Manage your Bitcoin and other cryptocurrencies securely with the self-custody Bitcoin.com Wallet app.
What is Bitcoin Taproot?
Bitcoin Taproot is a protocol upgrade activated in November 2021 that improved Bitcoin’s privacy, lowered fees for complex transactions, and gave developers a more flexible scripting environment. It was Bitcoin’s first major upgrade since SegWit in 2017 and bundled three Bitcoin Improvement Proposals: Schnorr signatures (BIP 340), the Taproot output type (BIP 341), and a new scripting language called Tapscript (BIP 342). Taproot addresses begin with `bc1p` and are technically called Pay-to-Taproot, or P2TR.
Taproot’s real impact turned out very different from its original pitch. The same upgrade designed to make multisig wallets and Lightning channels more efficient also accidentally enabled Ordinals, Inscriptions, BRC-20 tokens, and Runes, sparking a wave of activity that dominated Bitcoin block space for nearly two years. This guide covers what Taproot actually is, how its three pieces work, and why its real-world story diverged so sharply from the plan.
Origins of Taproot
Taproot was first proposed in January 2018 by Gregory Maxwell, one of Bitcoin’s earliest and most prolific protocol contributors. The core idea, using a cryptographic trick to make complex transactions indistinguishable from simple ones, was not new in the abstract. But Maxwell’s specific construction made it practical to deploy on Bitcoin without breaking compatibility with older nodes.
The proposal then went through more than three years of review, refinement, and debate. The cryptography was scrutinized, alternative designs were considered, and the community wrestled with how exactly to activate the upgrade without repeating the contentious activation fight that surrounded SegWit in 2017. The eventual answer was Speedy Trial, a time-boxed activation mechanism that gave miners a three-month window to signal readiness. They reached the required 90% threshold in June 2021, and Taproot locked in for activation later that year.
That Taproot took years of careful work and shipped without drama is itself a story about how Bitcoin upgrades. Changes to the base protocol are deliberately slow and conservative because once they are deployed, billions of dollars of value depend on them behaving correctly forever.
The Three Pieces of Taproot
Taproot is best understood by looking at its three component proposals one at a time. Each does something distinct, and they were designed to work together. The full specifications are published in the Bitcoin Improvement Proposals repository.
BIPComponentFunction340Schnorr SignaturesReplaces ECDSA with a linear signature scheme that supports key and signature aggregation341Pay-to-Taproot (P2TR)Defines the new output type and `bc1p` address format, with both key-path and script-path spending342TapscriptUpdates Bitcoin Script for use inside Taproot script paths, with cleaner rules and Schnorr supportBIP340ComponentSchnorr SignaturesFunctionReplaces ECDSA with a linear signature scheme that supports key and signature aggregationBIP341ComponentPay-to-Taproot (P2TR)FunctionDefines the new output type and `bc1p` address format, with both key-path and script-path spendingBIP342ComponentTapscriptFunctionUpdates Bitcoin Script for use inside Taproot script paths, with cleaner rules and Schnorr support
BIP 340: Schnorr Signatures
Every Bitcoin transaction needs a digital signature to prove that the spender is authorized to move the coins. From its launch in 2009 until Taproot, Bitcoin used a signature scheme called ECDSA, the Elliptic Curve Digital Signature Algorithm. ECDSA works fine, but it has an awkward mathematical property: signatures are not linear, meaning you cannot easily combine multiple signatures into one.
Schnorr signatures, introduced in BIP 340, are linear. That single property unlocks several practical benefits.
The most important is key aggregation. If three people are co-signing a transaction (a 3-of-3 multisignature spend, for example), Schnorr lets them produce one combined signature using one combined public key. From the outside, the transaction looks identical to a single-signer payment. The blockchain stores less data, the parties pay lower fees, and anyone watching the chain learns nothing about the multisig arrangement.
Schnorr signatures are also slightly smaller than ECDSA signatures and support efficient batch verification, which helps full nodes process blocks faster. The cryptographic security assumptions are essentially the same as ECDSA. Both schemes rely on the difficulty of the elliptic curve discrete logarithm problem on the secp256k1 curve.
BIP 341: Taproot (P2TR)
BIP 341 defines the new output type itself: Pay-to-Taproot, or P2TR. This is what creates the bc1p-prefixed addresses you may have seen.
The core idea behind P2TR is that every Taproot output commits to two ways of being spent at the same time:
- Key Path. The owner can simply produce a Schnorr signature with the right key and spend the coins, just like a normal payment.
- Script Path. A hidden tree of alternative spending conditions, any of which can be revealed and used to spend the output instead.
This tree of alternative scripts is built using a structure called a Merklized Alternative Script Tree, or MAST. A MAST lets a transaction commit to many possible spending conditions (multisig fallbacks, timelocks, hash locks, dispute-resolution branches) without putting any of them on-chain unless they are actually used. Only the specific branch that gets exercised is revealed, along with a small cryptographic proof that it was part of the original commitment. Every unused branch costs nothing in block space and leaks no information.
Combined with Schnorr key aggregation, this means the overwhelming majority of Taproot spends, even very complex ones, appear on the blockchain as plain key-path spends. A 2-of-3 multisig wallet, a Lightning channel cooperative close, a vault with timelocked recovery paths, and an everyday personal payment can all look exactly the same.
BIP 342: Tapscript
The third proposal, BIP 342, modernizes Bitcoin’s scripting language for use inside Taproot script paths. The result is called Tapscript.
Tapscript is not a brand-new language. It is a cleaned-up version of existing Bitcoin Script with several legacy quirks removed and several modest improvements added:
- Signature operations now validate Schnorr signatures rather than ECDSA
- Rigid script size limits inherited from earlier soft forks are relaxed
- A new opcode, OP_CHECKSIGADD, makes batch-friendly multisig verification more efficient
- A new signature hashing algorithm covers more transaction data, closing off some classes of subtle signing attacks
Tapscript is what gives Taproot its forward-looking flexibility. Future soft forks can extend it with new opcodes and features without disturbing existing Taproot outputs.
Taproot vs SegWit: How They Compare
SegWit and Taproot are often grouped together as Bitcoin’s two most important modern upgrades, but they were designed to solve different problems. SegWit, activated in 2017, focused on fixing transaction malleability and effectively expanding block capacity. Taproot, four years later, focused on privacy and scripting flexibility. The two upgrades complement each other rather than overlap.
FeatureSegWit (2017)Taproot (2021)ActivationAugust 2017, block 481,824November 2021, block 709,632Address prefixbc1qbc1pMain FocusBlock capacity, malleability fixPrivacy, scripting flexibilitySignatureECDSASchnorrMultisig appearanceVisible on-chainIndistinguishable from single-sigActivationUASF / BIP 9 SignalingSpeedy Trial / BIP 8FeatureActivationSegWit (2017)August 2017, block 481,824Taproot (2021)November 2021, block 709,632FeatureAddress prefixSegWit (2017)bc1qTaproot (2021)bc1pFeatureMain FocusSegWit (2017)Block capacity, malleability fixTaproot (2021)Privacy, scripting flexibilityFeatureSignatureSegWit (2017)ECDSATaproot (2021)SchnorrFeatureMultisig appearanceSegWit (2017)Visible on-chainTaproot (2021)Indistinguishable from single-sigFeatureActivationSegWit (2017)UASF / BIP 9 SignalingTaproot (2021)Speedy Trial / BIP 8
Taproot is technically a SegWit version 1 output, which is why both upgrades use the bc1 prefix. The difference is the character that follows: q for SegWit v0 and p for Taproot.
What Taproot Was Supposed to Improve
The pitch for Taproot, in the years leading up to activation, focused on three concrete benefits:
- Privacy. Because Schnorr aggregation and MAST make almost every spend look like an ordinary single-signature payment, chain analysis tools have a much harder time identifying multisig wallets, Lightning channels, and other complex setups by their on-chain fingerprints. The privacy benefit grows as more users adopt Taproot, since the anonymity set of “transactions that look like simple payments” expands.
- Lower fees for complex transactions. Bitcoin transaction fees are paid per byte. Schnorr signatures are slightly smaller than ECDSA signatures, key aggregation collapses many signatures into one, and MAST keeps unused script branches off-chain entirely. For a typical multisignature wallet, the savings can run to roughly a quarter of the previous on-chain footprint.
- Better infrastructure for second-layer protocols. The Lightning Network in particular was expected to benefit from Schnorr through a feature called Point Time-Locked Contracts, or PTLCs. PTLCs replace the hash-locked routing currently used in Lightning with a scheme that decorrelates payments across hops, improving privacy for routed payments. Channel factories, eltoo-style channel updates, and Discreet Log Contracts all benefit from Schnorr’s linearity as well.
These were the expected wins. They are real, and they are gradually showing up. But they are not the story most people remember from the years right after activation.
How Ordinals and Inscriptions Repurposed Taproot
In December 2022, a software engineer named Casey Rodarmor used Taproot’s relaxed script limits to do something unintended. He embedded an image directly into a Bitcoin transaction’s witness data. He called the protocol Ordinals, and the embedded data Inscriptions. The first inscription went on-chain on December 14, 2022, and the protocol launched publicly in January 2023.
Inscriptions worked because Taproot had quietly removed the strict size cap on individual scripts inside a MAST leaf. That meant a Taproot witness could carry kilobytes, eventually megabytes, of arbitrary content: images, text, audio clips, even small video files. Inscribed data was then numbered using a scheme that tracked individual satoshis through the chain, giving each inscription a stable identity. The result, in practice, was non-fungible tokens on Bitcoin.
The protocols built on top of Ordinals expanded rapidly. Within months, an anonymous developer known as Domo released BRC-20, a fungible token standard that runs on the inscription protocol. In April 2024, Rodarmor launched Runes, a more efficient fungible token protocol designed specifically for Bitcoin block space. At various points across 2023 and 2024, these protocols pushed Bitcoin transaction fees to multi-year highs and drove Taproot transaction utilization up alongside them. According to Glassnode data, Taproot adoption climbed from around 1% in early 2023 to peaks above 40% during 2024 before settling lower as inscription activity cooled.
This was not what Taproot was designed for. Many Bitcoin developers had mixed feelings about watching the upgrade’s most visible use case turn out to be NFTs and tokens rather than the privacy and Lightning improvements they had spent years building. But the same flexibility that lets inscriptions exist is what makes Taproot useful for everything else, and the episode showed how infrastructure upgrades can produce uses far beyond what they were designed for.
Adoption in 2026
Adoption numbers for Taproot vary depending on what exactly you measure (addresses receiving funds, transactions with at least one Taproot input, or share of total transaction outputs), and different dashboards report different figures. The general picture, as of April 2026, is that Taproot accounts for roughly a fifth of Bitcoin transaction activity by most measures. That is down from highs reached during the inscription boom but well above where it sat for the first year after activation.
The slow ramp follows the same pattern SegWit took before it. Wallet developers, exchanges, and custodians all upgrade on their own schedules, and many users never deliberately choose an address type. They simply use whatever their wallet generates. Major exchanges including Binance, Coinbase, Kraken, and OKX now support sending to Taproot addresses, but full native Taproot support across the broader ecosystem is still arriving.
There is one ongoing source of caution. Schnorr signatures, like ECDSA, rely on elliptic-curve cryptography that is theoretically vulnerable to a sufficiently powerful quantum computer running Shor’s algorithm. Taproot does not make Bitcoin more vulnerable to quantum attacks than legacy address types since they all use the same secp256k1 curve. However, Taproot addresses do reveal a public key directly on-chain at the time the output is created, whereas legacy and SegWit v0 addresses only reveal the public key when the output is spent. A draft proposal called BIP-360 has been under active discussion as a path toward post-quantum signature options, though no upgrade is imminent.
What Taproot Unlocks Going Forward
Several Taproot use cases are still being built. Three areas are worth watching:
- Lightning Network upgrades. PTLC routing and Schnorr-based channel constructions are gradually rolling out across Lightning implementations, improving payment privacy and enabling more sophisticated channel structures.
- Taproot Assets. Originally announced as Taro by Lightning Labs and renamed in 2023, Taproot Assets is a protocol for issuing fungible and non-fungible assets on Bitcoin using Taproot’s commitment structure, with the ability to transfer those assets over Lightning. It is a very different design philosophy from Ordinals and Runes, optimized for stablecoins and other financial instruments rather than collectibles.
- Vaults and advanced custody. Taproot’s MAST structure makes it practical to build Bitcoin vaults, wallets where withdrawals require time delays, where compromised keys can be revoked, and where multiple recovery paths can coexist without paying for them on-chain unless they are used. This is particularly relevant for institutional custody and for self-custody setups that need to balance security with usability.
Conclusion
Taproot is one of the most important upgrades in Bitcoin’s history. It made signatures more efficient, made complex transactions look like simple ones, and gave developers a more flexible foundation to build on. It also, almost by accident, opened the door to non-monetary uses of the Bitcoin blockchain that fell well outside its original design scope.
For everyday users, the practical upshot is straightforward. Taproot addresses are cheaper to spend from in many situations, more private when used with multisig or Lightning, and increasingly the default in newer wallets. For developers, Taproot is the foundation that most serious Bitcoin protocol work is now being built on. And for the protocol itself, it stands as a reminder that careful, conservative upgrades to base-layer infrastructure can produce effects far outside what their designers planned for.
