Witness script

SegWit gave scripts their own section of the transaction, and the witness script is what lands there when a bc1q vault is spent. Every byte inside the witness counts as one weight unit rather than four, a 75 percent discount that arrived at block 481,824 in August 2017. That discount is why multisig custody stopped being expensive.

How it works

The witness script is committed to by a plain SHA-256 hash sitting in the output, and it stays secret until the day someone spends. A spender fills the witness stack with the arguments the conditions require, then appends the serialized script as the final item. A node hashes that item, checks the 32 bytes against the commitment, and executes what it just verified.

Consensus applies the same script ceilings that legacy spends have: 10,000 bytes of script and 201 working instructions. Relay policy stops far short, at 3,600 bytes with no more than 100 items on the stack, so anything larger needs a direct arrangement with a miner rather than ordinary broadcast.

The arithmetic is what changed behaviour. A 2-of-2 script is 71 bytes: two pushes of 33-byte public keys, the two count opcodes and the verification opcode. Inside a witness those 71 bytes cost 71 weight units, under 18 virtual bytes. The identical 71 bytes carried the old way, in a signature script, cost 284 weight units, or 71 virtual bytes. Nothing about the security changed, only the price of using it.

Where you see it

Lightning runs on witness scripts. Every channel is funded into a 2-of-2 output, and the commitment transactions inside a channel are built from a small library of scripts for revocation and hash-locked payments specified in BOLT 3, which means most of them are created and destroyed without ever reaching the chain.

Signing hardware sees them as a named field. The PSBT format defines a witness script slot on both inputs and outputs, so a coordinator can hand a cosigner the exact conditions being satisfied and the device can show the user what it is agreeing to rather than a hash.

You also see them wrapped. A nested P2SH-P2WSH address, common on exchanges that never updated their withdrawal screens, carries a 34-byte redeem script whose only job is to point at the witness program, with the witness script underneath doing the real work.

Backups need the script bytes, not merely the keys. Store the output descriptor alongside every seed, because a witness script that nobody wrote down turns a fully signed quorum into coins that no one can move.

Witness script vs Tapscript

A witness script is a single script that is revealed in full; a tapscript leaf is one branch of a tree where only the branch you use is ever published. Under BIP-341 an output commits to a merkle root over many leaves, so a vault with five separate recovery paths shows exactly one of them at spend time and keeps the other four private forever. Tapscript also drops the 10,000-byte limit, disables OP_CHECKMULTISIG in favour of the batch-friendly OP_CHECKSIGADD, and applies a weight budget for signature checks instead of a fixed instruction count. If your wallet writes bc1q, you are using witness scripts; bc1p means the Taproot design instead.