Taproot (BIP341)

Taproot, defined in BIP341 and activated at block 709,632 in November 2021, is the soft fork that gave Bitcoin a new output type called Pay-to-Taproot (P2TR). It combines Schnorr signatures with Merkelized script trees so that a single 32-byte public key in the output can represent either one signer or an arbitrarily complex set of spending rules.

Two ways to spend

Every P2TR output supports two paths. The key path is a plain Schnorr signature over the output's public key, indistinguishable from any single-signer payment. The script path reveals one branch of a hidden script tree and the inputs that satisfy it. Crucially, only the branch actually used becomes public; every other condition stays private forever. A wallet using multisig, timelocks, or vault logic can therefore cooperatively spend via the key path and leak nothing about its underlying policy.

Why it matters for sovereignty

Before Taproot, a 2-of-3 multisig or a complex covenant was visible on-chain and cost more to spend. Taproot makes a cooperatively-signed multisig look like a single ordinary payment, improving both privacy and fees. This is the foundation that schemes like MuSig2 build on. The trade-off is that the script-path branch carries a control block and is slightly heavier than a key-path spend when it must be revealed.

Taproot leans on the same elliptic-curve mathematics covered in our entries on MuSig2 (BIP327) and HASH160. For a deeper look at how spending policies stay private until they are exercised, see the related cryptographic primitives in this glossary.