Opcode

Bitcoin Script has a fixed vocabulary of 256 possible byte values, split between opcodes that push literal data and opcodes that act on the data already pushed. A legacy script may run at most 201 acting opcodes and cannot exceed 10,000 bytes. For anyone buying bitcoin, that small vocabulary is why a wallet can quote a fee before broadcasting, and why bitcoin offers no surface for runaway contract bugs.

How it works

A validating node reads a script one byte at a time and looks each byte up in a fixed table. Values 0x01 through 0x4b are not instructions at all: each one says that the next N bytes are literal data and belong on the stack, which is why a 33-byte compressed public key appears in a script as 0x21 followed by the key itself. Three further push codes, OP_PUSHDATA1, OP_PUSHDATA2 and OP_PUSHDATA4, cover longer items, and the values 0x51 to 0x60 push the small integers 1 to 16 that show up in quorum counts.

Everything above 0x60 does work rather than carrying data, and those are the ones bitcoin counts. A pre-Taproot script may contain at most 201 of them, hold no stack element larger than 520 bytes, keep no more than 1,000 items on its stacks, and run to no more than 10,000 bytes in total. All four figures come out of script.h in Bitcoin Core, and all four are consensus rules rather than preferences a node operator can loosen.

Fifteen opcodes are listed in the table but dead. OP_CAT, OP_MUL, OP_LSHIFT and twelve others were switched off in 2010 after a crash bug, and a script that merely contains one of them fails, even inside a branch that never executes. None has ever been re-enabled. That single decision is the largest reason bitcoin's scripting is narrower than the word "programmable" leads people to expect.

Tapscript rewrote the bookkeeping for Taproot spends. BIP-342, live since block 709,632 in November 2021, dropped both the 201-instruction ceiling and the 10,000-byte size cap, and replaced them with a signature budget: the transaction must carry 50 weight units for every signature the script checks. It also turned a block of undefined byte values into OP_SUCCESS codes, so a script containing one is valid without being executed at all. That is deliberate room left for future upgrades.

Why this matters when you buy bitcoin

Opcodes decide what your withdrawal costs. A legacy output spells out four working instructions around a 20-byte hash in 25 bytes; the native SegWit equivalent is a version byte and a push, 22 bytes; a Taproot output is 34. Because SegWit moved the unlocking side into the witness at a quarter of the weight, spending a bech32 output takes roughly 68 virtual bytes against roughly 148 for the legacy version of the same payment. Picking bech32 or bech32m at withdrawal time, wherever the exchange offers it, is close to the cheapest decision in this glossary.

Opcodes also decide what your signing device can actually handle. A hardware wallet that only recognises the standard single-key templates cannot cosign a timelocked vault or an unusual policy, so if inheritance planning or multisig is anywhere in your plans, check script support in the reviews before you buy the device rather than after the coins are already on it.

The narrowness is a safety property, not a shortcoming. There are no loops, no way to read another transaction, and no state that persists between spends, so the failure mode that has drained billions of dollars from programmable chains, a contract behaving correctly on inputs its author never considered, has nowhere to occur. Bitcoin losses come from exchanges, phishing and lost backups, not from the script engine misfiring.

Worked example: the day OP_NOP2 grew teeth

OP_NOP2 was byte 0xb1 and it did nothing whatsoever, one of ten numbered no-ops left in the table for later use. BIP-65 gave it a job: confirm that the transaction's locktime has passed, and fail the script if it has not. Enforcement began at block 388,381 on December 14, 2015, and the opcode has been called OP_CHECKLOCKTIMEVERIFY ever since.

The trick is that old software still saw a byte that does nothing, so it still accepted the new transactions as valid. Only upgraded nodes enforced the timelock. That asymmetry is what makes a soft fork soft, and the same route turned OP_NOP3 into OP_CHECKSEQUENCEVERIFY at block 419,328 in July 2016. Eight reserved no-op slots are left, which is most of bitcoin's remaining upgrade room under the pre-Taproot rules and a large part of why so much design attention has moved to the OP_SUCCESS values Tapscript created.

Opcode vs Bitcoin Script

Bitcoin Script is the language and an opcode is one word of its vocabulary. The distinction matters when you read claims about what bitcoin can or cannot do, because nearly every serious proposal of the last decade has been a proposal to define one new opcode, not to change the language around it. OP_CHECKTEMPLATEVERIFY, OP_CAT and OP_CHECKSIGADD are each a single byte with a single job, and public arguments about covenants or vaults are arguments about whether one specific byte should be allowed to mean something. The stack, the limits and the absence of loops stay exactly as they are when a new opcode arrives.