P2WPKH

Native SegWit single-key outputs are written as 42-character bc1q addresses. The locking script is 22 bytes, and spending one input takes about 68 vbytes against about 148 for the legacy equivalent. Bitcoin Core has handed out this format by default since version 0.20.0, and most other wallets followed.

How it works

A P2WPKH output carries no opcodes in the usual sense. It is the byte 0x00, marking witness version 0, followed by a push of the 20-byte HASH160 of your compressed public key: 22 bytes, recognized by nodes as a witness program rather than executed as a script. The input that spends it leaves its scriptSig completely empty and puts two items in the witness field, the signature and the key.

The saving comes from how blocks are measured. BIP-141 defines block weight as the base size multiplied by three plus the total size, capped at 4,000,000 weight units, which works out to non-witness bytes costing four units each and witness bytes costing one. A P2WPKH input has 41 non-witness bytes weighing 164 units and about 108 witness bytes weighing 108, for 272 units in total. Divide by four and you get the 68 vbytes you actually pay for.

Two secondary effects matter as much as the discount. BIP-143 replaced the signature hashing algorithm so that the work of signing grows linearly with the number of inputs rather than quadratically, which is why a hardware wallet gets through a large SegWit transaction quickly. And because the transaction identifier no longer covers the witness, a third party can no longer alter a signature in flight to change the txid.

Where you see it

Open almost any wallet released in the last several years and the receive screen shows a bc1q string. Wallets derive those from the BIP-84 branch, path m/84'/0'/0', which SLIP-132 pairs with the zpub extended key prefix, so a backup restored into different software lands on the same addresses.

At this point essentially every exchange withdrawal form accepts bc1q. If one refuses, it is running validation code written before 2017, and the practical answer is to withdraw to a format it does accept and move the coins onward yourself.

One thing bc1q does not tell you is what the output pays to. A 42-character bc1q address is a single key; a 62-character one is a script. Both are witness version 0 and both use bech32, so the length is the only visible difference.

P2WPKH vs Nested SegWit

P2WPKH and nested SegWit spend the same key and commit to the same 20-byte hash. The difference is a wrapper. Nested SegWit puts that 22-byte witness program inside a P2SH output so the address can be a Base58 string beginning with 3, and the 23 extra non-witness bytes in the spending input weigh 92 units, which is exactly the gap between 91 vbytes and 68. Security is identical. You give up roughly a third of the available fee saving in exchange for an address that ancient software will accept.