Home › Glossary › OP_RETURN

OP_RETURN

Also called: OP_RETURN output, null data output, nulldata, data carrier, datacarrier.

OP_RETURN is the Bitcoin Script opcode (0x6a) that makes an output provably unspendable, used to embed small amounts of data in a transaction.

OP_RETURN is an opcode (byte 0x6a) that makes a script fail immediately. An output whose locking script starts with OP_RETURN can therefore never be spent, and every node can see that in advance. That makes it the standard way to put a small piece of data on the blockchain: nodes can leave these outputs out of their UTXO set, unlike fake addresses that look spendable forever.

What OP_RETURN outputs are used for

  • Commitments. SegWit (BIP 141) stores its witness commitment in an OP_RETURN output of the coinbase transaction, beginning 0x6a24aa21a9ed. Other protocols commit hashes the same way, for example for timestamping.
  • Application data. Protocols built on Bitcoin tag transactions with short payloads.
  • Payment requests. BIP 74 proposed letting a BIP 70 payment request include a zero-value OP_RETURN output.

BIP 158 compact block filters leave OP_RETURN outputs out, so that the filters themselves could later be committed to in one by a soft fork.

Size limits: policy and proposals

OP_RETURN size is mostly a matter of mempool policy, not consensus. For years Bitcoin Core relayed at most one OP_RETURN output per transaction, with up to 80 bytes of data (an 83-byte script). Bitcoin Core 30.0 (2025) raised that default and allowed several such outputs, a change that was widely debated. BIP 110 proposes a temporary soft fork that would, among other limits, make OP_RETURN scripts over 83 bytes invalid by consensus.

A bit of history

In the earliest versions of Bitcoin (up to 0.3.5), OP_RETURN ended the script with whatever value was on the stack, which let anyone steal coins by putting it in a scriptSig, as BIP 342 recounts. It was changed so that it always fails. Byte values for every opcode are in the opcode reference.

BIPs that define OP_RETURN

  • BIP 141 (SegWit): Segregated Witness (Consensus layer): Deployed. Defines Segregated Witness (SegWit), which moves signatures into a separate "witness" section of each transaction while remaining compatible with older nodes. This fixed transaction malleability,…
  • BIP 110: Reduced Data Temporary Softfork: Closed. Proposes a temporary soft fork that would limit the size of arbitrary data fields allowed in transactions under Bitcoin's core rules. Supporters argue this would discourage using block space for…
  • BIP 74: Allow zero value OP_RETURN in Payment Protocol: Closed. Adjusts the BIP 70 Payment Protocol so a merchant's payment request can include an OP_RETURN output carrying zero bitcoin, a way of attaching a small piece of data to a transaction. This lets…
  • BIP 158: Compact Block Filters for Light Clients: Deployed. Specifies how to build the compact block filters used by the BIP 157 light-client protocol, a compressed summary of the addresses and data touched in each block. Wallets use these filters to decide…

Related terms

  • Opcode: An opcode is a one-byte instruction in Bitcoin Script, such as OP_CHECKSIG (0xac) or OP_RETURN (0x6a), that pushes data or acts on the stack.
  • UTXO: A UTXO (unspent transaction output) is an amount of bitcoin locked to a script and not yet spent. A wallet's balance is the sum of its UTXOs.
  • Coinbase transaction: The coinbase transaction is the first transaction in every block, written by the miner to collect the block subsidy and fees; it has no real inputs.
  • Mempool: The mempool is a node's waiting area for valid, unconfirmed transactions; miners choose from it, usually by fee rate, when they build a block.