A watch-only wallet removes spending power, not privacy risk

Practical guide · prepared 19 September 2026. Sources were checked for this workflow; linked interfaces and policies can change. Research scope.

A watch-only wallet is often described as the safe half of cold storage: it can generate addresses and observe transactions, but it cannot sign. That is true and incomplete. The public descriptor or extended public key that gives the wallet its view may also reveal a whole branch of addresses to the software, server or person receiving it. The practical question is therefore not only can this machine spend? It is also who can build the same account map?

Define the view before exporting it

Start with one account and one purpose, not a wallet-wide export made for convenience. Record the network, script type, key fingerprint, derivation path and whether the descriptor covers receiving, change, or both. Bitcoin Core's descriptor documentation shows why that context matters: an extended public key plus its derivation can describe a large, enumerable set of scripts. A watch-only copy has no private keys, but it is not merely a list of past addresses.

Give separate activities separate views when the wallet supports that structure. A public donation account, a private savings account and a business reconciliation account do not need to be correlated by the same monitoring service. This extends the address-separation discipline in the address-reuse explainer to the monitoring layer.

Choose where the query happens

A public wallet server can learn the scripts your wallet asks about. Sparrow's own quick-start guide warns that using a public server shares public-key information and privacy with its operator. The stronger workflow is to connect the watch-only wallet to a node you control. That does not make the blockchain private; it removes an unnecessary account-level observer. If self-hosting is not practical, treat the chosen server as a party that may infer balances and transaction relationships, and avoid mixing unrelated accounts through it.

Network privacy is a separate layer. Bitcoin.org's privacy guide notes that addresses and transactions are public and that network peers may log IP information. A private node connection or Tor can reduce network disclosure, but neither repairs address reuse or undo information already given to an exchange.

Run an address challenge

1. Import only the public descriptor into a fresh profile with private keys disabled.
2. Generate three receive addresses and, if supported, three change addresses.
3. Derive the same indexes independently in the signing wallet.
4. Compare full addresses, script type and network. Do not settle for matching prefixes.
5. Verify one receive address on the signing device using the workflow in the device-display checklist.

A mismatch means stop. Likely causes include the wrong account, script type, network, derivation branch or passphrase-derived wallet. Sending a small amount does not prove the monitor can derive every future address; the index challenge tests the mapping more directly.

Set the operating rule

Label the watch-only file as sensitive even though it cannot spend. Encrypt its host, restrict backups, document which server it queries, and retire lost monitoring access or service accounts where possible. A copied extended public key itself cannot be revoked: you cannot rotate away past blockchain disclosure, and it may continue revealing future derived addresses. The honest conclusion is narrow: watch-only is a spending-control tool. Privacy depends on how much public wallet structure you export and where you let it be observed.