ScriptPubKey

A ScriptPubKey is the locking code on a transaction output. It sets the condition that someone must meet to spend the output, usually by showing a signature for a particular public key. It is written as Script bytes, though many modern locks are short fixed patterns rather than full programs. The name comes from the original code. Most people find it easier to think of it as the lock on an output.

Most ScriptPubKeys are one of a few standard templates. Wallets usually show them as addresses, which are a readable encoding of the lock's hash or key.

What are the common templates?

The list below covers the standard locks you will see most often. Each is a fixed pattern, so you can tell its type from its first bytes and its length.

• P2PK locks to a public key. It is 21 then a 33-byte compressed key, then ac, which is OP_CHECKSIG. Early coinbase outputs use it.
• P2PKH locks to the hash of a public key: 76a914, the 20-byte public key hash, 88ac. It is 25 bytes.
• P2SH locks to the hash of a script: a914, a 20-byte script hash, 87. It is 23 bytes.
• P2WPKH is the segwit version of P2PKH: 0014 then a 20-byte key hash. It is 22 bytes.
• P2WSH is the segwit version of P2SH: 0020 then a 32-byte script hash. It is 34 bytes.
• P2TR locks to a tweaked Taproot key: 5120 then a 32-byte key. It is 34 bytes.
• OP_RETURN marks data that can never be spent: 6a followed by a data push. Nodes limit how much of it they relay, under their policy settings.

What does a P2PKH script look like?

A P2PKH lock is the most familiar one. Here is the ScriptPubKey of output 1 in transaction 0b6461de422c46a221db99608fcbe0326e4f2325ebf2a47c9faf660ed61ee6a4:

76a91455ae51684c43435da751ac8d2173b2652eb6410588ac

Read it as: 76 is OP_DUP, a9 is OP_HASH160, 14 is a push of 20 bytes, then the hash, then 88 is OP_EQUALVERIFY and ac is OP_CHECKSIG. To spend it, a ScriptSig must give a public key that hashes to that value. It must also give a signature made with that key. The ScriptSig page shows that unlock.

The P2PKH lock is 25 bytes long. The size field before it is 19.

What does a segwit lock look like?

A segwit lock is a fixed pattern rather than a script that is executed. Output 0 of transaction 4b5c918e95b98843a8340a6bb2dd61b4eee73ea632db85fb9a7eb538fd355588 is a P2WPKH lock: 0014af267b26ef0ebd333b80dac1546f7db5d048d027. It has a version byte 00, a push of 20 bytes, and the key hash. Its unlocking data goes in the witness, not the ScriptSig. Witness data counts for less in the size calculation, so spending a segwit output costs less per byte of unlocking data than spending a legacy one.

A P2TR lock such as 5120f3778defe5173a9bf7169575116224f961c03c725c0e98b8da8f15df29194b80 is a tweaked public key that commits to optional scripts. It is unlocked in the witness too, and it is 34 bytes long.

Which locks are standard?

Nodes relay only the standard templates. A custom script can still be mined, but most nodes will not relay it. For example, the lock 6e935888945287 (OP_2DUP OP_ADD OP_8 OP_EQUALVERIFY OP_SUB OP_2 OP_EQUAL) works as a small puzzle. The two numbers that unlock it must sum to 8, and their difference must be 2. Transaction ab149362ea4e119d2bc5211b35083c23ec41842af6bbc2ff3c5f1e55941199cc pays to it. Only OP_5 then OP_3 unlocks it.

To use such a lock safely, most people wrap it in a P2SH or a P2WSH lock. The output then holds only a hash, and the full script is revealed when someone spends it.

What is an OP_RETURN output?

An OP_RETURN output is unspendable on purpose. It holds data, such as the ASCII text hello world, which is 6a0b68656c6c6f20776f726c64 in full. The 0b is the length, 11 bytes. Nodes treat it as provably unspendable, so they can drop it from the UTXO set. How much data a node will relay is a policy setting, -datacarriersize in Bitcoin Core, and its default has changed between versions, so check your node's release notes.

The next page, Witness, covers the unlocking data that segwit inputs carry outside the ScriptSig.

Sources

• BIP 141: Segregated Witness, for the witness locks
• BIP 341: Taproot, for the P2TR lock
• BIP 16: Pay to Script Hash, for P2SH