BIP 84 vs BIP 86: SegWit vs Taproot wallets

BIP 84 derives keys for native SegWit P2WPKH addresses (bc1q...) signed with ECDSA; BIP 86 derives keys for single-key Taproot P2TR addresses (bc1p...) signed with Schnorr. Taproot inputs are smaller but its outputs are larger, so fees are similar for everyday payments, and every Taproot key-path spend looks alike on-chain.

Updated 2026-10-20 · 3 min read

At a glance

Two paths, two script types

BIP 84 and BIP 86 share the BIP 44 layout and differ in the purpose number (84' or 86') and in what each derived key becomes:

• BIP 84, by Pavol Rusnak, hashes the public key with HASH160 and places it in a version 0 witness program, 0 <20-byte-key-hash>. Spending reveals the public key and an ECDSA signature.
• BIP 86, by Ava Chow, treats the derived key as a Taproot internal key P and computes the output key Q = P + int(hashTapTweak(bytes(P)))G, committing to an unspendable script path as BIP 341 recommends for outputs with no scripts. The output is 1 <32-byte-output-key> (0x5120{key}) and is spent with a single Schnorr signature.

BIP 84 vs BIP 86 compared

The two BIPs' test vectors show the effect of the purpose number. Both use the published test phrase "abandon abandon ... about" (never use it for real funds): its first BIP 84 receiving address is bc1qcr8te4kr609gcawutmrza0j4xv80jy8z306fyu, and its first BIP 86 address is bc1p5cyxnuxmeuwuvkwfem96lqzszd02n6xdcjrs20cac6yqjjwudpxqkedrcr. Same seed, different branch, unrelated addresses.

Taproot vs SegWit fees: smaller inputs, bigger outputs

A BIP 86 input is about 10.5 vB smaller than a BIP 84 input, because one 64-byte Schnorr signature replaces an ECDSA signature plus a public key. A P2TR output, though, is 12 bytes larger, because it stores a full 32-byte key instead of a 20-byte hash. For a typical payment with one input, one payment output and one change output, the two come out within a few vbytes of each other, depending on the recipient's address type. Taproot saves more the more inputs you spend at once, for example when consolidating many small coins. The transaction size calculator compares real transactions.

Privacy and compatibility

Every Taproot key-path spend looks the same on-chain: one 64-byte signature for one 32-byte key. A BIP 86 wallet's spends therefore resemble those of other Taproot users, including groups signing with MuSig2 and contracts whose script paths stayed hidden. BIP 84 spends reveal a public key and are always single-key P2WPKH.

On the other side, a sender needs BIP 350 Bech32m support to pay a bc1p address. Software that only implements BIP 173 Bech32 can pay bc1q addresses but rejects bc1p ones as having an invalid checksum. BIP 86 also registers no SLIP-0132 prefix: its account keys are plain xpubs, so watch-only setups should use a tr() output descriptor to avoid deriving the wrong address type.

Which should you choose?

• BIP 84 if you need to be payable by software that supports Bech32 but not Bech32m, or your tools only understand zpub and wpkh().
• BIP 86 if your wallet and the people who pay you support Bech32m, and you want smaller inputs and Taproot's uniform key-path spends.
• Both: one seed phrase can hold BIP 84 and BIP 86 accounts side by side, and moving coins between them is an ordinary payment.

For the protocol-level picture, see SegWit vs Taproot (BIP 141 vs BIP 341); for every path at once, BIP 44 vs 49 vs 84 vs 86. The Taproot guide explains the tweak in more depth.