Nested SegWit (P2SH-P2WPKH)

Nested SegWit, formally P2SH-P2WPKH, embeds a native SegWit output inside a Pay-to-Script-Hash wrapper. The result is an address that begins with 3 on mainnet and is encoded in Base58Check just like any other P2SH address, so older wallets and services that cannot read Bech32 can still send to it. It was the transition format that let the ecosystem adopt SegWit before Bech32 support became universal.

How the wrapping works

The on-chain scriptPubKey is an ordinary P2SH lock: OP_HASH160 <scriptHash> OP_EQUAL. The redeem script it commits to is the native witness program (OP_0 <20-byte pubKeyHash>). At spend time the witness program is provided in the scriptSig, while the signature and public key live in the discounted witness field, so the spender still captures most of SegWit's fee savings.

When to use it

Nested SegWit costs slightly more than native P2WPKH because the redeem script must be revealed in the input, adding bytes outside the witness discount. Its only advantage is compatibility, so once your counterparties recognize Bech32 there is little reason to keep using it. Self-custody operators auditing wallets should know that a type-3 address may be either a multisig P2SH or a nested SegWit single-sig.

See Pay-to-Script-Hash (P2SH) for the wrapper mechanism and P2WPKH (Native SegWit) for the cheaper native form.