Script is the small programming language that Bitcoin uses to decide whether a transaction may spend a given amount of bitcoin. Every output of a transaction carries a short piece of Script, called a locking script, that sets the conditions for spending it. Whoever wants to spend that output later must provide an unlocking script, typically a digital signature and a public key, that satisfies those conditions when the two are run together by every node.
Script was included in the original Bitcoin software released by Satoshi Nakamoto in 2009. It is deliberately limited: it has no loops and is not Turing-complete, which makes its behaviour predictable and its cost to check easy to bound. That distinguishes it from the general-purpose smart contract languages of Ethereum, such as Solidity, and explains both Bitcoin's security record and its narrower programmability.
Script in plain terms
Think of each bitcoin as sitting in a small lockbox, with a sticky note on the lid that says how the box may be opened. The most common note says "open with the key belonging to this person". Others say "open only if two of these three people agree" or "do not open until next March".
Script is the language those notes are written in. When someone tries to open a box, every computer on the network reads the note, checks what the person has supplied and agrees whether the box opens. Because the language is simple, everyone gets the same answer.
How Script works
Script is a stack-based language, read from left to right. Data items are pushed onto a stack, and operation codes, or opcodes, take items off the stack, act on them and push the results back. If the program finishes with a true value on top and nothing has failed, the spend is valid.
A standard payment to an address, known as pay-to-public-key-hash, works in steps:
- Unlock. The spender supplies a signature and their public key.
- Hash. The script duplicates the public key, hashes it and compares the result with the hash stored in the locking script.
- Check. If the hashes match, the opcode OP_CHECKSIG verifies that the signature is valid for this transaction and this key.
Because Bitcoin tracks coins as unspent transaction outputs, each output carries its own script, and a transaction spending several outputs must satisfy each one.
What Script can do
- Single-signature payments. The everyday case: coins are spent with one private key.
- Multi-signature. A multisignature script requires, for example, two of three keys, used by businesses, custodians and careful individuals.
- Timelocks. Opcodes added in 2015 and 2016 let coins be locked until a date or block height, or for a period after they are received.
- Hash locks. Coins can be released to whoever reveals a secret, the basis of the hashed timelock contract used by the Lightning Network and atomic swaps.
- Data. The OP_RETURN opcode marks an output as unspendable and lets a small amount of data be recorded on the chain.
Upgrades
In 2010 Satoshi Nakamoto disabled several opcodes, including OP_CAT, after bugs were found, which narrowed what Script could do. Later soft forks expanded it in controlled ways. Pay-to-script-hash, activated in 2012, let senders pay to the hash of a complex script, so the recipient supplies the full script only when spending. Segregated Witness, activated in 2017, moved signature data into a separate structure and introduced script versioning. The Taproot upgrade of November 2021 added Schnorr signatures and Tapscript, which lets many possible spending conditions be committed to while revealing only the one used, improving privacy and efficiency. As of November 2026, developers continued to debate proposals to re-enable OP_CAT or add "covenants" that restrict where coins can be sent next.
Limitations and criticism
Supporters see Script's simplicity as a strength: it reduces the room for costly bugs and for the kind of exploits that have hit complex DeFi contracts on other chains. Critics argue that it makes Bitcoin hard to build on, pushing innovation to sidechains and other networks. Script can be awkward to write directly, so developers use higher-level tools and policy languages that compile down to it. Its limited set of operations also means that some features common elsewhere, such as letting a contract inspect the transaction spending it, can be added only through a soft fork that most of the network accepts, a slow and politically difficult process. The use of witness data to store images and text since 2023, through so-called inscriptions, has also prompted argument over what Bitcoin's block space should be used for.