The one-time output-address construction used to avoid placing the reusable receiving address directly on-chain. Senders derive fresh output keys from recipient public keys and transaction-specific information.
Also called: one-time address.
From a receiving address to an output
A Monero receiving address contains public key information. The sender combines that information with transaction-specific secret material to derive an output public key. The reusable address itself is not placed in that output as its on-chain destination.
The recipient uses their private view key and public transaction data to derive the matching information while scanning. When an output matches, the wallet can recognize it and recover its amount. Spending requires additional secret material.
References: Monero source: crypto/crypto.cpp · Monero source: wallet/wallet2.cpp
Two payments to the same address
If a shop displays one receiving address and two customers pay it, their payments normally create different output keys. Someone searching a blockchain explorer for the shop's address does not get a simple public list of those incoming outputs.
The customers still know the address they were given and the payment each created. If the shop reuses the same address on several websites, those websites can compare the address outside the blockchain.
References: Moneropedia: stealthaddress · Standard address construction
One-time keys and subaddresses
A stealth address is often shorthand for the one-time output-address construction. A subaddress is a receiving address the wallet can hand to a payer. The concepts are related, but they are not interchangeable.
Subaddresses reduce reuse of the receiving identifier. Payments to those subaddresses still create one-time output keys. A wallet can therefore use a different subaddress for each customer without creating a separate wallet seed for each one.
References: Subaddress construction · Monero source: crypto/crypto.cpp
Limits of recipient unlinkability
This mechanism does not hide every transaction field. It does not erase messages, receipts or account records held by the sender. Anyone given the private view key receives additional ability to recognize incoming outputs.
For an ordinary standard-address output, the derivation combines a shared secret, the output index and the public spend key. Production code also handles encoding, curve operations and subaddress cases. A simple address string is not a decryption password.
References: Monero source: crypto/crypto.cpp · Monero source: wallet/wallet2.cpp
Related glossary terms
Practical guides
- Stop Giving Every Website the Same Piece of You
- Monero Offline Wallets: Cupcake, Cold Storage and Signing
Technical baseline: v0.18.5.4. Reviewed 2026-11-08 UTC.