Sighash flags
Also called: sighash, sighash type, hash type, SIGHASH_ALL, SIGHASH_ANYONECANPAY, signature hash.
Sighash flags are a byte on each Bitcoin signature saying which parts of the transaction it covers, such as SIGHASH_ALL (0x01) for all of it.
A sighash flag (signature hash type) tells verifiers which parts of a transaction a signature commits to. The signer hashes those parts into a message (the sighash), signs it, and appends the flag byte to the signature. Anything the signature doesn't cover can be changed later without invalidating it.
The sighash flags
| Flag | Value | Signature covers |
|---|---|---|
| SIGHASH_ALL | 0x01 | All inputs and all outputs |
| SIGHASH_NONE | 0x02 | All inputs, no outputs |
| SIGHASH_SINGLE | 0x03 | All inputs, and only the output with the same index as this input |
| SIGHASH_ANYONECANPAY | 0x80 | Combined with the above (0x81, 0x82, 0x83): only this input |
| SIGHASH_DEFAULT | 0x00 | Taproot only: same as ALL, with no byte appended |
Wallets use SIGHASH_ALL almost all the time. The others enable special constructions: ANYONECANPAY lets others add inputs (crowdfunding-style transactions), and SINGLE|ANYONECANPAY lets a signer offer one input for one output, as some swap and marketplace protocols do.
How the sighash algorithm evolved
- Legacy: hashes a modified copy of the whole transaction for each input, which takes quadratic time on large transactions and doesn't sign the input amount.
- SegWit v0: BIP 143 commits to the amount being spent and reuses intermediate hashes.
- Taproot: BIP 341 commits to the amounts and scripts of all inputs, uses tagged hashes and adds SIGHASH_DEFAULT, implied by a 64-byte Schnorr signature.
Proposed flags
BIP 118 proposes SIGHASH_ANYPREVOUT (0x40) and SIGHASH_ANYPREVOUTANYSCRIPT (0xc0) for Tapscript, letting a signature apply to any compatible coin; see BIP 118 vs BIP 119. Signing tools record the chosen type in a PSBT.