Bitcoin Address Validator

Bitcoin addresses: from Satoshi's first transaction to Taproot

A Bitcoin address is the on-chain destination string a wallet generates so others can send BTC to it. Conceptually it is a hash of a public key (or of a redeem script) encoded with a checksum to make typos virtually undetectable to the network. From the genesis block in 2009 to the activation of Taproot in November 2021, the address format evolved to balance backward compatibility, lower fees, smaller signatures and richer scripting.

Bitcoin is a UTXO (Unspent Transaction Output) chain, not an account chain. Every address represents one or more outputs locked by a script that only the owner of the corresponding private key can unlock. Confirming that a string is a syntactically valid address is the entry point of any wallet, exchange or merchant integration — and a wrong validation can route real money into the void.

The four address families in use today

• P2PKH (legacy): starts with 1, 26 to 35 Base58 characters. Example: 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa — Satoshi's genesis-block address.
• P2SH: starts with 3, 26 to 35 Base58 characters. Used for multisig and wrapped SegWit (3... wallets paying into bc1q...).
• Bech32 SegWit (P2WPKH/P2WSH): starts with bc1q, 42 (P2WPKH) or 62 (P2WSH) characters. Mixed case is forbidden — the encoding is case-insensitive but the canonical form is lowercase.
• Bech32m Taproot (P2TR): starts with bc1p, 62 characters. Activated by BIP 341/342, enables Schnorr signatures, MAST and Pay-to-Contract.

Testnet uses different prefixes: m, n and 2 for Base58, and tb1 for Bech32. Signet uses the same tb1 prefix as testnet. Regtest, used in local development, accepts bcrt1.

Base58Check vs Bech32: two checksums, one purpose

Base58Check, used by P2PKH and P2SH, takes the version byte concatenated with the hash, applies SHA-256 twice, takes the first 4 bytes as checksum, appends them and encodes everything with the Base58 alphabet — which omits the visually ambiguous characters 0, O, I and l. A single-character typo invalidates the address with overwhelming probability.

Bech32, introduced by Pieter Wuille (Sipa) and Greg Maxwell in BIP 173 (2017) and refined to Bech32m for Taproot (BIP 350), uses a BCH error-correcting code over a 32-symbol alphabet (qpzry9x8gf2tvdw0s3jn54khce6mua7l). It detects up to 4 single-character errors and is designed so that two valid addresses cannot differ by a single typo. The bc human-readable part identifies mainnet.

P2PKH:  1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa
P2SH:   3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy
SegWit: bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq
Taproot: bc1p0xlxvlhemja6c4dqv22uapctqupfhlxm9h8z3k2e72q4unkawfjqrnmnf

How a robust validator works (and why "regex only" is a bug)

A two-level validation is mandatory:

• Level 1 — format: regex over allowed characters, length and prefix. Rejects obvious garbage and mixed-case Bech32.
• Level 2 — checksum: Base58Check decode for legacy/P2SH, Bech32/Bech32m verify for SegWit/Taproot. Only at this stage do you know the address would actually be accepted by a node.

Common anti-pattern: validating only the format and skipping the checksum. The integration accepts typos like 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNb — visually similar but mathematically invalid — and the transaction is lost forever. Battle-tested libraries cover both levels: bitcoinjs-lib (JavaScript/TypeScript), python-bitcoinlib, rust-bitcoin and the C reference implementation libbitcoin.

Hot wallets, cold wallets and key management

An address is just the public face of a private key. Securing the key is what protects the funds:

• Hardware wallets (cold): Ledger, Trezor, Coldcard, BitBox. The private key never leaves the device; transactions are signed offline.
• Software wallets (hot): Electrum, Sparrow, BlueWallet, Muun. Convenient for daily use but exposed to the operating system.
• Custodial exchanges: Binance, Coinbase, Mercado Bitcoin, Foxbit. The user does not control the key — "not your keys, not your coins".
• Seed phrases (BIP 39): 12 or 24 words that deterministically derive every key. The backup must be physical (steel plate, fireproof safe), never a screenshot.

For larger amounts, multisig setups (typically 2-of-3 with one key cold, one hot and one with a third party) drastically reduce single-point-of-failure risk. Sparrow Wallet and Specter Desktop are the de facto standards for self-custody multisig.

Brazilian regulatory landscape

Law 14.478/2022, the so-called Marco Legal das Criptos, regulates virtual-asset service providers (VASPs) in Brazil and gives the Banco Central the role of supervising exchanges, custodians and brokerages. The Receita Federal Normative Instruction 1.888/2019 already required monthly reporting of operations above R$ 30.000 — Brazil was an early adopter of crypto tax transparency.

Brazilian exchanges (Mercado Bitcoin, Foxbit, NovaDAX) and the BCB's ongoing tokenization pilots (DREX, the Brazilian digital real) make address validation a daily compliance concern. Reporting on capital gains follows the standard Carnê-Leão when above R$ 35.000 per month, with a 15-22.5% rate depending on the gain bracket.

Mempool, fees and the lifecycle of a transaction

After a wallet broadcasts a transaction, it enters the mempool — the pool of unconfirmed transactions held by every full node. Miners pick the highest fee-rate transactions for the next block (~10 minutes). Bitcoin's supply is hard-capped at 21 million BTC, with the block subsidy halving every 210.000 blocks (~4 years). The next halving in 2028 will cut the subsidy from 3.125 BTC to 1.5625 BTC.

For micropayments, the Lightning Network opens off-chain payment channels, enabling instant transfers at virtually zero fee. Lightning invoices look different — they start with lnbc and are not Bitcoin on-chain addresses.

FAQ

Are Bech32 addresses case-sensitive? The specification requires all lowercase or all uppercase — mixed case is invalid. Decoders treat the all-lowercase form as canonical.

How do I tell a testnet address from a mainnet address? By the prefix: Base58 testnet starts with m, n or 2; Bech32 testnet uses tb1. Sending mainnet BTC to a testnet address (or vice-versa) loses the funds.

What is the Lightning Network and is its invoice an address? Lightning is an off-chain layer for fast, cheap payments. Its invoices (lnbc...) are not Bitcoin addresses and cannot receive on-chain BTC directly.

Why does Base58 omit the characters 0, O, I and l? To eliminate confusion when an address is read or written by hand. The four characters are visually similar in many fonts.

Does this tool send the address to a server? No. Validation runs entirely in the browser. No network request is made and no log is recorded.