BIP 49 vs BIP 84: nested vs native SegWit
BIP 49 and BIP 84 both derive keys for single-key SegWit (P2WPKH) spending, but BIP 49 wraps the SegWit script inside a P2SH address starting with 3, while BIP 84 uses it directly in a Bech32 address starting with bc1q. Native SegWit (BIP 84) is smaller and cheaper to spend; nested SegWit (BIP 49) exists so that wallets able to pay only 3... addresses could still pay SegWit users.
Updated · 3 min read
At a glance
| BIP 49 | BIP 84 | |
|---|---|---|
| Title | Derivation scheme for P2WPKH-nested-in-P2SH based accounts | Derivation scheme for P2WPKH based accounts |
| Status | Deployed | Deployed |
| Type | Specification | Specification |
| Assigned | 2016-05-19 | 2017-12-28 |
| Authors | Daniel Weigl | Pavol Rusnak |
| In plain English | Defines how HD wallets derive keys for SegWit addresses wrapped inside P2SH, which begin with "3". This let wallets offer cheaper SegWit transactions while staying payable from older software that could not yet send to native SegWit addresses. | Specifies the standard key path for HD wallets that use native SegWit addresses (those starting with 'bc1q'). Agreeing on this path means a user can restore the same seed phrase in different wallet apps and find the same addresses and funds. |
Same key, two ways to pay it
Both standards use the BIP 44 path layout and change only the purpose: m/49'/0'/0' for BIP 49 and m/84'/0'/0' for BIP 84. Both sign with ECDSA and put the signature and public key in the witness, as BIP 141 defines for P2WPKH. The difference is where the witness program lives:
- Nested SegWit (BIP 49): the output is an ordinary P2SH script,
HASH160 <20-byte-script-hash> EQUAL. To spend it, the scriptSig must reveal the redeem script0 <20-byte-key-hash>(pushed as0x160014{20-byte-key-hash}, 23 bytes), and only then does SegWit validation run on the witness. - Native SegWit (BIP 84): the output itself is
0 <20-byte-key-hash>(0x0014{20-byte-key-hash}), and the scriptSig is empty.
BIP 49 vs BIP 84 compared
| BIP 49 (nested SegWit) | BIP 84 (native SegWit) | |
|---|---|---|
| Script type | P2SH-P2WPKH | P2WPKH |
| Address starts with | 3 (testnet 2) |
bc1q (testnet tb1q) |
| Address encoding | Base58Check | Bech32, BIP 173 |
| scriptPubKey | 23 bytes (a914{hash}87) |
22 bytes (0014{hash}) |
| scriptSig when spending | 23 bytes | Empty |
| Witness | Signature + public key | Signature + public key (identical) |
| Typical input size | ~91 vB | ~68 vB |
| Output size | 32 bytes | 31 bytes |
| Account key prefix | ypub / yprv (0x049d7cb2 / 0x049d7878) |
zpub / zprv (0x04b24746 / 0x04b2430c) |
| Testnet prefix | upub / uprv |
vpub / vprv |
| Output descriptor | sh(wpkh()) |
wpkh() |
BIP 141 sums up the cost: compared with native P2WPKH, the nested version's scriptPubKey is 1 byte bigger and its scriptSig 23 bytes bigger, while the witness is the same.
Why nested SegWit exists
When SegWit activated at block 481,824 in August 2017, a wallet could only pay a bc1 address if it implemented BIP 173, which says plainly: "Only new software will be able to use these addresses". Paying a 3... address, on the other hand, had worked since P2SH (BIP 16) was enforced in 2012. BIP 49, by Daniel Weigl, gave SegWit users an address that any wallet could pay while still moving signatures into the witness. BIP 84, by Pavol Rusnak, followed for wallets ready to use Bech32 directly.
Both standards put SegWit coins in dedicated accounts on purpose. BIP 49 explains that adding SegWit addresses to existing BIP 44 accounts could make a non-upgraded wallet show an account with some coins missing, whereas a separate purpose "fails in a more visible way": the account shows up or not at all. BIP 84 adopts the same reasoning.
Which should you use?
- New wallet: BIP 84. Inputs are about a quarter smaller (about 68 vB against 91 vB), and a
bc1qaddress of 42 characters is always single-key P2WPKH, while a3address could hide any script. Or consider BIP 86 Taproot; see BIP 84 vs BIP 86. - Existing BIP 49 wallet: your coins are fine. Moving them to BIP 84 addresses saves about 23 vB per input on future spends, at the cost of one transaction now.
- Receiving from software that rejects
bc1q: a BIP 49 address remains a workable fallback. - Restoring:
3...addresses from a single-key wallet usually meanm/49'/0'/0'. Aypubexport also points to BIP 49, and azpubto BIP 84.
Compare all four common paths in BIP 44 vs 49 vs 84 vs 86, check an address with the address checker, or read the SegWit guide.
Frequently asked questions
Is an address starting with 3 SegWit?
Not necessarily. Every P2SH address starts with 3, including older multisig and other scripts. A 3 address from a BIP 49 wallet is nested SegWit (P2SH-P2WPKH), but you can't tell from the address alone, because the script is only revealed when the coins are spent. Native SegWit addresses start with bc1q instead.
What is the difference between ypub and zpub?
Both are BIP 32 extended public keys with alternate version bytes registered in SLIP-0132. A ypub (0x049d7cb2) comes from BIP 49 and tells software to create nested SegWit addresses starting with 3; a zpub (0x04b24746) comes from BIP 84 and means native SegWit bc1q addresses. The prefix labels the address type to derive; it doesn't change the key data.
Is native SegWit cheaper than nested SegWit?
Yes. Spending a native P2WPKH input takes about 68 vB, while the nested P2SH-P2WPKH version takes about 91 vB because its scriptSig must carry a 23-byte redeem script. The witness data is identical. Outputs differ by only one byte (31 against 32 bytes), so the saving shows up mainly when you spend.
Should I move my coins from BIP 49 to BIP 84?
You don't have to: nested SegWit coins remain fully spendable. Moving them costs one transaction now and saves about 23 vB on each later spend of each coin, so it can make sense for coins you'll keep, ideally when fees are low. Keep a record of the old path until the move has confirmed.
Can every wallet send to a bc1q address?
Only wallets that implement Bech32 (BIP 173) can pay bc1q addresses, and that limitation is why BIP 49 was written. Any wallet that can pay a 3 address can pay a BIP 49 address. If a service rejects your bc1q address, a nested SegWit address works as a fallback.