Monero

Simple

Monero (XMR) is private by default. Nobody looking at its network can see your balance, who paid you or how much.

Because everything is hidden, your phone has to look through the network itself to find your money. That's why the Monero balance can take a while to catch up, especially the first time. The Monero page shows how far it has got.

A new payment appears a couple of minutes after it's sent and can be spent about 20 minutes later; that wait is a Monero network rule.

• Speed up scanning, on the Monero page, catches up faster but uses more data and battery. • While your Monero balance is zero, Skip the history lets you watch only for new payments. Anything sent to you before then won't show.

Each contact you share with gets their own Monero subaddress, and Receive → New address makes another whenever you like.

Detailed

Private by design

Monero hides all three parts of a payment at the protocol level, from everyone: • the recipient, with one-time stealth addresses; • the sender, with ring signatures that mix each spent coin among decoys from the blockchain (16 members per ring under current rules); • the amount, with RingCT confidential transactions.

Two keys

A Monero wallet has a private view key, which recognises incoming payments and reads their amounts, and a private spend key, which is needed to spend and to tell when your coins have been spent. Addresses are built from the two matching public keys; main addresses start with 4 and subaddresses with 8.

Nodes

Because nothing is readable from outside, a wallet can't just look up a balance: it downloads blocks from a Monero node (anyone can run one, and many are public) and tests each output with its view key. A remote node never learns which outputs are yours, but it does see your IP address and when you broadcast a transaction.

Timing

Monero adds a block roughly each 2 minutes, and new outputs can't be spent until 10 blocks have passed, about 20 minutes. View tags, added in the 2022 network upgrade, let wallets skip most other people's outputs after one quick check.

In depth

Curve and keys

Monero works on the Ed25519 curve (a twisted Edwards form of Curve25519) with base point G and group order l. A wallet has a private view key a and a private spend key b, with public keys A = a·G and B = b·G.

One-time addresses

To pay (A, B), the sender picks a random r, publishes R = r·G, and for output number i creates the one-time key:

P = Hs(8·r·A ‖ i)·G + B

The recipient computes 8·a·R, which equals 8·r·A, and checks whether P − Hs(8·a·R ‖ i)·G equals B, so the view key alone finds payments. Spending needs P's private key x = Hs(8·a·R ‖ i) + b, which requires the spend key. Hs hashes to a scalar; the factor 8 clears the curve's small cofactor.

Ring signatures and key images

A spend is signed with a ring of outputs, the real one plus decoys, using CLSAG, a linkable ring signature: it proves the signer owns one member without saying which. Each spend also reveals a key image I = x·Hp(P), unique to the output; the network rejects any key image it has seen before, which stops double spends without revealing which output was spent. Decoys are drawn to mimic how old real spent outputs tend to be, following a gamma distribution.

Hidden amounts

Amounts are Pedersen commitments C = y·G + v·H, where v is the amount and y a random blinding factor. Commitments add up, so the network checks that inputs equal outputs plus the fee without seeing any amount, while Bulletproofs+ range proofs show each amount is non-negative and in range, so nobody can create money out of negative values.