HASH160 is SHA-256 followed by RIPEMD-160. It turns a 33-byte public key into the 20-byte hash inside most Bitcoin addresses. See how and why.
Two hashes in a row
HASH160(x) = RIPEMD-160( SHA-256(x) )Why use it?
- Shorter addresses: 20 bytes instead of 33, so addresses are easier to share.
- An extra layer: until you spend, only the hash of your public key is public, not the key itself.
- Two different designs: if one hash function were weakened, the combination would still be hard to attack.
Where it appears
| Use | Hashed data |
|---|---|
| Pay to public key hash (P2PKH) (addresses starting with 1) | the public key |
| Pay to script hash (P2SH) (addresses starting with 3) | the redeem script |
| P2WPKH (bc1q…, 42 characters) | the public key |
Taproot addresses don't hash the key: they contain a 32-byte tweaked public key directly.
Spot HASH160 in a script
In a P2PKH locking script, the bytes after OP_HASH160 are the 20-byte public key hash:
OP_DUP OP_HASH160 89abcdefabbaabbaabbaabbaabbaabbaabbaabba OP_EQUALVERIFY OP_CHECKSIGThe address is just that hash with a version byte and checksum, encoded in Base58 or Bech32.
Why RIPEMD-160?
It was a well-known, independent design from a different team than SHA-256, giving a shorter output. Combining two unrelated hash functions was a cautious choice in 2008.
Key takeaways
- HASH160 = RIPEMD-160 of SHA-256.
- It produces the 20-byte hash in P2PKH, P2SH and P2WPKH outputs.
- Taproot uses the public key itself instead.
Common questions
Is 160 bits secure enough?
For finding a key that matches someone's hash, yes. Collisions are easier at 160 bits, which is one reason newer script outputs like P2WSH use 32-byte SHA-256.
Why do two addresses from the same key look different?
Different address types encode the hash (or key) differently.
Is RIPEMD-160 still secure?
For Bitcoin's use (preventing someone from finding a key matching your hash), yes. No practical attack is known.
Does Taproot use HASH160?
No. Taproot outputs contain a 32-byte tweaked public key directly.