P2TR (Pay to Taproot)

P2TR (Pay to Taproot) is the output type activated by the 2021 Taproot soft fork. It is witness version 1, encoded in Bech32m, and its addresses always begin with bc1p. The scriptPubKey is simply OP_1 followed by a 32-byte x-only public key. That single point is deceptively powerful: it can commit simultaneously to an ordinary signing key and to a hidden tree of alternative spending scripts, so one uniform-looking output can carry arbitrarily rich conditions.

Two ways to spend

A key-path spend reveals only one Schnorr signature against the tweaked output key — indistinguishable on-chain from any other Taproot key-path spend, whether it guards a single-sig wallet or an aggregated multiparty key. A script-path spend instead reveals one leaf of the committed script tree plus a control block proving that leaf's membership, leaving every unused branch permanently private. A simple payment and a complex vault with timelocked recovery clauses look identical until — and unless — the exotic path is actually used. The mechanics of choosing between them are covered under key-path vs script-path spend.

What Schnorr buys

The move from ECDSA to Schnorr signatures is what makes the design sing. Schnorr signatures are linear, so multiple signers can aggregate into a single key and a single 64-byte signature: an n-of-n multisig presents on-chain as one ordinary key-path spend. That shrinks fees, but the deeper win is privacy through uniformity — the anonymity set of a Taproot key-path spend includes every other Taproot key-path spend, cooperative multiparty closes included. The script tree (a Merkelized structure often described as MAST) extends the same principle to contracts: commit to many branches, reveal only the one you use.

Encoding and practical details

P2TR addresses use Bech32m, a deliberate variant of Bech32 that fixed a checksum weakness affecting witness versions beyond 0 — which is why a bc1q address and a bc1p address are not interchangeable even though they look like siblings. Spends benefit from the witness discount, key-path inputs are among the cheapest to spend on the network, and signature verification batches efficiently for nodes. Wallet and exchange support, patchy in the first years after activation, is now broadly mainstream, though anyone publishing a static address should still expect the occasional legacy service that cannot send to bc1p.

Why it matters for sovereignty

For operators building collaborative custody, inheritance plans, or covenant-style conditions, P2TR is the cheapest and most private base layer available: complex protection without a complex on-chain footprint. A family multisig, a business treasury with recovery timelocks, and a plain hodl wallet all blend into the same crowd. That uniformity is a public good — every key-path spend strengthens everyone else's privacy — and a quiet expression of the decentralization ethos: the chain records that value moved, not how your security is architected. For the underlying upgrade see Taproot and the specification at BIP341.

For miners, Taproot outputs are just transactions — the soft fork changed validation rules, not the mining process — but P2TR still shows up on the operations side: modern wallets and coordination tools increasingly default to it for payout addresses, and pool payouts to bc1p destinations are routine. Sending support is the item to verify when dealing with older infrastructure; a service that cannot pay a bc1p address in 2026 is advertising deferred maintenance. For anyone structuring self-custody today, the pragmatic default is straightforward: use Taproot for new single-sig wallets to blend into the largest uniform crowd, evaluate it for multisig once your tooling supports the aggregation flows properly, and remember that the privacy benefit is collective — every ordinary key-path spend makes the sophisticated ones harder to distinguish, which is the rare upgrade where self-interest and public good point the same direction.

See on-chain adoption context in the live network vitals.