P2PKH locks bitcoin to the hash of a public key; to spend, you reveal the key and a signature. Step through the script with an animated diagram.
The script
Locking: OP_DUP OP_HASH160 <pubkey hash> OP_EQUALVERIFY OP_CHECKSIG
Unlocking: <signature> <public key>Step by step
- Push the signature and public key from the unlocking script.
OP_DUPcopies the public key.OP_HASH160hashes the copy.- Push the expected hash from the output.
OP_EQUALVERIFYchecks they match, or fails.OP_CHECKSIGchecks the signature with the public key.
Addresses
The 20-byte hash, with version byte 00, encoded in Base58Check, gives an address starting with 1.
Today
P2PKH still works everywhere, but spending it costs more than Segregated Witness (SegWit) or Taproot because the signature and key aren't discounted as witness data.
Why "pay to public key hash" was a good idea
Before P2PKH, senders had to know your full public key. With P2PKH you share a short address, and your public key stays hidden until you spend. The design also allowed the familiar address format with a checksum.
Cost today
A P2PKH input carries its signature and key in the non-witness part, so it costs four times more weight per byte than SegWit. Moving coins off legacy addresses when fees are low saves money later.
Key takeaways
- P2PKH locks to a HASH160 of a public key.
- The spender reveals the key and a signature.
- Addresses start with 1; spending costs more than SegWit.
Common questions
Why hash the public key?
It makes outputs and addresses shorter, and keeps the key hidden until spending.
Should I still use a 1… address?
It works, but bc1 addresses are cheaper to spend from.
Is a 1… address still safe?
Yes, it works and is secure. It's just more expensive to spend than newer types.
What does OP_EQUALVERIFY do in P2PKH?
It checks the hash of the provided public key matches the one in the output, and fails immediately if not.