Taproot is Bitcoin’s most significant protocol upgrade since SegWit, activated in November 2021 at block 709,632. It bundled three Bitcoin Improvement Proposals (BIPs 340, 341, and 342) into a single soft fork that introduced a new signature scheme, a smarter way to handle complex transactions, and a new script structure that laid the groundwork for innovations like Ordinals and inscriptions.
What Taproot Actually Changes
At its core, Taproot redesigns how Bitcoin transactions are signed and how spending conditions are stored on the blockchain. Before Taproot, every transaction publicly revealed all of its spending rules, even the ones that were never used. A multisignature wallet requiring three of five keyholders, for example, would expose all five public keys and the full script logic on the blockchain whenever coins moved. Taproot fixes this by letting the most common spending path look identical to a simple, single-signature payment.
The upgrade rests on three technical pillars: Schnorr signatures, Merklized Alternative Script Trees (MAST), and a new scripting language called Tapscript. Each solves a different problem, but they work together to make Bitcoin transactions smaller, cheaper, and more private.
Schnorr Signatures
Bitcoin originally used ECDSA (Elliptic Curve Digital Signature Algorithm) for transaction signatures. Taproot replaced it with Schnorr signatures for anyone using the new transaction format. Schnorr signatures are about 11% smaller than ECDSA signatures, which directly reduces the data each transaction puts on the blockchain and therefore the fee you pay.
The bigger advantage is key aggregation. With ECDSA, a multisig transaction involving five participants needed five separate public keys and five separate signatures recorded on-chain. Schnorr lets those five participants combine their keys into a single aggregated public key and produce one combined signature. On the blockchain, this looks exactly like a transaction from a single person sending bitcoin. The verification algorithm is also linear, meaning that validating a batch of Schnorr signatures takes proportionally less computational effort than checking each one individually. This makes the entire network faster at processing blocks.
Merklized Alternative Script Trees
MAST (sometimes called “Taptree” in Taproot’s implementation) changes how complex spending conditions are organized. Think of a Bitcoin transaction that could be spent in multiple ways: maybe it can be claimed by three partners agreeing together, or by one partner after a six-month timelock, or by a backup key in an emergency. Before Taproot, all of those conditions had to be published on-chain when the coins were spent, regardless of which path was actually used.
MAST structures these alternative spending paths as a binary Merkle tree. Each possible spending condition sits in a leaf node of the tree, and only the leaf that gets used is ever revealed on the blockchain. The other conditions stay hidden. This means a contract with dozens of possible outcomes only exposes one outcome’s script when it executes. The rest remain private.
The tree doesn’t have to be balanced, either. You can structure it so the most likely spending paths sit closer to the root, making them cheaper to reveal. Less common paths sit deeper in the tree, costing slightly more in fees if used but saving space in the typical case. This lets developers optimize transaction costs around real-world usage patterns.
How Taproot Improves Privacy
The privacy gain comes from combining Schnorr and MAST. When all parties in a complex contract agree on the outcome (the “key path” spend), they produce a single aggregated Schnorr signature. On the blockchain, this transaction is indistinguishable from someone sending bitcoin from a regular wallet. Nobody watching the blockchain can tell whether it was a simple payment, a multisig transaction, a Lightning Network channel close, or a sophisticated smart contract.
Only when the parties disagree, or when a specific condition triggers (like a timelock expiring), does the transaction fall back to revealing one of the script paths from the Merkle tree. Even then, only that single path becomes public. The default spending path hides the existence of any multi-party contract behind what looks like an ordinary transaction.
Impact on Transaction Costs
Taproot reduces transaction costs in two ways. First, Schnorr’s smaller signatures mean less data per transaction. Second, multisig and complex transactions shrink dramatically because multiple inputs and signatures get condensed into a single aggregated signature. For a standard single-signature transaction, the savings are modest. For multisig transactions or contracts with multiple spending conditions, the reduction is significant because you’re replacing several keys and signatures with one.
The network as a whole benefits too. Smaller transactions mean more of them fit into each block, increasing effective throughput without changing Bitcoin’s block size rules.
How Taproot Enabled Ordinals
One of Taproot’s most unexpected consequences was making Bitcoin Ordinals and inscriptions possible. BIP 342 introduced a new opcode called OP_SUCCESS and, critically, removed the previous 10,000-byte script size limit for Taproot scripts. Scripts are now constrained only by the block size limit, which allows roughly 4 MB of data per block.
This change meant that arbitrary data, including images, text, and other media, could be embedded directly into Taproot script data. That script data also receives a fee discount compared to regular transaction data (a holdover from SegWit’s “witness discount” structure). The Ordinals protocol, launched in early 2023, took advantage of both the larger script capacity and the fee discount to inscribe data onto individual satoshis, effectively creating NFT-like assets on Bitcoin. Whether you view Ordinals as a creative use of the protocol or an unintended side effect, they exist because Taproot opened the door.
Adoption and Wallet Support
Taproot transactions use a new address format starting with “bc1p,” known as Pay-to-Taproot (P2TR). Adopting any new Bitcoin address format depends on wallets and service providers choosing to update their software. This process has been gradual, following the same pattern as SegWit adoption, which took years to reach widespread use after its 2017 activation.
The main bottleneck is that wallet developers, exchanges, and payment processors each upgrade on their own schedule. If your wallet doesn’t support P2TR addresses yet, you can still send bitcoin to Taproot addresses, but you won’t benefit from the smaller signatures and lower fees on your own transactions until your wallet generates P2TR addresses for you. Most major wallets have added or are actively adding Taproot support, but checking your specific wallet’s feature list is worthwhile if lower fees matter to you.
What Taproot Means for You
If you hold bitcoin and make simple transactions, Taproot offers marginally lower fees and slightly better privacy when you use a wallet that supports P2TR addresses. The gains are real but incremental for everyday use.
If you’re involved with multisig setups, Lightning Network channels, or any kind of Bitcoin-based contract, the benefits are more substantial. Your transactions become cheaper, more private, and indistinguishable from regular payments in the common case. For developers building on Bitcoin, Taproot’s larger script capacity and more flexible scripting language open design space that didn’t previously exist, as the Ordinals phenomenon demonstrated.
Taproot didn’t change Bitcoin’s supply, its proof-of-work consensus, or its block timing. It changed how transactions are structured and verified, making the network more efficient and more private without altering the economic rules that define Bitcoin.