P2PKH

P2PKH, short for pay to public key hash, is the lock behind the classic Bitcoin address, the one that starts with 1. It locks an output to the HASH160 of a public key rather than to the key itself. To spend, you show the full public key and a signature made with its private key. P2PKH is a legacy type. The SegWit type P2WPKH works the same way, and it is now the usual choice for new payments.

What does a P2PKH locking script look like?

The scriptPubKey holds a public key hash between a fixed set of opcodes. The whole script is 25 bytes:

76a91455ae51684c43435da751ac8d2173b2652eb6410588ac

76 is OP_DUP, and a9 is OP_HASH160. 14 pushes the next 20 bytes, which is the hash. 88 is OP_EQUALVERIFY, and ac is OP_CHECKSIG. Output 1 of 0b6461de422c46a221db99608fcbe0326e4f2325ebf2a47c9faf660ed61ee6a4 is one such lock.

What does the unlocking script look like?

The scriptSig pushes a signature and then the public key:

483045022100c233c3a8a510e03ad18b0a24694ef00c78101bfd5ac075b8c1037952ce26e91e02205aa5f8f88f29bb4ad5808ebc12abfd26bd791256f367b04c6d955f01f28a7724012103f0609c81a45f8cab67fc2d050c21b1acd3d37c7acfd54041be6601ab4cef4f31

48 pushes the 72-byte signature, and 21 pushes the 33-byte public key, which starts with 03 because it is compressed. Input 0 of 40e331b67c0fe7750bb3b1943b378bf702dce86124dc12fa5980f975db7ec930 is a spend of this form.

The key may be compressed (33 bytes) or uncompressed (65 bytes). What matters is that it hashes to the value in the lock. A compressed key does not match an uncompressed hash, and the other way round.

How does a P2PKH script run?

The scriptSig runs first, then the scriptPubKey. The script overview has an animated stack that shows each step. In short:

1. The scriptSig pushes the signature, then the public key.
2. OP_DUP copies the public key.
3. OP_HASH160 hashes the copy.
4. The lock pushes the 20-byte hash from the output.
5. OP_EQUALVERIFY checks that the two hashes match, then removes both. If they differ, the script fails.
6. OP_CHECKSIG checks the signature against the public key and leaves OP_1 if it is valid.

Step 5 is the extra work compared with P2PK. It proves that the key shown in the spend hashes to the key the output was locked to.

What is the address for P2PKH?

P2PKH has an address. It is the Base58Check encoding of the public key hash, with a one-byte prefix in front: 00 on mainnet and 6f on testnet. Mainnet addresses start with 1, and testnet addresses start with m or n.

The example uses an uncompressed public key that starts with 04283338. Its HASH160 is bc73550c1612ee81155d29254217cbd60084a6d1. The prefix and hash are followed by a 4-byte checksum, the first four bytes of the double SHA-256 of what came before. Base58 encoding then gives the address 1JBSCVF6VM6QjFZyTnbpLjoCJTQEqVbepG.

A wallet that receives a 1 address decodes it, takes out the hash, and builds this lock. The address page explains the other address types.

Why does P2PKH hash the public key?

Hashing gives a shorter address. Base58 encoding a compressed public key gives an address of 51 characters. Hashing the key first gives 34 characters, which is easier to copy and share. Hashing also keeps the public key out of sight until the coins are spent. The checksum makes a typing mistake easy to catch.

Until around 2016, most wallets paid addresses with P2PKH locks. Sending to an address that starts with 1 still creates this lock.

Which P2PKH transactions can you check on our explorer?

• a1075db55d416d3ca199f55b6084e2115b9345e16c5cf302fc80e9d5fbf5d48d is the pizza transaction, in block 57,043 on 22 May 2010. Laszlo Hanyecz paid 10,000 BTC for two pizzas. Its one output is a P2PKH lock to 17SkEw2md5avVNyYgj6RiXuQKNwkXaxFyQ.
• Input 0 of faf2987fd2240d9c46575cc35c354eeca71b794c482f3cc49fba1a5f9a80808c is a P2PKH spend from 2023. P2PKH locks are still in use, though SegWit addresses are now more popular.

The next page, P2MS, covers locks that need several signatures. For the other address types, see the address page.