What it means
The idea is called public key cryptography, which means securing information with mathematics. The two keys are linked, so that something locked with one can be opened only by the other.
A well-known early method of this kind is named RSA, after the initials of its three inventors. If you want someone to send you a private message, you give them your public key, and they lock the message with it.
Only your private key can open it, so even if the message is intercepted, nobody else can read it. The same system works in reverse to prove who sent something.
If you sign a document with your private key, anyone can use your public key to check that the signature is genuine and that the document was not altered afterwards. Businesses rely on this every day without noticing.
Secure websites, online banking, email encryption, digital contracts and card payments all use public key methods, and cryptocurrency addresses are derived from public keys. Even a simple login using a security key on a phone relies on the same principle.
The nuance is that a public key only proves identity if you know whom it belongs to. Organisations called certificate authorities issue digital certificates that link a public key to a named company, and this link is what makes secure web browsing trustworthy.
The private key must be guarded carefully, because anyone who holds it can act as its owner.
In practice
Real-world examples.
Example
An online retailer uses a certificate containing its public key so customers' browsers can set up a secure connection. When a shopper enters card details, the information is protected in transit and cannot be read by anyone listening on the network. The retailer renews the certificate every year and tracks the expiry date in the finance calendar to avoid an outage that would stop sales.
Example
A finance team sends a signed payment instruction to its bank using a digital signature. The bank checks the signature against the company's public key, which confirms that the instruction came from an authorised sender and was not changed on the way. The treasury team keeps a log of which approvers hold signing rights, much like a list of authorised bank signatories.
Example
A cryptocurrency investor shares her wallet address to receive a payment. The address comes from her public key, so anyone can send funds to it, but only her private key can authorise spending them. If she loses that private key, the funds are lost with it, and there is no bank to call for help.
Case study
Seen in the real world.
Marlow Treasury Services is an illustrative, fictional company that sends large payment files to banks every day. Its staff used to e-mail the files with passwords sent by text message, and an internal review found the process was open to interception and impersonation.
The treasury manager moved the process to digital signatures using key pairs. Each approver signed the file with a private key stored on a hardware device, and the bank held the matching public keys on record. The change took three months to roll out and cost about $40,000 in software and devices.
Fraud attempts based on forged emails dropped to nothing, and audit tests became simpler because every payment carried a verifiable signature. The auditors confirmed that the control worked and reduced the amount of manual testing they needed to perform. The illustrative lesson is that the public key is safe to publish, but the private key must be protected as carefully as a company's bank signing authority.
Watch out
Common mistakes.
- Thinking the public key must be kept secret, when its purpose is to be shared so that others can encrypt messages to you or verify your signatures.
- Losing or sharing the private key and assuming the public key will still protect you, when anyone with the private key can act as the owner.
- Trusting a public key without checking that it belongs to the right organisation, which leaves room for impersonation.
Questions
People also ask.
Can someone work out my private key from my public key?
Not in practice, because the maths is designed so that going from the public key back to the private key is infeasible with current computing power.
What is a digital certificate?
It is an electronic document, issued by a trusted body, that links a public key to the identity of a person or organisation. Web browsers show a padlock symbol when the certificate checks out.
Why does finance care about public keys?
Payment systems, electronic signatures and digital assets all rely on them, so weak key management can lead directly to financial loss. A lost or stolen private key can be as damaging as a stolen cheque book.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%Related