P2TR

Pay to taproot is witness version 1, live since block 709,632 on November 14, 2021, and written as a 62-character address beginning bc1p. A cooperative spend publishes one 64-byte Schnorr signature and costs about 57.5 vbytes per input, the cheapest input on bitcoin. Whatever alternative rules were built into the output stay invisible unless somebody actually uses them.

How it works

A P2TR output is OP_1 followed by a push of 32 bytes, 34 bytes in total, and those bytes are an x-only public key. X-only means the y coordinate is dropped and inferred, which saves a byte against the 33-byte compressed keys used everywhere else.

The key you see is not the key anyone holds. It is an internal key adjusted by a hash of itself and the merkle root of a tree of alternative scripts, so the published value commits to both the cooperative path and every fallback at once. Spending then takes one of two routes. The key path produces a single signature over the tweaked key and reveals nothing else. The script path reveals one leaf of the tree, plus the branch hashes proving that leaf belongs, and leaves the rest of the tree secret forever.

Schnorr signatures under BIP-340 make the key path cheap and private. They are 64 bytes against 71 or 72 for a DER-encoded ECDSA signature, and they add linearly, so several signers can combine their keys and produce one signature under MuSig2. A 2-of-2 arrangement that cooperates ends up indistinguishable from one person paying a bill.

Because witness version 1 requires bech32m, a bc1p address uses the BIP-350 checksum constant rather than the original bech32 one.

Where you see it

Wallets that default to Taproot derive from the BIP-86 branch at m/86'/0'/0'. Bitcoin Core added the encoding in version 22.0 and started generating tr() descriptors for new descriptor wallets in version 23.0.

Inscriptions put arbitrary data into a Taproot script path witness, which is why a large share of bc1p activity has nothing to do with payments. That is an artifact of the discount on witness data rather than a property of the address type.

The friction is at the edges. Some exchanges still reject bc1p withdrawal destinations, and some older payment terminals do too. There is no workaround inside your wallet: use a bc1q address from the same seed, and consolidate later if you want everything under Taproot.

P2TR vs Taproot

Taproot is the upgrade and P2TR is the output type it created. The soft fork bundled three specifications: BIP-340 defined Schnorr signatures, BIP-341 defined the output format and its spending rules, and BIP-342 defined tapscript, the adjusted script language used inside the tree. P2TR is the part you interact with, the address starting bc1p. Saying "I use Taproot" almost always means "my wallet gives me P2TR addresses", but the upgrade also changed how signatures are checked inside scripts you may never touch.