USD, EUR and GBP driven by the watch-only balance.

What if my wallet only gives me an xpub?

Use the Multisig kind instead — despite the name it accepts any output descriptor, including single-key ones. Wrap the xpub in the script it belongs to, with the multipath suffix so both chains are covered:

wpkh([d34db33f/84h/0h/0h]xpub6CUGRU…/<0;1>/*)      native segwit (bc1q…)
sh(wpkh([d34db33f/49h/0h/0h]ypub6X…/<0;1>/*))    nested segwit (3…)
pkh([d34db33f/44h/0h/0h]xpub6D…/<0;1>/*)         legacy (1…)

The [fingerprint/path] origin is optional metadata; Bag accepts the key with or without it. A wpkh(zpub…/<0;1>/*) descriptor derives exactly the same addresses as the plain zpub input — Bag's test suite checks the two paths agree.

Watch-only means it cannot spend

A zpub is a one-way street. Public derivation produces public keys and addresses; there is no operation that turns a public key back into a private one. So Bag, or anyone else holding your zpub, can watch your coins but cannot move them. That is the whole point of a watch-only setup: the signing keys stay on the hardware wallet or the air-gapped machine, and the phone that faces the internet only ever holds public material.

Bag reinforces this at the input: the private-key prefixes (xprv, yprv, zprv and their testnet forms) are rejected before parsing, so a mis-paste cannot end up in storage.

Privacy

Bag is built around one rule: nothing that identifies your wallet leaves the phone. Extended public keys and descriptors are parsed on-device, and child addresses are derived on-device with plain BIP32 arithmetic. The only thing that reaches the network is a list of individual addresses, sent to the block explorer you chose (mempool.space, blockstream.info or your own Esplora-compatible node under NETWORK in Wallet & Privacy).

Turn on Route through Tor and every query goes through Orbot's SOCKS proxy (a system VPN on iOS). This is fail-closed: if Orbot is not running, Bag does not quietly fall back to the clear net — scans stop and the app tells you so. A .onion explorer address is supported.

Everything financial is encrypted at rest: the zpub or descriptor, wallet labels and cached balances, the manual BTC amount, the DCA log (AES-256 Hive box) and the health-check result all live in the platform keystore-backed secure storage, never in plain preferences. There is no account, no analytics SDK, no crash reporter and no server of ours that ever sees a key. The app is GPL-3.0 and the source is public, so you can verify each of these claims yourself.

Pricing

Free forever: a manually entered BTC amount, net worth in up to 3 of 30 currencies, charts from 1 day to all-time, the DCA tracker and the widget. You can type in the balance a web explorer showed you and never touch Pro.

Pro is a one-time unlock, no subscription. It unlocks the watch-only scanner itself — zpubs, output descriptors and multisig — plus Tor routing, a custom Esplora node, the Bitcoin Health Check, Sentinel on Android and fee alerts. Buy it through Google Play or the App Store, or — if you installed from F-Droid or the APK — pay with bitcoin on bitbag.app/pro and receive a signed licence key that the app verifies offline. Nothing phones home after that.

Frequently asked questions

What is the difference between an xpub and a zpub?

Both are BIP32 extended public keys. The zpub prefix (SLIP-132) signals a BIP84 native segwit account whose addresses start with bc1q; xpub is the generic prefix and may belong to a legacy BIP44 account or, in many wallets, to a segwit account as well. Bag’s single-key input accepts zpub so the script type is unambiguous; an xpub goes in as a descriptor such as wpkh(xpub…/<0;1>/*).

Is it safe to paste my xpub into a website?

No. An xpub reveals every address, the full balance and the entire history of the wallet, past and future, to whoever receives it, and the site sees your IP address next to it. It cannot spend your coins, but it is a permanent loss of privacy. Derive addresses locally instead.

Does Bag send my zpub to a server?

No. The zpub is parsed and addresses are derived on the phone. Only individual addresses are sent to the block explorer you selected, and with Route through Tor enabled they go through Orbot so the explorer does not see your IP either.

Can someone spend my bitcoin with my zpub?

No. A zpub contains only public keys. There is no way to derive a private key from it, so it can watch the wallet but never sign a transaction. Bag also rejects any private-key prefix (xprv, yprv, zprv) at input.

Why does my xpub show a zero balance?

Almost always because the checker derived the wrong address type. An xpub exported from a native segwit account must be interpreted as bc1q addresses, not legacy 1… addresses. In Bag, wrap it as wpkh(xpub…/<0;1>/*) under the Multisig kind, or use the zpub form of the same key.

Which block explorer does Bag use?

mempool.space or blockstream.info, selectable under NETWORK in Wallet & Privacy, or your own Esplora-compatible server, including a .onion address. The custom URL is stored encrypted because a node address identifies your own infrastructure.

How many addresses does Bag scan?

It follows the standard gap limit: it walks each chain until 20 consecutive addresses have no history, with a hard cap of 1000 addresses per chain. Receive and change chains are both scanned so the balance stays correct after you spend.

Does checking a zpub balance cost anything in Bag?

Watch-only scanning is a Bag Pro feature, a one-time unlock with no subscription. The free tier lets you enter a BTC amount by hand and shows net worth, charts, the DCA tracker and the widget.

Get Bag

Free on Google Play, the App Store and F-Droid. No account, no ads, no analytics. Source on GitHub.

Google Play App Store F-Droid