P2SH-P2WPKH

BIP 141: Segregated Witness

P2SH-P2WPKH (also known as Nested P2WPKH) is a locking script type that wraps a modern P2WPKH inside a legacy P2SH.

It allows you to send bitcoins to a legacy 3address (P2SH), but also take advantage of the cheaper transaction fee costs that come from spending a modern P2WPKH output.

Therefore, P2SH-P2WPKH provides a stepping-stone until wallets and exchanges support sending directly to bc1qaddresses.

There's no reason to use P2SH-P2WPKH if you have the option to use P2WPKH directly. P2SH-P2WPKH is only useful if you cannot send to a bc1qaddress from your wallet or exchange, but can send to a 3address instead.

Purpose

Why does P2SH-P2WPKH exist?

The new P2WPKH locking script introduced in the Segregated Witness upgrade is unlocked via the witness field of a transaction.

The witness field provides a discount in terms of how much space it takes up in a block. As a result, it costs less in fees to spend a P2WPKH compared to a legacy P2PKH (which is unlocked via the ScriptSig field and doesn't provide a discount).

So you'd prefer to use P2WPKH over the legacy P2PKH if you have the choice.

However, wallets and exchanges may not have implemented the functionality to send to P2WPKH (bc1qaddresses) when Segregated Witness was first activated in 2016. Therefore, P2SH-P2WPKH provides the option to send to a P2SH (3address) instead, whilst also being able to spend the output as if it was a P2WPKH later on.

As a result, P2SH-P2WPKH allows you to take advantage of the witness discount provided by P2WPKH, even if the wallet or exchange you're using does not allow you to send to bc1qaddresses.

Usage

How does P2SH-P2WPKH work?

P2SH-P2WPKH is one of the more complex scripts to understand.

The ScriptPubKey is a standard P2SH, but to unlock it you need to use both the ScriptSig and Witness field of a transaction.

ScriptPubKey

The ScriptPubKey is a standard P2SH locking script. For example:

OP_HASH160
OP_PUSHBYTES_20
6d3ed4cf55dc6752a12d3091d436ef8f0f982ff8
OP_EQUAL

a9146d3ed4cf55dc6752a12d3091d436ef8f0f982ff887

The script hash is the hash160 of a P2WPKH ScriptPubKey. For example:

P2WPKH ScriptPubKey: 001402c8147af586cace7589672191bb1c790e9e9a72
hash160:             6d3ed4cf55dc6752a12d3091d436ef8f0f982ff8

The original P2WPKH ScriptPubKey will be revealed in the upcoming ScriptSig.

The fact that P2SH-P2WPKH uses a standard P2SH ScriptPubKey is what makes it backwards-compatible. Most wallets and exchanges should support sending to a P2SH (3address).

ScriptSig

The ScriptSig contains a 22-byte data push of a P2WPKH ScriptPubKey.

OP_PUSHBYTES_22
001402c8147af586cace7589672191bb1c790e9e9a72

16001402c8147af586cace7589672191bb1c790e9e9a72

This data push is a complete P2WPKH ScriptPubKey. In other words, it's the ScriptPubKey you would have used if you were using P2WPKH directly.

For the execution of this script type to continue successfully, the hash160 of this data push must match the script hash in the ScriptPubKey.

The fact that the ScriptSig contains a further P2WPKH inside it is why this is sometimes referred to as a "Nested P2WPKH".

Witness

The witness field contains the signature and public key required to unlock the P2WPKH ScriptPubkey inside the ScriptSig.

304402201f85ab44217563b4ce9d11e4c7b00dc59dd102099eb250634f4b6906276ba07702206147cc98f29c5fcbad925b5e40fe154f4d429f9569f292f9298f615c4940044501
022ae7dd28111380c100301f5e9797383e291234c341d7a242202a6def9069181c

{
  "stackitems": "02",
  "0": {
    "size": "47",
    "item": "304402201f85ab44217563b4ce9d11e4c7b00dc59dd102099eb250634f4b6906276ba07702206147cc98f29c5fcbad925b5e40fe154f4d429f9569f292f9298f615c4940044501"
  },
  "1": {
    "size": "21",
    "item": "022ae7dd28111380c100301f5e9797383e291234c341d7a242202a6def9069181c"
  }
}

0247304402201f85ab44217563b4ce9d11e4c7b00dc59dd102099eb250634f4b6906276ba07702206147cc98f29c5fcbad925b5e40fe154f4d429f9569f292f9298f615c494004450121022ae7dd28111380c100301f5e9797383e291234c341d7a242202a6def9069181c

This data is executed against the P2WPKH ScriptPubKey in the ScriptSig, just as it would be for a direct P2WPKH.

The structure of the Witness field for a P2SH-P2WPKH is exactly the same as it is for a direct P2WPKH.

P2SH-P2WPKH uses compressed public keys only. This is different to legacy P2PKH, where both uncompressed and compressed public keys can be used.

Summary

A P2SH-P2WPKH is unlocked in two steps:

1. The ScriptPubKey is unlocked by the ScriptSig. This is done by providing a data push (a P2WPKH ScriptPubKey) that hashes to the script hash in the ScriptPubKey.
2. The ScriptSig is unlocked by Witness. This is done by providing the signature and public key needed to unlock the P2WPKH ScriptPubKey in the ScriptSig.

It's a bit confusing I know. I think it's the fact that the ScriptSig actually contains a ScriptPubKey inside it, and that's what throws most people off.

But don't be put off, because as I say it isn't executed like a typical P2SH.

P2SH-P2WPKH (and P2SH-P2WSH) work differently to all other scripts in Bitcoin.

Costs

The following table shows the number of bytes required to unlock a legacy P2PKH, a P2SH-P2WPKH, and a modern P2WPKH:

Note: The size of signatures can vary slightly in size, but these sizes are the most typical.

As you can see, P2SH-P2WPKH actually requires more bytes to unlock than a legacy P2PKH or modern P2WPKH.

However, the size calculation of a transaction was adjusted during the Segregated Witness upgrade to use virtual bytes instead. This new virtual bytes measurement gives a discount to the bytes in the witness field, where each byte in the witness only takes up 0.25 virtual bytes of space.

The following table shows the number of virtual bytes required to unlock the same scripts:

Note: The number of bytes in the witness have been multiplied by 0.25.

So even though the spending of a P2SH-P2WPKH requires more bytes overall, the discount given to the bytes in the witness field means that a P2SH-P2WPKH uses fewer virtual bytes compared to a legacy P2PKH.

And seeing as the amount you pay in transaction fees is calculated in sats per virtual byte, it works out cheaper to spend a P2SH-P2WPKH than a legacy P2PKH.

P2WPKH is the cheapest. But if that's not an option, P2SH-P2WPKH is cheaper than legacy P2PKH.

Address

How do you create an address for a P2SH-P2WPKH?

P2SH-P2WPKH locking scripts have a 3address.

This is because it uses P2SH for the ScriptPubKey, so it has the same address format as any other P2SH.

To create the address, you simply use the script hash from the ScriptPubKey as the hash160 data, use the prefix 0x05 (to signify a P2SH address), then encode to Base58Check.

And to create the script hash, you first need to construct the P2WPKH ScriptPubKey you want to use, then hash it using hash160.

tool-682f21cb95544

Address (Base58)

Encode the hash160 of a public key or script to a legacy address.

Generate Random

Prefix

1 byte

Type

P2PKH P2SH P2PKH (Testnet) P2SH (Testnet)

HASH160

0 bytes

Checksum

0 bytes

Address

Base58 encoding of the above data

0 characters

0 secs

It's not possible to identify a P2SH-P2WPKH from the address alone. The only way you can identify that a 3address uses Nested P2WPKH is when it gets spent, as that's when it reveals the P2WPKH locking script wrapped inside the ScriptSig.

Summary

P2SH-P2WPKH (Nested P2WPKH) was created to take advantage of the cheaper spending costs of P2WPKH, even if the wallet or exchange you're using does not allow you to send to P2WPKH directly (bc1qaddress).

As a compromise, you can send bitcoins to a P2SH (3address) instead, then spend the output later on as if it was a P2WPKH. This means the output is unlocked via the witness field, and the discount provided by this witness reduces the costs in terms of transaction fees.

But now that P2WPKH is widely adopted, there is no longer much use for the old P2SH-P2WPKH.

The most annoying interesting aspect of P2SH-P2WPKH (aside from the lengthy acronym) is how it uses both the ScriptSig and Witness field to be unlocked. This makes it a multi-step unlocking process, and is naturally more complex than a straightforward P2PKH or P2WPKH.

This is especially annoying if you're parsing the blockchain or working on a blockchain explorer, as it adds yet another locking script type to identify and handle. It ends up turning the ScriptSig from just being the "unlocking code" field in to a "locking code" field as well, which is a bit weird.

So don't worry if you find this script type difficult to understand — I did too (and still do).

I actually put off writing this page for a long time (Segwit was released in 2016, and I wrote this page in 2025), as I hoped that P2SH-P2WPKH would fade in to obsolescence over the years so that I wouldn't have to go through the rigmarole of explaining how it works. But P2SH-P2WPKH is going to live in the blockchain forever, so we might as well get the hang of them at some point.

Ideally it would have been easier to migrate directly from P2PKH to P2WPKH without having P2SH-P2WPKH thrown in as a backwards-compatible stepping stone, but it served its purpose while wallets and exchanges implemented the new Segregated Witness features.

It was all for a more pleasant user experience. We just have to deal with the complexity.

Resources

• interpreter.cpp
• Will Segwit embedded inside P2SH save fee compared to P2PKH?
• How do transaction costs compare between Bech32 addresses and legacy Bitcoin addresses?
• Segregated Witness Wallet Development Guide