Taproot activated at block 709,632 on 14 November 2021. It is three BIPs working together.
BIP340: Schnorr signatures
A new schnorr signature scheme on the same secp256k1 curve. Signatures are 64 bytes and public keys are 32-byte x-only keys. Because Schnorr is linear, several signers can combine their keys into one with protocols like MuSig2 (BIP327) and produce one signature.
BIP341: Taproot outputs
A Taproot output (SegWit v1, bc1p…) commits to one 32-byte key Q. Q is built from an internal key P and an optional tree of scripts:
Q = P + t·G, where t = hashTapTweak(P || merkle_root)
There are two ways to spend:
- Key path: sign with the tweaked key. On-chain it is just one signature. Nobody can tell whether a script tree existed.
- Script path: reveal one script (a leaf), its inputs, and a control block holding P and the Merkle branch proving that leaf is in the tree. The other leaves stay hidden.
This tree of alternatives is often called MAST. A typical design: the key path is "everyone agrees", and the leaves are fallbacks such as "2-of-3 after 6 months".
BIP342: Tapscript
The script language inside leaves was updated. OP_CHECKMULTISIG was replaced by OP_CHECKSIGADD, which is batch-verifiable. The 10,000-byte script limit and 201-opcode limit were removed and replaced with a signature budget tied to witness size. Unused opcodes became OP_SUCCESSx, which makes future soft forks simpler.
Better signature hashing
The BIP341 sighash commits to the amounts and scripts of all inputs being spent, so hardware wallets can verify fees without seeing previous transactions.
Activation
Taproot used "Speedy Trial", a short BIP9-style signalling window with a 90% threshold. The 90% threshold was reached at block 687,284 on 12 June 2021, it was locked in from the next period (block 687,456), and it was enforced from block 709,632.
Benefits
Cheaper and more private multisig and contracts, because the common case looks like an ordinary single-key payment.