BIP 341 (Taproot)

BIP-341 defines Taproot - SegWit version 1 outputs that use a tweaked x-only public key directly as the address. Activated as a soft fork in November 2021 at block height 709,632, alongside BIP-340 (Schnorr signatures) and BIP-342 (Tapscript).

The headline structural choice: there is no hash layer in front of the public key. The bech32m address (the part starting with bc1p...) IS a 32-byte tweaked x-only pubkey, presented directly to anyone reading the chain. Earlier hashed-address types (P2PKH, P2WPKH) hide the pubkey behind a 160-bit hash until the address is spent. P2TR does not. Every P2TR output puts its key on chain at creation.

This choice is what makes key-path and script-path spending look identical on the wire - the script tree commitment is folded into the tweak rather than appearing as a separate hash layer - and it is also why P2TR outputs are "always-exposed" in post-quantum terms: the public key is forensically reachable from the moment the output is created, regardless of whether the output is ever spent.

The two spending paths

A P2TR output commits to either a single public key (the "internal key"), a tree of alternative spending scripts (the "script paths"), or both. The taproot tweak combines them into a single output key that doesn't reveal which paths exist.

1. Key-path spend. A single Schnorr signature over the tweaked key. The witness contains exactly 64 bytes. Observers cannot tell whether script paths existed or what they would have been. This is the common case and the cheapest spend type in Bitcoin.
2. Script-path spend. Reveals one leaf of a Merkleized script tree, proves it was committed to in the tweak, and executes the leaf script under Tapscript. Other branches stay hidden. Pay for the branch you actually use.

Authored by Pieter Wuille, Jonas Nick, and Anthony Towns. The activation followed an extended "Speedy Trial" signaling period, ending in lock-in in June 2021 and full activation in November.

Spec: BIP-341.