Taproot

Three specifications shipped together: BIP-340 for Schnorr signatures, BIP-341 for the output type, and BIP-342 for the adjusted script language. Activation happened at block 709,632 on November 14, 2021, four years after the previous upgrade. The practical effect is that complicated arrangements, multisig vaults, escrows, channel closes, can settle looking like anybody else's payment.

How it works

The design starts from an observation about how contracts actually end: almost all of them end in agreement.

A Taproot output commits to two things at once inside a single 32 byte value. One is a public key, held by whoever the cooperative parties are. The other is a merkle tree whose leaves are alternative scripts, the fallbacks that apply when cooperation fails. The published key is the cooperative key adjusted by a hash of itself and the root of that tree, which means the output commits to every fallback without revealing that any exist.

Spending then takes one of two paths. The key path produces a single signature and publishes nothing about the tree, so the transaction is indistinguishable from a one person payment. The script path reveals exactly one leaf plus the sibling hashes needed to prove it belongs to the committed root, and every other branch stays secret permanently. A vault with a two of three quorum, a time delayed recovery key, and an emergency clause exposes only the clause that was used.

BIP-342 adjusted the script language for those leaves. OP_CHECKMULTISIG is unavailable inside a Taproot leaf and OP_CHECKSIGADD replaces it, counting successful signatures on the stack instead of consuming a batch at once, which lets threshold checks be written without the old awkwardness. The 10,000 byte script size cap and the 201 opcode limit are gone, replaced by a signature operations budget that scales with the size of the witness. Unknown public key types and unknown leaf versions are defined as valid, leaving room for the next upgrade without another address format.

Because Taproot occupies witness version 1, its addresses use the bech32m checksum from BIP-350 rather than the original bech32 one. That is why software can accept bc1q and still reject bc1p.

Why this matters when you buy bitcoin

The privacy argument is the one that applies to almost everybody, including people who will never write a script.

Every previous way of protecting bitcoin advertised itself. A 2-of-3 multisig deposit was legible on-chain as a 2-of-3 multisig deposit, which told chain analysis firms, and anyone who bought data from them, that the address belonged to somebody holding enough to bother. A cooperative Taproot spend from the same setup publishes one signature against one key. The security is unchanged and the signal is gone.

Cost moves in the same direction. A Taproot key path input is the cheapest input type on bitcoin, and the gap widens as the arrangement grows more complicated, because the fallback branches you never use cost nothing. For anyone building the kind of inheritance or multisig setup our hardware wallet reviews describe, that changes the math on how many keys are worth having.

The friction is real and worth planning around. Some exchanges still refuse bc1p as a withdrawal destination, and older hardware wallet firmware may not derive Taproot addresses at all. The workaround is boring: receive to a bc1q address from the same seed phrase, and move to Taproot when your whole stack supports it. Nothing is lost by waiting, since both address types come from one backup.

One honest note on the side effects. Taproot's cheap witness data is what made inscriptions economical, and the resulting demand pushed fee rates to levels ordinary payments had not seen for years. That was a consequence of the discount rather than a goal of the design, and it is a fair thing to hold against it.

Speedy Trial, the compromise that got Taproot activated

The code was uncontroversial by early 2021 and the activation method almost sank it anyway.

The argument was over BIP-8 and its lockinontimeout flag. One camp wanted LOT set to true, forcing activation at the timeout whether or not miners signaled, on the principle that 2017 had shown miners could stall indefinitely. The other wanted false, on the principle that a forced activation with weak support risks the split it is trying to avoid. Neither side moved for months.

Speedy Trial ended the deadlock by making the question smaller. It kept the version bits counting of BIP-9, lowered the threshold to 1,815 of 2,016 blocks, opened a window of roughly three months, and set a fixed minimum activation height of 709,632 so lock-in and enforcement were separated by a long, predictable gap. If miners signaled, the fork happened on a known date. If they did not, the attempt expired quickly and the harder argument could resume with nothing lost.

The code shipped in Bitcoin Core 0.21.1 on May 1, 2021. Miners cleared the threshold in the difficulty period ending on June 12, 2021, giving the network five months of advance notice before the rules changed. It remains the only activation method bitcoin has used that was designed primarily to fail cheaply.

Taproot vs Schnorr signatures

Taproot is the package; Schnorr signatures are one part of it. BIP-340 defines a signature scheme that has existed in cryptography since the 1980s and could in principle be used anywhere, while BIP-341 defines what a bitcoin output looks like and BIP-342 defines what runs inside one. On bitcoin the three are inseparable in practice, because a BIP-340 signature is only valid in a witness version 1 spend, but they are separate documents solving separate problems, and the key aggregation people find most interesting is a property of the signature scheme rather than of Taproot itself.