Taproot is an upgrade to the Bitcoin protocol that activated in November 2021 at block 709,632. It changed how bitcoin can be locked and spent by adding a new signature scheme, Schnorr signatures, and a new output type that can hide complex spending conditions behind what looks like an ordinary single-signature payment. Its aims were to make more advanced transactions, such as multi-signature wallets and payment channels, cheaper and more private, and to give developers more room to build on Bitcoin.
Taproot was the most significant change to Bitcoin since Segregated Witness (SegWit) in 2017. It was introduced as a soft fork, meaning older nodes continued to accept the new blocks, and it was specified in three Bitcoin Improvement Proposals: BIP 340 for Schnorr signatures, BIP 341 for Taproot itself and BIP 342 for an updated scripting system known as Tapscript. The core idea was proposed by developer Gregory Maxwell in 2018.
Taproot in plain terms
Imagine a safe that can be opened in several ways: by the owner alone, by two of three business partners together, or by a lawyer after a year has passed. Under the old rules, using any of those methods meant showing the whole list of options to everyone watching, which revealed how the safe was set up and took up space.
Taproot changes that. In the normal case, where everyone agrees, the safe opens with what looks like one simple key, and nobody can tell that other options ever existed. Only if a backup option is actually used does the owner reveal that one option, and nothing else. The result is that complex arrangements look like everyday payments, which helps privacy and keeps transactions smaller and cheaper.
How Taproot works
Taproot combines several technical pieces:
- Schnorr signatures. Bitcoin previously relied only on ECDSA digital signatures. Schnorr signatures, defined in BIP 340, have a simpler mathematical structure that allows several public keys and signatures to be combined into one. A group using a multi-signature arrangement can therefore sign together in a way that looks like a single signer.
- Key path and script path. A Taproot output is locked to a single public key, which can be tweaked to commit to a set of alternative scripts. Spending through the key path needs only one signature; spending through the script path reveals just the one script being used.
- Merkle trees of scripts. The alternative conditions are organized in a Merkle tree, an idea often described as MAST, so unused branches stay hidden.
- Tapscript. BIP 342 updated Bitcoin's scripting language for use within Taproot and made future upgrades to it easier.
Taproot outputs use a new address format starting with "bc1p", encoded with a variant of the Bech32 scheme.
Activation
Bitcoin has no central authority to switch on upgrades, so activation required coordination among developers, miners and node operators. After earlier disputes over how upgrades should be activated, the community adopted a method called Speedy Trial, in which miners signalled readiness during set periods in 2021. The required threshold of 90 per cent of blocks in a difficulty period was reached in June 2021, locking Taproot in, and its rules became active at block 709,632 on 14 November 2021. The process went smoothly compared with the contentious debates around SegWit.
Effects and uses
Adoption of Taproot by wallets and exchanges was gradual, as each service had to update its software. Its benefits are greatest for complex arrangements: multi-signature custody, the Lightning Network and contracts with time-locked fallbacks can all become cheaper and more private when they use the key path.
Taproot also had an effect few expected. Its relaxed limits on script data were used from early 2023 by the Ordinals protocol to inscribe images, text and other files into Bitcoin transactions, creating Bitcoin NFTs and later fungible token experiments such as BRC-20. Inscriptions led to periods of high demand for block space and higher fees, and to a debate among developers about whether such uses should be discouraged.
Limitations and criticism
Taproot's privacy gains depend on wide use: if only a small share of transactions use Taproot, those that do stand out. Script-path spends still reveal the condition used. Some security researchers noted that Taproot's key-path outputs expose a public key directly, which could matter if quantum computers ever become able to break elliptic curve cryptography, although older address types also expose keys once spent. Others criticized the inscription activity Taproot made possible as a distraction from bitcoin's role as money, while supporters saw it as a sign of a more flexible Bitcoin blockchain. Many later Bitcoin proposals, including ideas for covenants, build on the structure Taproot introduced.