Output

A transaction output is a package of bitcoin with a lock on it. It holds an amount in satoshis and a ScriptPubKey, the locking code that says who can spend it. A later transaction spends the whole output by naming it as an input. Outputs are the only place value lives on the chain: an input does not hold any.

A transaction can create many outputs, and each one can have a different lock. Once an output is spent, it is gone for good. Only the outputs nobody has spent yet remain, and those are the UTXO set that nodes keep.

What are the fields of an output?

Every output has the same three fields, repeated once per output.

Field	Size	Format	What it holds
Amount	8 bytes	Little-endian integer	The value in satoshis. One satoshi is 0.00000001 BTC.
ScriptPubKey size	Variable	Compact size	The length in bytes of the locking script that follows.
ScriptPubKey	Variable	Script	The lock. See ScriptPubKey.

For a typical P2PKH output, the size field is 19 (25 bytes) and the script is 25 bytes of fixed pattern. The entire output is 34 bytes.

How is the amount stored?

The amount is an 8-byte integer in little-endian order, so the bytes appear backwards in raw data. To read it, reverse the bytes and convert the hex to decimal.

For example, 100,000,000 satoshis (1 BTC) is 0000000005f5e100 in big-endian. In raw data it is written 00e1f50500000000. Transaction 2c5ae87c8f15d1b7432358212dbe6ee51b8e24c6f071b0d708647611000510f7 has one output like this, locked with a P2PKH script.

The field is 8 bytes, so it could hold up to 2 to the power of 64 minus 1 satoshis. Nodes do not accept that much, though. The consensus rules cap every output at 21 million BTC, which is 2,100,000,000,000,000 satoshis. An output above that makes the transaction invalid.

Zero is allowed. An output of 0 satoshis is valid, although it has no value and most nodes will not relay it. The sum of the outputs cannot be more than the sum of the inputs.

What is the fee in an output?

The fee is not written anywhere in the transaction. It is what is left over: the sum of the inputs minus the sum of the outputs. The miner who includes the transaction collects it. Because the fee is a remainder, a wallet that gets the output amounts wrong can overpay a miner without meaning to. The fee page works through the numbers.

What is change?

An output is spent as a whole. If a wallet holds one output of 0.5 BTC and wants to pay 0.1 BTC, it cannot spend part of that output. It spends the whole 0.5 BTC and creates two new outputs: one of 0.1 BTC to the payee and one of about 0.4 BTC back to itself, minus the fee. That second output is the change.

Nothing in the transaction marks which output is the change. Wallets usually place it last, but the rules do not require that. Transaction 4b5c918e95b98843a8340a6bb2dd61b4eee73ea632db85fb9a7eb538fd355588 has two outputs: one P2WPKH output of 1,684,450 satoshis and one P2PKH output of 215,880,776 satoshis. The second is probably the change, but the transaction alone does not say so.

Can an output be empty?

The amount can be zero, and the lock can be empty too. An empty lock is valid but dangerous: anyone who sees the output can spend it, because nothing checks a signature. Transaction 87d8ed6aae8ad82b01e2b9d7d7ca21e55e83e8fa2ae587892f12b06d3a12253c has one output with an empty ScriptPubKey and an amount of zero, so there is nothing to take. Its inputs' value went to the miner as the fee.

The next page, ScriptPubKey, looks at the lock itself: the common templates and how each one is unlocked.

Sources

• Bitcoin white paper, section 2 on transactions and outputs
• Bitcoin Core: consensus, MAX_MONEY, for the 21 million BTC cap