Public key hash

A Bitcoin public key hash is 20 bytes, made by hashing a public key twice. First you hash it with SHA-256, then you hash that result with RIPEMD-160. Bitcoin calls the combined step HASH160. Most addresses and locking scripts carry this hash rather than the full key, because the hash is shorter.

How is a public key hash made?

There are three steps.

1. Take the public key as bytes. Use the compressed form, 33 bytes, unless you have a reason not to.
2. Hash those bytes with SHA-256. You get 32 bytes back.
3. Hash that result with RIPEMD-160. You get 20 bytes back. That is the public key hash.

For the compressed key from the public key page, the three values are:

public key   02cd33111c7fc75b33bc30ad959dd27433d631dee5bf072733334163dedc403070
SHA-256      302752d85c08e5bae4e3bc813c552cb87393170f70c79aefe8dc22197b7e2aa2
RIPEMD-160   1fe032088d648e925f15a24a0cf6a1e80f01bf91

This Python function does both hashes. It needs Python 3 with the standard hashlib module.

import hashlib

def hash160(data: bytes) -> bytes:
    """SHA-256, then RIPEMD-160: the 20-byte public key hash."""
    return hashlib.new("ripemd160", hashlib.sha256(data).digest()).digest()

pubkey = bytes.fromhex("02cd33111c7fc75b33bc30ad959dd27433d631dee5bf072733334163dedc403070")
print(hash160(pubkey).hex())  # 1fe032088d648e925f15a24a0cf6a1e80f01bf91

Some OpenSSL 3 builds leave RIPEMD-160 out of hashlib. If you see an "unsupported hash type" error, use a library such as pycryptodome, which provides RIPEMD-160.

Why is the hash 20 bytes?

RIPEMD-160 always returns 160 bits, which is 20 bytes. That makes the hash 13 bytes shorter than a compressed key and 45 bytes shorter than an uncompressed one. A shorter value gives a shorter address. The address adds a version byte and a checksum, and then it is encoded for people to read.

Why do addresses use a hash?

Satoshi used public key hashes for addresses in the first release of Bitcoin, and the main goal was a shorter address. That release used only uncompressed keys, so each key was 65 bytes, which was long to copy and paste. A 20-byte hash was much easier to share.

The hash also keeps the key hidden until you spend. Some people count that as extra protection. It only covers coins that have not moved yet, because the key is revealed the moment you spend. The shorter address is the clear benefit.

Where does the hash appear in a transaction?

The hash appears in the locking script of an output, which sets the conditions for spending the coins. There are two common forms. The diagram shows both, and the text below explains them.

P2PKH

P2PKH is the legacy form, and its addresses start with 1. The scriptPubKey of our example key's P2PKH output is:

76a9141fe032088d648e925f15a24a0cf6a1e80f01bf9188ac

The bytes 76 (OP_DUP), a9 (OP_HASH160), 14 (push 20 bytes) and 88 and ac (OP_EQUALVERIFY and OP_CHECKSIG) surround the hash. When you spend, the scriptSig reveals the full compressed key and a signature. A node then hashes the key with HASH160 and compares the result with the hash in the lock. If they match, it checks the signature.

A real example is transaction 6f7cf958…8516, which has a P2PKH output.

P2WPKH

P2WPKH is the SegWit form, and its addresses start with bc1q. The scriptPubKey is shorter:

00141fe032088d648e925f15a24a0cf6a1e80f01bf91

The 00 is OP_0, which marks witness version 0. The 14 pushes the next 20 bytes, which is the hash. The key does not appear in the lock. It comes later, in the witness, when the output is spent. A real example is transaction c178d8da…a83a, which has a P2WPKH output.

How do addresses use the hash?

An address is the public key hash with a prefix and a checksum, encoded as text. A P2PKH address adds the byte 00 in front, appends a checksum, and encodes the result in Base58. A P2WPKH address uses bech32 and the version number. The hash does not change between the two. Only the wrapping does.

Our example key gives the P2PKH address 13uYXKWq8VoZgQApSxTXHPtYDs1m1xGi4z. The address page walks through the full construction.

Summary

The public key hash is the 20-byte HASH160 of a public key: SHA-256, then RIPEMD-160. It keeps addresses short, and it sits inside every P2PKH and P2WPKH output. The full key is only revealed when the coins are spent. The next page, checksum, explains how addresses add a check against typing errors.

Sources: the Bitcoin Wiki page on version 1 addresses describes the HASH160 step, and Bitcoin Core's hash.h defines it in the reference software.