Home › Glossary › Taproot

Taproot

Also called: Taproot upgrade, P2TR, SegWit v1, BIP 341, BIP341, bc1p.

Taproot is the 2021 Bitcoin soft fork (BIPs 340, 341, 342) that added Schnorr signatures and P2TR outputs which hide unused spending conditions.

Taproot is the soft fork that added SegWit version 1 outputs, Schnorr signatures and a new script system. It is defined by BIP 340, BIP 341 and BIP 342, written by Pieter Wuille, Jonas Nick, Anthony Towns and Tim Ruffing, and activated at block 709,632 on 14 November 2021 after Speedy Trial signaling.

How Taproot works

A Taproot (P2TR) output contains a single 32-byte public key Q: an internal key P, tweaked with the root of an optional tree of scripts. The output can be spent in two ways:

  1. Key path: one 64-byte Schnorr signature for Q. Nothing about any scripts is revealed.
  2. Script path: reveal one script, its inputs and a control block (33 + 32m bytes, up to 128 levels deep) proving the script is a leaf of the committed tree. Only that branch is published (MAST).

Scripts in the tree use Tapscript (BIP 342). With MuSig2 (BIP 327), several signers can share one key, so a multisig spent cooperatively looks like any single-signature payment.

Why Taproot matters

  • Privacy: most spends look alike, whatever other conditions the output allowed.
  • Efficiency: a key path spend is smaller than an equivalent multisig script.
  • Upgradability: leaf versions, OP_SUCCESS opcodes and the annex leave room for future soft forks.

Taproot addresses use bech32m (BIP 350) and start with bc1p; single-key wallets derive them at m/86'/0'/0' (BIP 86). Read the full Taproot guide or compare it with SegWit in BIP 141 vs BIP 341.

BIPs that define Taproot

  • BIP 341: Taproot: SegWit version 1 spending rules: Deployed. Taproot introduces a new kind of Bitcoin output that can be spent either with a single signature or by revealing just one of many possible alternative spending conditions, kept hidden in a tree…
  • BIP 340: Schnorr Signatures for secp256k1: Deployed. Defines a standard for Schnorr signatures, a simpler and more flexible signing method than the ECDSA scheme Bitcoin originally used, on the same elliptic curve. Schnorr signatures are compact (64…
  • BIP 342 (Tapscript): Validation of Taproot Scripts: Deployed. Specifies Tapscript, the updated scripting rules used when a Taproot output is spent through one of its hidden alternative conditions. It switches signature checks to Schnorr, removes some old…
  • BIP 350: Bech32m format for v1+ witness addresses: Deployed. Introduces Bech32m, a corrected version of the Bech32 address format used for SegWit addresses (those starting with 'bc1'). A subtle flaw in Bech32 could let certain typos go undetected, so Bech32m…
  • BIP 86 (Taproot derivation): Key Derivation for Single Key P2TR Outputs: Deployed. Defines the standard key path for HD wallets that use single-key Taproot addresses (those starting with 'bc1p'). It plays the same role for Taproot that BIP 84 does for SegWit, so seed phrases…
  • BIP 327: MuSig2 for BIP340-compatible Multi-Signatures: Deployed. Standardizes MuSig2, a scheme that lets several people jointly create a single signature that looks like an ordinary one-person Taproot signature. This makes shared-control wallets cheaper and more…

Related terms

  • Schnorr signatures: Schnorr signatures are the 64-byte digital signatures standardized in BIP 340 and used by Taproot. They are simpler and more flexible than ECDSA.
  • Tapscript: Tapscript is the script language for Taproot script paths (BIP 342): Bitcoin Script with Schnorr signature checks, OP_CHECKSIGADD and OP_SUCCESS hooks.
  • P2TR: P2TR (Pay to Taproot) is the SegWit version 1 output type from BIP 341: one 32-byte key with optional hidden scripts. Addresses start with bc1p.
  • MAST: MAST commits to many alternative spending scripts in a Merkle tree so only the branch actually used is revealed; Taproot implements it as script trees.
  • MuSig2: MuSig2 is a Schnorr multi-signature scheme (BIP 327): several signers share one aggregate key and produce one ordinary-looking signature.

Learn more

Guides