An externally owned account is controlled by a private key: a secret number that controls that account.

The private key creates a public address. The address is safe to share because it only receives assets and identifies the account. The private key must stay secret because it controls the account.

This only works one way. Ethereum can derive an address from a private key, but it is effectively impossible to work backward from an address to the private key.