Bitcoin Core getrawchangeaddress RPC: Change Control Guide

This guide explains Bitcoin Core getrawchangeaddress RPC in plain English. It shows what the command does, what its result means and what it cannot prove.

Special-purpose interface

Use this RPC only when a raw transaction workflow genuinely manages its own change. Ordinary receive invoices belong to getnewaddress. Mixing the purposes can expose internal wallet structure, cause reconciliation mistakes and encourage address reuse.

Address-type contract

Select legacy, p2sh-segwit or bech32 according to the intended wallet policy and signer support. An omitted value follows changetype and can vary between deployments. Confirm the final script type after transaction construction instead of trusting a string passed earlier.

Keypool state

Each call reserves new wallet destination state even if the transaction is abandoned. Retry loops can consume keypool entries and create unused addresses. Make generation idempotent at the application layer and test locked or depleted keypool failure without logging secrets.

Change calculation

Change equals selected inputs minus recipient outputs and fee, subject to dust and policy. Use satoshi integer arithmetic, not floating point. A no-change transaction must contain no fabricated output. Prefer proven wallet funding APIs where manual control is unnecessary.

Construction and signing

Bind the generated destination to one transaction draft, add it once, then sign with the intended wallet or external signer. Decode the signed transaction and confirm recipient, change, fee, locktime and replaceability before broadcast.

Privacy and recovery

Change heuristics can link wallet activity even with fresh addresses. Avoid revealing which output is change and retain recovery material that covers derived destinations. A seed or wallet backup must be tested through an actual rescan of change-bearing transactions.

How specialists test it

Operators test the command on a non-production node first. They check a normal reply, an invalid request, a timeout and a restart. This shows what the response means and prevents one local result from being mistaken for a network-wide outcome.

Conclusion

getrawchangeaddress is a low-level wallet-state operation for controlled raw transaction workflows. It is safe only when change arithmetic, retries, signing, output verification and recovery are handled as one auditable process.