P2PK

P2PK, short for pay to public key, is the simplest lock in Bitcoin. It locks an output directly to a public key. Anyone who can make a valid signature with the matching private key can spend the coins. P2PK is a legacy type from Bitcoin's first years, and it is rare today.

What does a P2PK locking script look like?

The scriptPubKey is two opcodes around one public key. 41 pushes the next 65 bytes, which is an uncompressed public key, and ac is OP_CHECKSIG. The whole locking script is 67 bytes:

41049464205950188c29d377eebca6535e0f3699ce4069ecd77ffebfbd0bcf95e3c134cb7d2742d800a12df41413a09ef87a80516353a2f0a280547bb5512dc03da8ac

Output 1 of 1db6251a9afce7025a2061a19e63c700dffc3bec368bd1883decfac353357a9d uses this lock. A compressed public key is 33 bytes, so the same lock with a compressed key is 35 bytes: 21, the key, then ac.

How is a P2PK output spent?

The unlocking script is a single push, the signature:

483045022100c219a522e65ca8500ebe05a70d5a49d840ccc15f2afa4ee9df783f06b2a322310220489a46c37feb33f52c586da25c70113b8eea41216440eb84771cb67a67fdb68c01

48 pushes the next 72 bytes. The signature is in DER form, and its last byte, 01, is the sighash type SIGHASH_ALL. That byte says which parts of the transaction the signature covers. The spender does not show a public key, because the lock already holds it. Input 0 of e827a366ad4fc9a305e0901fe1eefc7e9fb8d70655a079877cf1ead0c3618ec0 is a spend of this kind.

How does a P2PK script run?

The two halves run in order, and the stack carries the signature across:

1. The scriptSig pushes the signature onto the stack.
2. The scriptPubKey pushes the public key.
3. OP_CHECKSIG takes both items off the stack and checks the signature against the key.
4. If the signature is valid, it pushes OP_1. If not, it pushes an empty item (false, the same as OP_0), and the script fails.

With OP_1 as the only item left, the script is valid, and the coins can move.

Which P2PK outputs can you check on our explorer?

• The genesis block's coinbase transaction, 4a5e1e4baab89f3a32518a88c31bc87f618f76673e2cc77ab2127b7afdeda33b, pays its output 0 to an uncompressed P2PK lock. The coins have never moved.
• Block 170 holds f4184fc596403b9d638783cf57adfe4c75c605f6356fbc91338530e9831e9e16, the transaction in which Satoshi sent 10 BTC to Hal Finney. Both of its outputs are P2PK. Input 0 of ea44e97271691990157559d0bdd9959e02790c34db6c006d779e82fa5aee708e spends one of them.
• Output 0 of 3db8816c460f674e47f0e5799656721a249acdd53cd43a530c83384577485947 is a P2PK lock to a 33-byte compressed key. Input 0 of cda1f7d88232ff7e4fc1fcbf8a66b2cc3b8e19b5bc0ad22618453b8b75156740 spends it.

Why is P2PK rare today?

Early miners paid their block rewards to P2PK outputs. You will find P2PK mostly in the coinbase transactions of the first blocks. The reason is not known. A likely one is that a miner has no need for addresses, so the simpler lock was enough.

Later, wallets offered only addresses, and an address converts to a P2PKH lock. A P2PK lock could only be built by hand, in a raw transaction. P2PKH also hides the public key until the coins are spent, which P2PK does not do.

Does a P2PK output have an address?

No. A P2PK output has no official address. Some explorers show one anyway. They take the HASH160 of the public key and encode it as a P2PKH address. For the genesis output, that address is 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa. It is the address the same key would have as a P2PKH lock. It is useful for searching, but the P2PK output itself has no address of its own.