Transaction output

Two fields make one: an eight-byte amount in satoshis, and a script stating the condition for spending it. The address you paste into a withdrawal form is nothing more than that script in a human-readable encoding, which is why choosing bech32 over an older format is really a choice about the lock your coins will sit behind. Outputs are cheap to create and expensive to unlock later.

How it works

An output is a small record with no owner named anywhere in it.

The value field is 8 bytes, holding a whole number of satoshis. Sixty-four bits is generous for a currency capped near 2,100,000,000,000,000 satoshis, and using integers rather than decimals is why bitcoin accounting has no rounding errors. Then comes a length prefix and the locking script, called scriptPubKey in the source, which is a short program that a future spender must satisfy.

Different scripts produce different sizes and different costs. A pay-to-public-key-hash lock is 25 bytes of script, making the whole output 34 bytes. A native SegWit lock is 22 bytes, making the output 31 bytes. A Taproot lock is 34 bytes of script and 43 bytes in total. The address encodings you recognise map straight onto these: a leading 1, a bc1q, a bc1p.

The word "lock" is more accurate than "owner". The script does not record a person. It records a test, and anyone who can pass the test can spend the coin, which is the whole reason a private key has to be protected rather than merely a login.

Two more properties matter. Outputs are numbered by position, starting at zero, so the second output of a transaction is index 1. And an output below the dust threshold, roughly 546 satoshis for a legacy lock and 294 for a native SegWit one, will not be relayed by default, because it would cost more to spend than it holds.

Where you see it

Outputs are the right-hand column of every block explorer page, and there are almost always two of them on a spend.

One is the payment and one is the change, and nothing in the transaction says which is which. That guess is the raw material of blockchain analysis, and it is why a wallet that reuses its change address is easier to follow than one that does not.

Outputs are also the network's memory. Every full node keeps a database of all unspent outputs, because that set is exactly what a new transaction must be checked against. An output you create sits in that database on tens of thousands of machines until somebody spends it. Making many tiny outputs is therefore mildly antisocial as well as expensive, and consolidating them is a courtesy as much as a saving.

The one exception is deliberately unspendable. An OP_RETURN output carries data and can never be redeemed, so nodes drop it from the unspent set immediately rather than storing it forever.

For anyone buying bitcoin, the practical version is short. Withdraw to an address format your future self will be glad of, prefer fewer larger withdrawals over many small ones, and remember that the balance your wallet shows is just the sum of the outputs currently locked to keys it controls.

Transaction output vs UTXO

An output is a record; a UTXO is a status that record holds only while nobody has spent it. Every output ever created is written into a block permanently and can be read there years later, but the moment a later transaction references it, it stops being unspent and leaves the set that nodes track. So every UTXO is an output, while most outputs are no longer UTXOs. The distinction has a practical edge: your wallet balance is the sum of your UTXOs, not the sum of everything ever paid to your addresses, and a block explorer showing a large total received on an address is describing history rather than money you still have.