P2TR | Bitcoin Glossary | Mapping Bitcoin

Overview

Pay-to-Taproot (P2TR) is Bitcoin's most advanced output type, activated as part of the Taproot soft fork in November 2021. P2TR combines Schnorr signatures with Merkelized Alternative Script Trees (MAST) to create outputs that are both more private and more efficient than previous formats, particularly for complex spending conditions.

How P2TR Works

Every P2TR output encodes a single public key on-chain. This key can be spent via two paths:

P2TR Output Structure:

              ┌────────────────┐
              │  Tweaked Key   │ ◄── What appears on-chain
              │   (32 bytes)   │
              └───────┬────────┘
                      │
            ┌─────────┴─────────┐
            │                   │
     ┌──────▼──────┐    ┌──────▼──────┐
     │  Key Path   │    │ Script Path │
     │  (Schnorr   │    │   (MAST)    │
     │   spend)    │    │             │
     └─────────────┘    └──────┬──────┘
                               │
                        ┌──────▼──────┐
                        │ Merkle Tree │
                        │  of Script  │
                        │  Branches   │
                        └─────────────┘
                       ╱       │       ╲
                   Script   Script   Script
                     A        B        C

• Key path spend — The most common and most efficient path. A single Schnorr signature satisfies the output. Using MuSig, even a multisig arrangement looks identical to a single-key spend on-chain.
• Script path spend — Falls back to revealing a specific branch of the MAST tree. Only the executed script branch is revealed; all other branches remain hidden.

Privacy Advantages

The key insight of P2TR is that all key path spends look identical on-chain, regardless of the underlying complexity. A 3-of-5 multisig cooperative spend, a single-key spend, and a Lightning channel close all produce the same on-chain footprint when using the key path. This dramatically improves fungibility and makes chain analysis harder.

Address Format

P2TR addresses use Bech32m encoding (an updated version of Bech32) and start with bc1p on mainnet. The p stands for witness version 1, distinguishing them from P2WPKH addresses that start with bc1q (witness version 0).

Common Misconception

P2TR does not require a script tree. A P2TR output can be created with only a key path (no script branches), making it just as simple to use as P2WPKH while still benefiting from Schnorr signature efficiency. Wallets that default to Taproot use this simpler form for everyday payments.