P2SH-P2WPKH

P2SH-P2WPKH is a nested form of P2WPKH. It puts a P2WPKH lock inside a legacy P2SH output. The address therefore starts with 3, not bc1q, so older wallets and exchanges can send to it. When you spend it, the signature and public key go in the witness, so the spend still gets the SegWit fee discount.

Nested means one lock sits inside another. The outer lock is the P2SH, and the inner one is the P2WPKH. Spending it takes two steps, which is why the form looks harder than it is.

If your wallet can send to bc1q addresses, use P2WPKH directly. There is no reason to nest it.

Why was P2SH-P2WPKH needed?

SegWit arrived in 2017, and many wallets and exchanges could not yet send to bc1q addresses. They could send to P2SH addresses, though. P2SH-P2WPKH let those senders pay a 3 address, while the receiver could still spend the coins as a P2WPKH later. BIP 49 defined wallet key paths for this form.

Most wallets now send to bc1q addresses, so P2SH-P2WPKH is now mostly a legacy form. Nodes still accept it as a standard lock.

What does the P2SH lock look like?

On chain, the output looks like any other P2SH output: OP_HASH160, a 20-byte push, and OP_EQUAL:

OP_HASH160
OP_PUSHBYTES_20
6d3ed4cf55dc6752a12d3091d436ef8f0f982ff8
OP_EQUAL

As hex, it is 23 bytes:

a9146d3ed4cf55dc6752a12d3091d436ef8f0f982ff887

Output 0 of 021e23df3cdb8b504bec1a3f7a382a83be7518354bac2331076753b5b4755a4e carries this lock. It was confirmed in block 826,281.

The 20-byte hash is the HASH160 of a P2WPKH lock, not of a public key:

P2WPKH lock: 001402c8147af586cace7589672191bb1c790e9e9a72
HASH160:     6d3ed4cf55dc6752a12d3091d436ef8f0f982ff8

The P2SH part is what makes the form compatible. Any wallet that can pay a 3 address can pay this output. Its address is a P2SH address, made with Base58Check and the prefix 05. The address does not show the inner lock, so you cannot tell from the address alone that it is nested. You only see the form when the output is spent.

What goes in the ScriptSig?

The scriptSig of a spend holds one data push: the full P2WPKH lock, which is 22 bytes. The push adds one byte of length in front, so the ScriptSig is 23 bytes:

16001402c8147af586cace7589672191bb1c790e9e9a72

The first byte, 16, means the next 22 bytes are pushed. Those 22 bytes are the P2WPKH lock, 0014 followed by the 20-byte hash. Input 0 of a55bd4d4ebd319ab2990c356e16cab1eeb52a93c414b869a606dc0add61d725a spends the example output. It was confirmed in block 829,574.

The ScriptSig must contain nothing else. Bitcoin's BIP 141 rules reject a nested spend that has any extra opcode in it.

What goes in the witness?

The witness of a P2SH-P2WPKH spend is the same as the witness of a direct P2WPKH spend. It holds the signature and the public key:

02
47
304402201f85ab44217563b4ce9d11e4c7b00dc59dd102099eb250634f4b6906276ba07702206147cc98f29c5fcbad925b5e40fe154f4d429f9569f292f9298f615c4940044501
21
022ae7dd28111380c100301f5e9797383e291234c341d7a242202a6def9069181c

The count 02 is followed by a 71-byte signature (47), and a 33-byte compressed public key (21). The witness is 107 bytes in all. The example is input 0 of the same spend as above. Only compressed public keys are allowed, as they are for P2WPKH.

How does Bitcoin check the spend?

Bitcoin checks a nested spend in two steps:

1. It takes the push from the ScriptSig, hashes it with HASH160, and checks that the result equals the hash in the P2SH lock.
2. It takes the witness and checks the inner P2WPKH lock with it, exactly as it would check a direct P2WPKH spend.

The ScriptSig turns from an unlocking field into a locking field in this form. That is why the form confuses many people. The P2SH-P2WSH page uses the same two steps with a P2WSH inside.

How much does it cost?

The witness gets the SegWit discount, but the ScriptSig does not. A P2SH-P2WPKH spend therefore sits between a legacy P2PKH and a direct P2WPKH:

Unlock	ScriptSig (bytes)	Witness (bytes)	Total (bytes)	Virtual bytes
P2PKH	107	0	107	107
P2SH-P2WPKH	23	107	130	49.75
P2WPKH	0	107	107	26.75

These are typical sizes, since a signature can vary by a byte or two. Each witness byte counts as 0.25 virtual bytes, so the 107-byte witness counts as 26.75. Adding the 23-byte ScriptSig gives 49.75. Fees are set per virtual byte, so the nested spend costs about half of a P2PKH spend. A direct P2WPKH spend costs about a quarter.

The output side is different. A P2SH output is 23 bytes, a P2WPKH output is 22 bytes, and a P2PKH output is 25 bytes. Outputs get no witness discount, so the size difference shows up directly. See virtual byte and fee rate for how those sizes become a fee.

Should you use P2SH-P2WPKH?

Use it only when the sender can pay a 3 address and cannot pay a bc1q one. Otherwise pay P2WPKH directly. Spending a direct P2WPKH output costs about half as much, and it skips the extra step.

The form is still valid and still standard, so nodes relay it and miners include it. Older outputs of this kind will stay in the chain forever, so it is worth knowing how to read one.