A digital signature proves you hold a private key without revealing it. Learn how Bitcoin signatures authorise every spend and why they can't be reused.
Proof without revealing the secret
A digital signature lets you prove you know a private key without showing it. Anyone with your matching public key can check the proof.
What gets signed
When you spend, your wallet signs a hash of the transaction itself (which inputs, which outputs, which amounts). So:
- a signature for one transaction can't be reused for another,
- if anyone changes an output, the signature stops being valid.
Exactly which parts are covered is chosen with a sighash flag. The default, SIGHASH_ALL, covers everything.
Two schemes in Bitcoin
| Scheme | Used by | Lesson |
|---|---|---|
| ECDSA | Legacy and SegWit v0 outputs | ECDSA signatures |
| Schnorr | Taproot outputs (since 2021) | Schnorr signatures |
Both use the same curve, secp256k1. See Elliptic curve cryptography.
Sighash types
| Flag | Signs | Typical use |
|---|---|---|
| ALL | All inputs and outputs | Normal payments |
| NONE | All inputs, no outputs | Rare, risky |
| SINGLE | All inputs, the matching output | Special protocols |
| ANYONECANPAY (combined) | Only this input | Crowdfunding-style transactions |
Almost every wallet uses ALL: the signature locks the whole transaction.
Signatures you can see
Open a transaction on MyBitcoinExplorer and expand its raw data: each SegWit input's witness begins with a signature of about 71 bytes, or 64 bytes for Taproot.
Key takeaways
- A signature proves knowledge of a private key without revealing it.
- Bitcoin signatures commit to the transaction, so they can't be reused.
- Bitcoin uses ECDSA and, since Taproot, Schnorr signatures.
Common questions
Can someone fake my signature?
Not without your private key, as far as anyone knows. Forging one would require breaking elliptic curve cryptography.
Is my signature public?
Yes, once your transaction is broadcast. That's safe: signatures don't reveal the private key, as long as the wallet uses fresh random nonces.
Can a signature reveal my private key?
Not with correct software. It only becomes possible if a wallet reuses or leaks its secret signing nonce.
Do all inputs need separate signatures?
Yes, each input proves its own right to spend, unless they share a key and the scheme allows aggregation.