The cryptography that makes it work

Hash functions: digital fingerprints

A cryptographic hash function takes any input — a word, a file, a whole block of transactions — and produces a fixed-length string of characters called a hash or digest. Ethereum and Bitcoin use functions like SHA-256 and Keccak-256 that always output 256 bits (64 hex characters). Three properties make it useful. It is deterministic: the same input always gives the same hash. It is one-way: from the hash you cannot work backwards to the input. And it is collision-resistant: it is practically impossible to find two different inputs with the same hash. Together these make a hash a reliable fingerprint of data.

The property that matters most for blockchains is the avalanche effect: change the input by even one character and the hash changes completely and unpredictably. This is exactly why a hash detects tampering — alter a single transaction and the block's fingerprint transforms entirely, so any change is instantly detectable by anyone recomputing it.

// Same input -> same hash; a tiny change -> a totally different hash.
// (Conceptual: real code would use a crypto library's keccak256.)
hash("hello")  // -> 1c8aff95...9b3d2f  (always the same)
hash("hello")  // -> 1c8aff95...9b3d2f  (deterministic)
hash("hellp")  // -> 7f0e21a4...c05e88  (one letter changed: unrecognisable)

// A block's fingerprint is just the hash of its contents:
blockHash = hash(previousHash + transactions + nonce);

Key pairs: a public lock and a private key

The second primitive is public-key (asymmetric) cryptography. You generate a pair of mathematically linked keys: a private key you keep utterly secret, and a public key you can share freely. The magic is that the two are related but you cannot derive the private key from the public one. On a blockchain, your public key (or a hash of it) becomes your address — the identity others send funds to — while your private key is what lets you spend from it. Owning cryptocurrency is, quite literally, knowing a private key. There is no account with a bank to call; the key *is* the ownership.

Digital signatures: proving it was you

Key pairs enable the crucial trick: a digital signature. When you want to send a transaction, your wallet uses your private key to produce a signature over the transaction's contents. Anyone on the network can then use your public key to verify that the signature is valid — that it could only have been produced by the matching private key, and that the transaction hasn't been altered since. Crucially, verifying the signature never reveals the private key. So you prove you authorised this exact transaction without ever exposing your secret. That is how a blockchain lets strangers confirm your transactions are genuine with no trusted middleman checking passwords.

The pattern is always the same three roles. The private key signs, the public key verifies, and the hash is what actually gets signed (you sign a fingerprint of the data, not the whole data). Hold that triangle and every transaction on a blockchain makes sense.

// Sending a transaction (conceptual):
tx = { from: myAddress, to: bobAddress, amount: 5 };

// 1. Hash the transaction to get its fingerprint.
digest = hash(tx);

// 2. Sign the digest with the PRIVATE key (only I can do this).
signature = sign(digest, myPrivateKey);

// 3. Anyone verifies with my PUBLIC key -- no secret revealed.
valid = verify(digest, signature, myPublicKey);  // true if untampered
// The network accepts the transaction only if 'valid' is true.

Putting it together on a blockchain

Now the pieces connect. Your address is derived from your public key by hashing it — so hashing and key pairs already work together. When you send funds, you sign the transaction with your private key; miners or validators verify the signature with your public key before accepting it, so only you can spend from your address. Each block bundles many such verified transactions and is fingerprinted with a hash that includes the previous block's hash, chaining them so no past transaction can be altered without detection. Every guarantee you heard about in the first lesson — tamper-evidence, ownership, authorisation without trust — reduces to these two primitives working together.

• Address = a hash of your public key — safe to share, it's where funds are sent.
• Spending = signing a transaction with your private key.
• Verification = the network checking that signature with your public key.
• Tamper-evidence = each block's hash chains to the previous block's hash.

Seed phrases: your keys, made survivable

Private keys are long random numbers no human could memorise, so wallets present them as a seed phrase (also called a recovery or mnemonic phrase): usually 12 or 24 ordinary words. That phrase is a human-friendly encoding of the secret from which your keys are derived. Whoever has the seed phrase has the keys, and therefore the funds — so it must be written down and stored offline, never typed into a website, photographed, or shared. Most losses and thefts in the whole space trace back to a mishandled seed phrase, not broken cryptography. The maths is essentially unbreakable; the humans are the weak point.