Locks

Every bitcoin output has a lock, and the lock holds a rule. A new transaction must meet that rule before it can spend the output. In the most common payment, the rule asks for a digital signature made with the private key behind an address. Without that signature, the network rejects the transaction.

That is how ownership is protected. Anyone can see the lock, but only a person who can meet the rule is able to move those coins.

When is a lock put on an output?

A transaction spends existing outputs and creates new ones, and each new output receives its lock at the moment it is created. The sender sets that lock, usually by choosing the address of the person who will receive the coins.

To pay a friend, you create a new output with a lock that says, in effect, that only the owner of this address may spend it. Once the transaction is mined, the output belongs to your friend, because only they hold the key that meets the lock. You cannot take the coins back unless your friend chooses to spend them. That is why you should check an address before you pay it.

How does a payment reach the blockchain?

You never send coins directly from your computer to someone else's. Instead, you build a transaction, send it into the network, and wait for a miner to add it to a block. When that block joins the blockchain, the transaction's new outputs become part of the permanent record.

It helps to think of the blockchain as storage for outputs. When you want to make a payment, you choose the outputs you are able to unlock, and you spend them. Once an output is spent, it stays in the record, but no one can spend it again.

What does a lock look like?

Locks are written in Script, Bitcoin's small programming language. A lock is built from short instructions called opcodes, and the lock itself is known as a locking script. For the most common kind of address, the locking script reads like this:

OP_DUP OP_HASH160 <20-byte public key hash> OP_EQUALVERIFY OP_CHECKSIG

In plain words, the script copies the key, hashes it, checks that the hash matches the address, and then checks the signature. The last step is the OP_CHECKSIG opcode, which checks a signature against a public key. You do not need to memorize the code. The P2PKH page explains each step in detail.

How is an output unlocked?

To spend an output, the new transaction includes an unlocking script alongside that output. For the common lock, the unlocking script holds two things: a signature and your public key.

The network then runs the unlocking script and the locking script together. It checks that the public key matches the address in the lock, and it checks that the signature is valid for this particular transaction. If both checks pass, the spend is valid. If either check fails, the node rejects the transaction.

Every node that receives the transaction runs the same check before it passes the transaction on to its neighbors.

Does the unlocking script reveal the private key?

No. The unlocking script holds a signature, not the private key itself. That signature proves you hold the key, and it works for this one transaction only. The digital signatures page explains how this works in detail.

Can a lock do more than check one key?

Yes. Script includes other checks, so a lock can ask for more than a single signature. It can require two signatures from two different keys, which is called multisig. It can also stay locked until a set time, using a locktime. Every node checks these rules in exactly the same way.

Some people describe this as programmable money. In effect, the lock is a small program that decides who may spend the output.

Next, keys and addresses explains the keys behind each lock, and how an address is built from them.