The one question behind every type
Every classification comes down to control over three rights: reading the ledger, submitting transactions and taking part in consensus. NIST's Blockchain Technology Overview uses exactly this lens, dividing systems into permissionless ones, where anyone can publish blocks, and permissioned ones, where publishing is restricted to authorized users.[1]
The familiar four labels are finer cuts of the same idea. Public means fully permissionless. Private and consortium are permissioned with one or several operators; NIST notes that permissioned networks are often deployed for a group of organizations called a consortium. Hybrid mixes a permissioned core with a link to a public chain.[1]
Public blockchains
Bitcoin is the reference case. Its 2008 whitepaper describes a peer-to-peer network where nodes can leave and rejoin at will and consensus comes from the longest proof-of-work chain, with no gatekeeper.[2]
Ethereum is public too but uses proof of stake. 32 ETH is the minimum stake for a validator, and since the Pectra upgrade a single validator can hold between 32 and 2,048 ETH.[3]
The cost of openness is resources: every full node stores and verifies the whole history, and fees rise when demand for block space rises.
NIST also stresses that the choice is not about technology quality. It notes that permissioned networks can have the same traceability of digital assets and the same distributed, resilient and redundant data storage as permissionless ones; they differ in who is trusted.[1]
Private, consortium and hybrid blockchains
A private chain is run by one organization that decides who can join. A consortium chain spreads that control across several known organizations. NIST describes an owner or consortium that admits publishing nodes and can remove them.[1]
Hyperledger Fabric is the common platform for both. Its documentation describes permissioned networks as a set of known, identified participants operating under a governance model, and notes that Fabric's consensus is pluggable and does not need a native cryptocurrency to reward mining.[4]
Fabric also runs smart contracts, called chaincode, in general-purpose languages such as Go, Java and Node.js rather than a blockchain-specific language.[4]
NIST lists hybrid approaches next to permissioned ones as an option when regulation rules out a fully public chain, for example where records must stay on nodes inside a given jurisdiction.[1]
Solana, Avalanche, BNB Chain and Sui are public as well, though they set different hardware bars for validators. Higher hardware requirements do not make a chain permissioned, but they do shrink the set of people who can realistically take part.
Consortium networks suit groups that share a process but not full trust. Fabric's documentation describes a permissioned chain as a way to secure interactions among entities that have a common goal but may not fully trust each other; the chain replaces reconciliation between separate databases, not the members' trust in each other.[4]
The weak point of a consortium is governance, not code. Members must agree on who joins, who leaves and how disputes are settled; NIST notes that such networks likely have additional legal contracts in place for their users.[1]
Side-by-side comparison
The table puts the four access models next to each other.
Most real deployments fit one row cleanly; the hybrid row is the one where marketing labels most often blur the details.
| Type | Who can validate | Example |
|---|---|---|
| Public | Anyone meeting the protocol rules | Bitcoin, Ethereum |
| Private | One organization's approved nodes | Internal Hyperledger Fabric network |
| Consortium | Nodes of several member organizations | Industry Fabric network |
| Hybrid | Permissioned nodes, anchored to a public chain | Permissioned network linked to a public chain |
Worked example: how much a public chain asks of a node
The Bitcoin whitepaper gives its own arithmetic. A block header with no transactions is about 80 bytes. With one block every 10 minutes, that is 80 bytes x 6 x 24 x 365 = 4.2 MB of headers per year.[2]
Headers are small, which is why lightweight clients are possible. Full transaction data is much larger, and that is the real cost of a public ledger: every full node keeps a copy. A private chain with five known nodes avoids most of that duplication, at the price of trusting those five operators.
A node operator on a public chain also chooses how much history to keep. Pruned nodes discard old transaction data after verifying it, and the whitepaper already anticipated this by designing the Merkle tree so that spent transactions could be dropped without breaking the block hash.[2]
A private network has no need for such tricks, because its operators can size hardware for a known number of members and a known transaction volume.
Layer 1 and layer 2: the other way to classify
A layer 1 runs its own consensus and security. A layer 2 processes transactions separately and posts data or proofs back to a layer 1, inheriting its security. Ethereum.org lists optimistic rollups and zero-knowledge rollups as the two main rollup types.[5]
For a user the difference shows up in fees and in the chain ID the wallet switches to. Arbitrum, Optimism and Base are all public layer 2 networks; they are permissionless to use even when their sequencer is run by one company.
Layer 2 fees are much lower because many transactions are rolled up into a single transaction on mainnet, which ethereum.org credits with reducing gas fees for users.[5]
That data post still pays Ethereum's base fee, which can rise by up to 12.5 percent per block when blocks are above target, so layer 2 costs rise when mainnet is busy.[6]
Rollups also inherit the access model of the chain they post to. A rollup on Ethereum is only as open as its own entry rules allow, but its final record is as public as Ethereum itself.[5]
See also: Glossary: layer 2 · Arbiscan
How to tell which type a project uses
Ask who can run a block-producing node without signing an agreement. If the answer is anyone, the chain is public. If a company or group must approve you first, it is permissioned, whether it calls itself private, consortium or enterprise.[1]
Next, ask whether there is a native token that pays for block production. NIST notes that permissionless networks usually reward publishers of valid blocks with a native cryptocurrency. Fabric-style networks can run without one, because members take part for their business relationship, not for protocol rewards.[1]
Then ask where the data can be read. A public explorer that shows every block without a login points to a public ledger. NIST notes that a permissioned network may let anyone read it or may restrict read access to authorized individuals.[1]
For layer 2 networks, check where the data goes. Ethereum.org's scaling docs explain that rollups post transaction data to layer 1, which is what secures them with Ethereum consensus. Validiums keep data off the main chain and derive their security differently.[5]
The answers rarely take more than a few minutes to find in a project's own documentation, and they tell you more than a marketing label does.
The bottom line
Choose by who must be able to verify the record. If outsiders with no relationship to you need to check it, only a public chain or a public layer 2 does the job; if every participant is a known, contracted party, a permissioned network like Fabric is cheaper and faster to run.
Educational content, not financial advice. Crypto assets are volatile; do your own research.