If bitcoin is indivisible, where does change come from?

Question

Let's say I want to give Alice .22 BTC. I currently have in my wallet 1 BTC. Because Bitcoin is indivisible, I have to spend the 1 BTC I have as input, and .78 BTC will be returned to me as change, while the other .22 BTC is sent to Alice. My question is how is this consistent with currency indivisibility? Is the .22 BTC and .78 technically created from the 1 BTC? Or is there change from another transaction? I'm just confused how it's indivisible but exact change can be created.

Answer 1

I like to suggest a mental model where the network is a metals forge:

You have a 1 oz gold coin stamped with your key on it, with your transaction you send it to the forge to be melted down and re-formed to two new coins, a .22 with Alice's key stamped on it and a .77 with a key of yours on it, and then the forge keeps the remainder for their fee.

You can't spend half your 1oz coin, but you can have the whole thing melted down into multiple, and perhaps many, parts.

Answer 2

I'm adding this as an additional answer to the ones that exist, to clarify a comment:

if the outputs can be split exactly, then why the inputs can't be split so I only spend the exact amount I want. – rb612

You're essentially asking for the differences between Bitcoin's UTXO (Unspent Transaction Output) model, compared to the more intuitive Account model.

• Privacy If a transaction spends an output that was previously assigned to A (you), and sends a new output to B (the recipient) and A (you again), it is obvious to the network what the paid amount was. If instead of sending to A, it sends to C (same thing, still you, just a different address), third parties may either think that the amount to C is the payment or the other. This may sound like a small deal, but it is pretty essential. In the extreme, if all your coins were always assigned to the same address, everyone you've ever done business with could permanently observe how much money have.

• Incentives This is related to the previous point. In systems where it is possible to partially spend balances, it tends to be cheaper to do so over sending to a new account. This means the system incentives making choices that are bad for privacy. This does not only hurt your own, but also others. The easier it is to investigate transactions done by people you have transacted with, the more information is leaked about you, even if you at every point made the more private choice possible. This means that everyone benefits from a system whose cheapest usage is also the more private one.

• Replay Account models suffer from replay. Say A pays 1 BTC to B, and B sends 0.8 of that to C. Now B sends another 0.7 BTC to A (meaning now has 0.9. At this point, you need a solution to prevent C from rebroadcasting A's transaction to C, and having it take effect another time, paying him again. The UTXO model directly and cleanly solves this, because the same coin is never reusable another time.

Answer 3

It's not the value, it's the inputs. If you have 1 input worth 1 BTC and sent Alice .22 BTC as one output and your change would be a 2nd output. A single input can be split into many outputs. If Bob, Alice, and Charlie each sent you 0.33 BTC and you wanted to send someone 0.5 you would need to use more than one input (since each input is only 0.33) to cover the full value, and then you would have two outputs, one to the recipient and the other as change. The two inputs that the recipient received, was received as a single output, so now the value has been consolidated back into one output.

Answer 4

The bitcoins themselves never really exist, only receipts from previous transactions. So if received that 1 BTC from a friend, you have a receipt somewhere saying that he sent you 1 BTC. You can then reference this receipt in a future transaction as proof you do own 1 BTC. This is how bitcoins exists, as receipts. But the indivisible part comes from the fact you can only reference a receipt once and only once, never twice. Even so, when you finally do reference it you can split it up however much you want (with some limitations), deciding who gets how much of the bitcoin referenced in the receipt. Whatever is unaccounted for the miners get, this way the entire value of the receipt is spent, always. So obviously using the receipt again in a future transaction would be pointless as it's now worthless, if it were even possible.

To get your change you simply send to two people at once. One output with the value of 0.22 to an address Alice owns and another with 0.78 to an address you own. The receipt you had proving you owned 1 BTC has now been fully spent and can never be spent again, but in its place two more receipts have been created, which in turn can be used in a future transaction, but only once.

Another way of thinking about this is that you can't divide a bitcoin without letting the bitcoin network know about it. If you want to split up a bitcoin you own, you need to create a transaction doing so first. So you could create a transaction sending yourself 0.78 BTC and 0.22 BTC referencing your receipt for 1 BTC, then afterwards send the 0.22 BTC in its entirety to Alice, no change needed. Though honestly the question whether you divided up the 1 BTC or created two entirely new coins while the original 1 BTC remained indivisible seems to me to be more a question for philosophy.

Said shortly, when you spend a bitcoin you have to use the entire coin all at once (indivisible part), but in the process you can create as many smaller bitcoins as you want (divisible part) and give some back to yourself as change.