# Schnorr signatures

Taproot introduced Schnorr signatures: a fixed 64 bytes, simpler maths, batch verification and multi-party key aggregation. Learn what changed.

Canonical page: https://mybitcoinexplorer.com/learn/schnorr-signatures
Topic: Cryptography
Published: 2026-10-29
Updated: 2026-10-30


## What changed
Schnorr signatures arrived with [Taproot](https://mybitcoinexplorer.com/learn/taproot) in November 2021 (BIP 340).

| | ECDSA | Schnorr |
|---|---|---|
| Size | 71–72 bytes | 64 bytes |
| Public key | 33 bytes | 32 bytes (x-only) |
| Malleable | Yes, needed fixes | No |
| Batch verification | No | Yes |
| Easy key aggregation | No | Yes |

## Linearity: the big win
Schnorr's maths is "linear": signatures and keys can be added together. With protocols like **MuSig2**, several people can combine their keys into one public key and jointly produce one signature.

> Diagram: Key aggregation: three signers, one key and one signature on-chain — Alice key → Bob key → Carol key → *One combined key: looks like a single user

On-chain, a 3-of-3 multisig spend looks exactly like an ordinary single-signature spend: smaller and more private.

## Batch verification
A node can check many Schnorr signatures together faster than one by one, which helps during [Initial block download (IBD)](https://mybitcoinexplorer.com/learn/initial-block-download).


## Why it took until 2021
Schnorr signatures were invented by Claus-Peter Schnorr around 1989, but a patent covered them until 2008. When Bitcoin launched, ECDSA was the standardised, patent-free option. Adding Schnorr later needed a soft fork, which arrived with Taproot.

## MuSig2 and FROST
- **MuSig2:** n-of-n signing, where all parties combine into one key.
- **FROST:** threshold signing (like 2-of-3) that still produces one ordinary-looking signature.

Both make shared custody cheaper and more private on-chain.


## Key takeaways

- Schnorr signatures are 64 bytes and arrived with Taproot.
- They are non-malleable and support batch verification.
- Key aggregation lets many signers look like one on-chain.

## Common questions

### Do Schnorr signatures use a different curve?

No, they use the same secp256k1 curve as ECDSA.

### Can I use Schnorr with my old address?

No, only Taproot (bc1p) outputs use Schnorr signatures.

### Are Schnorr signatures more secure than ECDSA?

They have a cleaner security proof and no malleability. Both are considered secure today.

### Do Schnorr signatures save fees?

Yes, slightly per signature, and greatly when many signers aggregate into one.

## Related lessons

- [Taproot](https://mybitcoinexplorer.com/learn/taproot)
- [ECDSA signatures](https://mybitcoinexplorer.com/learn/ecdsa)
- [Multisig](https://mybitcoinexplorer.com/learn/multisig)
- [Digital signatures](https://mybitcoinexplorer.com/learn/digital-signatures)