# Which of Your Crypto Addresses Show Their Public Key? Bunker Answers in 30 Seconds

> Bunker is a free, offline scanner that shows which of your crypto addresses expose their public key, with a calm plan to hide what you can.

Canonical: https://nosistech.com/bunker-crypto-address-public-key-scanner/
Published: 2026-10-27
Last updated: 2026-10-27
Author: Carlos Paredes, NosisTech LLC

Open a wallet app such as Xverse, and you see five addresses at once: payment, Ordinals, Stacks, Starknet and Spark. Add a hardware wallet and an exchange account, and the list grows fast.

Now ask one question about each address. Has the world seen its public key?

Most holders cannot answer. The answer matters, because the safety of most wallets depends on a math problem that nobody has solved yet. An address whose public key nobody has seen gives an attacker nothing to work on.

I built [Bunker](https://bunker.nosistech.com) to answer that question. You paste your public addresses, and Bunker rates each one in about 30 seconds. Then it gives a calm plan, step by step, to hide what you can hide.

Bunker is free and open source. It runs only on your device, it knows more than 100 networks, and it works in English and Spanish.

---

## Why the public key matters

Most wallets protect funds with elliptic-curve signatures. Bitcoin and Ethereum, for example, use ECDSA. Your private key makes the signature. Your public key lets anyone check that signature.

The whole system depends on one fact. Nobody knows a fast way to compute a private key from a public key. Nobody has found a solution, and nobody has proved that no solution exists.

History shows that this kind of fact can change. RSA, the early lock of the internet, grew to signatures of about 400 bytes because mathematicians kept finding shortcuts. A wallet signature is 64 bytes, because nobody has found a shortcut for its math yet.

This is why I started the project. Here is the reason, in the words of the README:

> **From the Bunker README:**
>
> I see AI advancing at an alarming rate. AI models now solve math problems that stayed open for decades. The signatures that protect most crypto wallets depend on math problems that nobody has solved yet. Nobody has broken them today. But I do not want to wait for the day that someone does. Crypto needs extra security now.

The first step costs nothing. Keep your funds on addresses whose public key the world has never seen. To do that, you must know which of your addresses already show it.

## The idea in one picture: a sealed box

Think of your address as a sealed box. Your public key, which Bunker calls the lock, is inside the box. The world sees only a fingerprint of the box, called a hash.

```
seed phrase  ->  private key  ->  public key  ->  hash  ->  address
(your 24 words)   (the key)       (the lock)      (fingerprint)
```

Each arrow goes in one direction only. The feared attack goes backward, from the lock to the key. Three rules follow from the picture:

- When you receive coins, the box stays closed.
- When you sign anything, the box opens, and the lock becomes public.
- Nobody can pick a lock that nobody can see.

Signing covers more than sending coins. A token approval, an NFT listing and a "sign in with wallet" message also open the box.

Some address types have no box at all. A Bitcoin Taproot address (`bc1p`) puts the public key inside the address. On Solana, the address is the public key. A new address of the same type does not hide anything.

## How to scan your addresses

You need no account, no wallet connection and no installation.

1. Open [bunker.nosistech.com](https://bunker.nosistech.com).
2. Paste your public addresses into the box, one on each line.
3. If you want a label, type it after the address and a space.
4. Select **Scan addresses**.
5. If a card asks "Has it ever sent a transaction or signed a message?", answer it.
6. Read the plan next to the results.
7. To keep the plan, select **Copy plan** or **Print**.

The page needs no internet connection after it loads. You can test this: turn on airplane mode, then scan. The result is the same.

You can also run Bunker from your own disk. Download the single file from [bunker.nosistech.com/nosis-bunker.html](https://bunker.nosistech.com/nosis-bunker.html) and double-click it. It opens in your browser.

## A real scan, from start to finish

For this article, I ran a real scan with the Bunker command-line tool. I used three public addresses from published standards, so no real person's wallet appears here:

- a Taproot address from the BIP-86 test vectors, with the label "Ordinals",
- a Native SegWit address from the BIP-173 test vectors, with the label "Savings",
- an Ethereum address from the EIP-55 test vectors, with the label "Daily wallet".

```
bc1p5cyxnuxmeuwuvkwfem96lqzszd02n6xdcjrs20cac6yqjjwudpxqkedrcr Ordinals
bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4 Savings
0x5aAeb6053F3E94C9b9A09f33669435E7Ef1BeAed Daily wallet
```

Bunker returned these results. The text in the last column is its exact explanation:

| Address | Label | Result | Explanation from Bunker |
| --- | --- | --- | --- |
| `bc1p5cyx...kedrcr` | Ordinals | Lock visible | Taproot puts the public key in the address. Ordinals and Runes use this type. |
| `bc1qw508...v8f3t4` | Savings | Check needed | Only a hash of the key is on chain until this address spends. |
| `0x5aAeb6...1BeAed` | Daily wallet | Check needed | The key stays hidden until the first transaction or signed message from this address. One address covers every EVM network. |

The Taproot address needs no question. Its key is in the address, so the answer is known. The other two addresses hide the key until they sign, so Bunker asks about each one.

For the example, the savings address has never sent anything, so the answer is "No". The daily wallet swaps tokens every week, so the answer is "Yes". I gave these answers to the tool. It printed this plan:

```
BUNKER PLAN

1. Ground rules
   - Do not hurry. A bad migration can cost more than the risk that you try to avoid.
   - Do not type a seed phrase or private key into a website or chat. Real tools do not ask for it.
   - Do not follow links that tell you to "migrate now". Use only your own wallet app.
   - Ledger and Trezor do not send a "quantum patch" by email. Update firmware only in Ledger Live or Trezor Suite.
   - Send a small test amount before each large move.

2. Move to new addresses
   - 0x5aAeb6...1BeAed (EVM networks | Daily wallet): Add a new account on your hardware wallet. Use it only to receive. Move coins and tokens on every EVM network where this address holds them.

3. Visible with no hidden option yet
   - bc1p5cyx...kedrcr (Bitcoin | Ordinals): Taproot has no hidden option yet. Keep inscriptions here. Move plain coins to a new SegWit address. Be ready to move to BIP-360 outputs when they activate.

4. Keep these locks hidden
   - bc1qw508...v8f3t4 (Bitcoin | Savings): Use it only to receive. When you spend, your wallet sends the change to a new address, and the rest stays hidden.

5. Watch for the real fixes
   - Bitcoin: activation of BIP-360 (quantum-safe outputs), and the BIP-361 discussion about a freeze of coins that do not move.
   - Ethereum and EVM networks: the hash-based signature roadmap, and smart accounts that can change signature types.
   - Solana: a post-quantum signature upgrade for the network.
   - Networks that can change keys (Aptos, Starknet, Flow, XRP, Stellar, Algorand, NEAR, Hedera): support for post-quantum keys.

Educational tool. Not financial, legal or security advice. Examine each address on a block explorer before you move funds.
Bunker by NosisTech. https://bunker.nosistech.com
```

The plan follows the same order every time. Four details show how it works:

1. **Ground rules come first.** A rushed move can lose more money than the risk that it avoids. Wrong addresses, fake tools and lost keys are real dangers today.
2. **The daily wallet moves.** Its key is public on every EVM network, because one key makes the same `0x` address on all of them. A new account that only receives hides the key again.
3. **The Ordinals address waits.** A new Taproot address does not help, because every Taproot address shows its key. The real fix is BIP-360, a proposed address type that runs on test networks only today.
4. **The savings address stays.** Its key has never been on chain. The plan tells you to keep it that way and to use it only to receive.

On the website, you can also type a value for each address. The plan then puts the largest amounts first in each group. The page keeps the values in memory only and stores nothing.

## What each result means

| Result | Meaning | What to do |
| --- | --- | --- |
| Lock visible | The public key is on chain or in the address. | Move to a hidden address type if the network has one. |
| Check needed | The key is hidden until the address sends or signs. | Answer the question on the card. |
| Lock hidden | The key has never been shown. | Use this address only to receive. |
| Hash-protected | The address type has no curve key, for example BIP-360. | Nothing. |
| Ask your provider, Check your pool | A permissioned network such as Canton, or a Zcash unified address. The provider or the pool decides the risk. | Ask the operator the questions in the plan, or check the pool in your wallet. |
| Shows every key | An extended public key (xpub). | Stop sharing it with apps and trackers. |
| Not rated | A typo, a test network, a contract or an unknown format. | Read the note on the card. |

Bunker uses named results on purpose. A single score from 0 to 100 looks exact when it is not, and it hides the reason. A named result points to one clear action.

## What Bunker never asks for

Bunker needs public addresses only. It never needs a seed phrase or a private key, and no real tool does.

Scared people sometimes paste a seed phrase into any page that says "wallet". Fake "quantum migration" tools ask for exactly that. So Bunker reads the input for secrets before it does anything else. If it finds one, the page clears the box at once and shows a warning. The guard knows 19 kinds of secrets.

I tested this with a well-known public test phrase of 12 words. The tool refused to process anything:

```
$ echo "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about" | node cli/bunker.js --json
{
  "ok": false,
  "error": {
    "code": "SECRET_DETECTED",
    "message": "The input looks like a seed phrase. Nothing was processed, stored or sent. Use public addresses only. Never share a seed phrase or private key."
  }
}
```

The exit code was 2, which means "a secret was found, and nothing was processed". Notice that the message does not repeat the words. An error must never leak what it blocks.

## How to check the tool yourself

Do not trust a security tool on its word. Bunker gives you four ways to check it:

| Claim | How you can check it |
| --- | --- |
| Nothing leaves your device. | The page blocks every network connection with its Content Security Policy. Turn on airplane mode and scan. |
| Nothing is stored. | The page uses no cookies, no browser storage and no analytics. A test fails the build if this changes. |
| The code is open. | The full source is public on GitHub under the Apache License 2.0. |
| Your file is the real file. | Compare its SHA-256 hash with the published hash. |

A SHA-256 hash is a fingerprint of a file. If one byte changes, the fingerprint changes. To compare the hash on Windows, do these steps:

1. Download [nosis-bunker.html](https://bunker.nosistech.com/nosis-bunker.html).
2. Open your Downloads folder in File Explorer.
3. Right-click an empty area, and select **Open in Terminal**.
4. Type `Get-FileHash .\nosis-bunker.html -Algorithm SHA256` and press Enter.
5. Compare the result with the value in [SHA256SUMS.txt](https://bunker.nosistech.com/SHA256SUMS.txt). The two values must be the same.

On macOS or Linux, use `shasum -a 256 nosis-bunker.html`. For version 1.2.2, the hash starts with `4fb97cc5`.

For this article, I also built the page again from a fresh copy of the source code. The new file had the same SHA-256 hash as the live site. This is called a reproducible build. Anyone can repeat it and get the same file.

The hash check protects you from fake copies. Scammers copy security tools and add a "verify your seed phrase" box. The real page never asks for a seed phrase.

## Built for people and for AI agents

People now ask AI assistants to check their wallets. Bunker gives them two local tools: a command-line tool with JSON output, and an MCP server. MCP (Model Context Protocol) is the standard way for assistants such as Claude Desktop and Cursor to call tools.

Both tools run on your own computer and use the same engine as the web page. Neither one sends an address anywhere. Article 10 of this series explains them in detail.

## What Bunker does not do

- It does not look up balances or transactions. You type the answers and the values, so no address leaves your device.
- It does not move funds. It gives a plan, and you act in your own wallet.
- It does not rate private bank networks that have no public addresses. Those need a review of the provider.
- It does not say when a break will come. Security experts disagree on the date. They agree that a rushed migration is dangerous.

As of October 25, 2026, nobody has shown a break of ECDSA or of the Solana signature system. Bunker states what is known today, and it tells you what to watch.

## The Bunker series

This article is the first of twelve. The other eleven take the tool apart, one piece at a time, with code from the project and real examples:

1. [The Sealed Box: When a Crypto Address Shows Its Public Key](https://nosistech.com/crypto-address-public-key-exposure-explained/)
2. [Bitcoin, Ethereum, Solana and 100 More: How Each Network Shows the Public Key](https://nosistech.com/crypto-networks-public-key-exposure-rules/)
3. [From Pasted Text to a Plan: Inside the Five-Step Engine of Bunker](https://nosistech.com/bunker-detector-pipeline-architecture/)
4. [One Wrong Character: How Bunker Catches Typos in Crypto Addresses](https://nosistech.com/bunker-checksum-validation-typo-test/)
5. [Never Paste a Seed Phrase: How Bunker Blocks 19 Kinds of Secrets](https://nosistech.com/bunker-seed-phrase-private-key-guard/)
6. [A Web Page That Cannot Send Your Data: The Browser Security of Bunker](https://nosistech.com/bunker-content-security-policy-offline-page/)
7. [Zero Dependencies: How Bunker Keeps Outside Code Out of the Build](https://nosistech.com/bunker-zero-dependencies-supply-chain-security/)
8. [Taproot, Zcash, Canton and Shared Formats: The Hard Cases in Bunker](https://nosistech.com/bunker-exposure-models-hard-cases/)
9. [Bunker for AI Agents: A Local CLI and MCP Server With No Web API](https://nosistech.com/bunker-mcp-server-ai-agents/)
10. [Designing Bunker for Phones, Screen Readers and Two Languages](https://nosistech.com/bunker-ux-accessibility-wcag-spanish/)
11. [The Bunker Build Log: 42 Problems Fixed and 30 Decisions Recorded](https://nosistech.com/bunker-build-log-problems-decisions/)

## Try Bunker

- The tool: [bunker.nosistech.com](https://bunker.nosistech.com) (add `#es` to the address for Spanish)
- The code and the docs: [github.com/nosistech/nosis-bunker](https://github.com/nosistech/nosis-bunker)
- The background story: [docs/01-background.md](https://github.com/nosistech/nosis-bunker/blob/main/docs/01-background.md)

In the next article, I explain the sealed box in detail. You will see what opens it, what keeps it closed, and why a wallet that only receives keeps its key out of view.

Have a question or feedback about Bunker? [Contact NosisTech](https://nosistech.com/connect/).

### Keep reading: Bunker by NosisTech

Next article: [The Sealed Box: When a Crypto Address Shows Its Public Key](https://nosistech.com/crypto-address-public-key-exposure-explained/)

All articles: [NosisTech Writing](https://nosistech.com/blog/)

*This post is general information, not financial, legal or security advice. Bunker is an educational tool with no warranty. Examine each address on a block explorer, and send a small test amount before you move funds.*