What is Schnorr signature?
A signature scheme added to Bitcoin by Taproot, whose main property is that several signatures can be combined into one that verifies against a combined key.
Not yet verifiedHow we verify
3 min read
In this entry
A signature scheme added to Bitcoin by Taproot, whose main property is that several signatures can be combined into one that verifies against a combined key.
BIP-340 specifies it (source: BIP-340). It replaces nothing: the older signature scheme still works, and both exist side by side.
The property that matters is linearity. Signatures under this scheme can be added together, and so can public keys, in a way the previous scheme did not permit. That single mathematical fact is what makes multi-party signing collapse into something indistinguishable from a single signer.
How it works
- Signatures combine. Several signers can jointly produce one signature valid for the sum of their public keys, using a multi-round protocol.
- The result is one signature and one key. What appears on chain is a single signature against a single key, not a list of signatures and a script describing a policy.
- Fees fall. A multi-party spend that previously published several signatures now publishes one, so the transaction is smaller and cheaper. See sat vb.
- Privacy improves. An observer cannot tell a joint spend from an ordinary single-signer payment, because on chain they look identical. Under the old scheme, a multisig spend advertised itself and its policy.
- Adoption is opt-in. BIP-340 is used by Taproot outputs, and the previous scheme remains valid for older address types (source: BIP-340).
Wallet and exchange support has to be added deliberately, which is why some withdrawal forms still reject addresses beginning with the Taproot prefix.
Example
Illustrative comparison of the same three-of-three spend under each scheme.
| Old scheme | Schnorr, combined | |
|---|---|---|
| Signatures published | 3 | 1 |
| Spending policy visible on chain | Yes | No |
| Approximate relative size | Larger | Smaller |
| Looks like an ordinary payment | No | Yes |
Illustrative comparison; exact sizes depend on script structure.
The practical result for a business or a family using shared custody is that their arrangement stops being public information, and their transactions cost less. Neither improvement required changing how many people must approve a spend.
Why it matters when you buy
The direct effect on a buyer is small and specific: some exchange withdrawal forms still reject Taproot addresses, so if a withdrawal to an address beginning "bc1p" fails, the venue's support rather than your wallet is usually the cause. Beyond that, this is the mechanism that makes shared custody cheaper and more private. Multisig basics covers the setup, and moving crypto off an exchange covers withdrawals.
Related terms
taproot — the upgrade that introduced it; multisig — what it makes cheaper and private; segwit — the earlier upgrade it builds on; sat vb — why smaller transactions cost less; private key — what produces a signature; psbt — how multi-party signing is coordinated.
Questions
Do I need to do anything to use it?
No. If your wallet generates Taproot addresses, you are already using the scheme. The only friction is that some exchanges and older wallets do not yet support sending to those addresses.
Is it more secure than the old scheme?
It is built on the same elliptic curve and offers a cleaner security proof. The visible benefits are efficiency and privacy for multi-party spends rather than a change in how hard the underlying problem is.
Why do some exchanges reject Taproot addresses?
Because support has to be implemented deliberately and some venues have not prioritized it. The workaround is to withdraw to a SegWit address from the same wallet.