SIGHASH Flags

SIGHASH flags are single-byte codes appended to every Bitcoin signature that tell the network exactly which portions of a transaction that signature commits to. Because a signature can only protect data it covers, the flag determines what a signer endorses and — by omission — what other parties are still free to change after signing. The flag is the final byte of a DER-encoded ECDSA signature, or the optional 65th byte of a Schnorr signature under Taproot. Most users never see them, because wallets sign everything with the default; but every collaborative transaction protocol in Bitcoin is built out of the non-default modes.

The three base modes

SIGHASH_ALL (0x01) is the default: the signature commits to every input and every output, locking the transaction completely so no one can redirect funds, alter amounts, or splice in extra inputs without invalidating the signature. SIGHASH_NONE (0x02) signs the inputs but none of the outputs — effectively a blank cheque, since whoever holds the partially signed transaction can point the funds anywhere; it exists for protocols where outputs are decided later by other participants. SIGHASH_SINGLE (0x03) commits only to the output at the same index as the signed input, ignoring the others — "I authorize my input as long as this specific output stands, and I don't care what else the transaction does." Legacy SIGHASH_SINGLE carries a well-known historical pitfall when an input's index exceeds the output count, one of several sharp edges the newer signing schemes cleaned up.

The ANYONECANPAY modifier

Each base mode can be combined with ANYONECANPAY (0x80), which restricts the input commitment to only the signer's own input, leaving the rest of the input set open. The workhorse combination is ALL|ANYONECANPAY (0x81): "these exact outputs must stand, but anyone may add more inputs." That is the shape of crowdfunding-style transactions — pledgers each sign their contribution toward a fixed set of outputs — and of certain fee-bumping patterns where extra funds join later. The full matrix of uses is covered under SIGHASH_ANYONECANPAY.

Taproot's default

Under Taproot, a 64-byte Schnorr signature with no trailing flag byte implies SIGHASH_DEFAULT (0x00), which behaves identically to SIGHASH_ALL but saves a byte on the most common case — a small, characteristic piece of Bitcoin frugality. An explicit flag byte is appended only when a non-default mode is needed, and it must never be 0x00. Taproot's signature-hash construction also commits to more context than legacy modes did (including the amounts and scripts of all inputs being spent), closing off classes of cross-input trickery and making offline signing safer for hardware wallets.

Why they matter

SIGHASH flags are Bitcoin's built-in vocabulary of partial commitment: they underpin collaborative constructions from payment pools to multisig coordination flows and fee-bumping schemes. For the sovereign user the operational takeaway is simple — a signature means precisely what its flag says, no more. When a device or protocol asks you to sign with anything other than ALL/DEFAULT, understand what you are leaving unsigned, because that is exactly the part someone else can rewrite.