BIP 86
Key Derivation for Single Key P2TR Outputs
Original title: Key Derivation for Single Key P2TR Outputs
- Status
- Deployed
- Type / Layer
- Specification / Applications
- Author
- Ava Chow
- Assigned
- Status verified
- Source
- github.com/bitcoin/bips/blob/master/bip-0086.mediawiki
Summary
Defines how HD wallets derive keys for single-key P2TR (Taproot) outputs. It reuses the m / purpose' / coin_type' / account' / change / address_index hierarchy introduced by BIP44 and assigns 86' at the purpose level. The point is recoverability: a wallet backed up with nothing but its seed can still find these coins, because the purpose value tells recovery software that keys on this branch are used as P2TR. The specification deliberately mirrors the wording of BIP49 and BIP84 so implementers have little extra to do. A derived public key is not used as an address directly; it becomes the Taproot internal key P and is tweaked into an output key as Q = P + int(HashTapTweak(bytes(P)))G. Crucially the tweak commits to no script tree, so the resulting output has no script path and can only be spent through the key path. The scriptPubKey takes the form "1 <output key>", and the address is encoded in Bech32m, hence the bc1p prefix.
Why it matters
It gives Taproot its own compartment in wallet derivation, so bc1p addresses fit into existing HD practice — one seed as the whole backup, separate accounts, watch-only monitoring — without new machinery. It is deliberately minimal: only single-key P2TR is covered, and Taproot outputs with multisig or a script tree fall outside it.
Related BIPs
Related articles
This page carries a summary, not a translation. The original document is authoritative, and the metadata above — including Status — was transcribed from the bips repository on the verification date shown. Always consult the original when implementing or verifying.