SegWit vs Taproot (BIP 141 vs BIP 341)
SegWit (BIP 141, activated in 2017) moved signatures into a separate witness and introduced versioned witness programs; Taproot (BIP 341, activated in 2021) is SegWit version 1, an output type that can be spent with one Schnorr signature or by revealing one script from a hidden tree. Taproot doesn't replace SegWit: it builds on it, and version 0 outputs remain fully valid.
Updated · 3 min read
At a glance
| BIP 141 | BIP 341 | |
|---|---|---|
| Title | Segregated Witness (Consensus layer) | Taproot: SegWit version 1 spending rules |
| Status | Deployed | Deployed |
| Type | Specification | Specification |
| Assigned | 2015-12-21 | 2020-01-19 |
| Authors | Eric Lombrozo, Johnson Lau, Pieter Wuille | Pieter Wuille, Jonas Nick, Anthony Towns |
| In plain English | Defines Segregated Witness (SegWit), which moves signatures into a separate "witness" section of each transaction while remaining compatible with older nodes. This fixed transaction malleability, effectively increased block capacity, and created a clean upgrade path that later enabled the Lightning Network and Taproot. | Taproot introduces a new kind of Bitcoin output that can be spent either with a single signature or by revealing just one of many possible alternative spending conditions, kept hidden in a tree structure until used. As a result, complex arrangements like multisig or timelocked contracts can look like ordinary payments on-chain, improving privacy and reducing fees. |
What SegWit (BIP 141) changed
BIP 141, by Eric Lombrozo, Johnson Lau and Pieter Wuille, defined Segregated Witness. It moved signatures and scripts into a new witness structure that isn't part of the txid, which ended unintended transaction malleability, and replaced the 1 MB block size limit with a limit of 4,000,000 weight units, in which witness bytes count a quarter as much as other bytes (block weight).
It also introduced witness programs: a version (0 to 16) followed by 2 to 40 bytes. Version 0 defines P2WPKH (a 20-byte key hash) and P2WSH (a 32-byte script hash), with signatures hashed per BIP 143. Versions 1 to 16 were "reserved for future extensions". SegWit (BIPs 141, 143 and 147) activated at block 481,824 on 24 August 2017.
What Taproot (BIP 341) changed
BIP 341, by Pieter Wuille, Jonas Nick and Anthony Towns, used that reserved space. A Taproot output is a version 1 witness program holding a 32-byte public key Q, which commits to an internal key P and, optionally, the root of a Merkle tree of scripts (MAST). It can be spent in two ways:
- Key path: one 64-byte Schnorr signature (BIP 340) for
Q. Nothing about any scripts is revealed. - Script path: reveal one script, a control block of 33 + 32m bytes proving it is in the tree, and the inputs that satisfy it. The other scripts stay hidden.
BIP 342 defines tapscript, the script rules for that path. Taproot (BIPs 340, 341 and 342) activated at block 709,632 on 14 November 2021.
SegWit vs Taproot compared
| SegWit v0 (BIP 141) | Taproot, SegWit v1 (BIP 341) | |
|---|---|---|
| Witness version | 0 | 1 |
| Output types | P2WPKH, P2WSH | P2TR |
| Address | bc1q..., Bech32 |
bc1p..., Bech32m |
| Signature scheme | ECDSA, DER-encoded, up to 72 bytes | Schnorr, 64 bytes (65 with a non-default sighash) |
| Signature message | BIP 143 | New BIP 341 algorithm, committing to all input amounts and scriptPubKeys |
| What the output holds | Hash of a key (20 bytes) or script (32 bytes) | A tweaked public key (32 bytes) |
| Complex scripts | P2WSH reveals the whole script when spent | Only the used leaf is revealed; a key-path spend reveals none |
| Multisig | OP_CHECKMULTISIG |
OP_CHECKSIGADD in tapscript, or key aggregation such as MuSig2 |
| Wrapped in P2SH | Possible (P2SH-P2WPKH, P2SH-P2WSH) | No: P2SH-wrapped v1 outputs get no Taproot rules |
| Single-key input | ~68 vB | ~57.5 vB |
| Single-key output | 31 bytes | 43 bytes |
| Built-in upgrade paths | Witness versions 1 to 16 | Leaf versions, OP_SUCCESSx opcodes, the annex, new public key types |
How Taproot relates to SegWit
Taproot is a SegWit upgrade, not a competitor. It relies on BIP 141's witness structure, weight rules and versioned outputs, and on the fact that nodes which haven't upgraded treat unknown witness versions as anyone-can-spend, which is what made it a soft fork. Version 0 outputs work exactly as before, and wallets can hold both types at once.
Taproot also fixed issues that SegWit v0 left open. Its signature message commits to the amounts and scripts of every input being spent, which helps offline signers check fees, and its Schnorr signatures are fixed-size and support batch verification.
Which should you use?
For a simple single-key wallet both are sound, and the practical comparison is BIP 84 vs BIP 86. Taproot's advantages grow with complexity: multisig groups and contracts can spend with one signature when everyone agrees, and keep fallback conditions private. Paying a bc1p address requires a wallet with Bech32m support (BIP 350); see Bech32 vs Bech32m.
The SegWit guide and Taproot guide cover each upgrade in depth, and the soft forks guide explains how both were activated.
Frequently asked questions
Is Taproot part of SegWit?
Yes. Taproot outputs are SegWit version 1 witness programs, using the versioning system BIP 141 created in 2017. Version 0 covers P2WPKH and P2WSH; version 1 with a 32-byte program is Taproot (P2TR). That is why both address types start with bc1: bc1q for version 0 and bc1p for version 1.
Is Taproot better than SegWit?
It depends on the use. Taproot single-key inputs are smaller, every key-path spend looks alike, and unused script conditions stay hidden. Native SegWit outputs are smaller, and paying a bc1q address only needs Bech32 support, which older software is more likely to have. For multisig and contracts Taproot offers the most; for simple wallets the difference is modest.
When were SegWit and Taproot activated?
SegWit (BIPs 141, 143 and 147) activated at block 481,824 on 24 August 2017, after BIP 91 locked it in. Taproot (BIPs 340, 341 and 342) activated at block 709,632 on 14 November 2021, after miners signalled during the Speedy Trial deployment. Both were soft forks, so nodes that hadn't upgraded kept working.
Does Taproot replace SegWit v0 addresses?
No. Version 0 outputs (bc1q) remain valid and spendable, and wallets can keep using them. Taproot adds a new output type alongside them. A wallet can hold both, for example a BIP 84 account for native SegWit and a BIP 86 account for Taproot under the same seed phrase.
Can Taproot be wrapped in P2SH like SegWit?
No. BIP 341 applies its rules only to native version 1 outputs with 32-byte programs; P2SH-wrapped version 1 outputs are left unencumbered, so wrapping offers no protection. Nested SegWit existed for senders that couldn't pay Bech32 addresses, whereas Taproot relies on senders supporting Bech32m (BIP 350).