A public cryptographic tag tied to the actual output being spent. It lets nodes recognize another attempt to spend that output without directly exposing which ring member it was.
One spend marker for one output
An input includes a key image derived from the real output's public key and corresponding one-time private scalar. The signature proves the required relationship without declaring which member of the ring supplied that secret.
Nodes record key images from accepted spends. A later attempt to spend the same output produces the same image and conflicts with that record. Choosing different decoys does not create fresh spending authority.
References: Monero source: crypto/crypto.cpp · Monero source: cryptonote_core/blockchain.cpp · Monero source: ringct/rctSigs.cpp
Decoy appearances leave spending authority unchanged
Your output can appear in someone else's ring as a decoy. That transaction's key image belongs to the real output they control, not automatically to every output in the ring.
When your wallet later spends your output, it creates the image for that output. Earlier appearances as a decoy do not consume the balance. An explorer showing your output in a ring does not establish that you made the transaction.
References: Monero source: cryptonote_core/blockchain.cpp · Monero source: ringct/rctSigs.cpp
Key images in a view-only workflow
A view-only wallet can recognize incoming outputs, but recognizing an output is not the same as knowing its key image. Without the needed spending secrets or imported images, it cannot reliably infer all spent status from the blockchain.
Offline-signing workflows can transfer signed key-image information from the spending wallet to the viewing wallet. That lets the viewing side track spends while the private spend key remains on the signer. The exact exchange depends on the wallet software.
References: Monero source: wallet/wallet2.cpp · Feather: offline transaction signing
Public tags and private keys
The conceptual relation is I = x Hp(P): P is an output public key, x is its one-time private scalar, and Hp maps the public key to a curve point. This describes the role of the values, not a complete implementation recipe.
The key image is public in a spending transaction. The scalar x is secret. Neither is the wallet's reusable public address, and the key image alone is not a public lookup label for the real ring member.
References: Monero source: crypto/crypto.cpp · CLSAG paper, IACR 2019/654
Related glossary terms
Practical guides
- Monero Offline Wallets: Cupcake, Cold Storage and Signing
- Connect Your Monero Wallet to a Remote Node
Technical baseline: v0.18.5.4. Reviewed 2026-11-08 UTC.