Key Path vs. Script Path

The "Magic" of Taproot lies in its dual-path spending mechanism. A single P2TR address can be spent in two completely different ways, but the blockchain only ever sees the way that was actually used.

1. The Key Path (The Fast Path)

The Key Path is used when everyone involved in the address agrees to sign the transaction.

• The Process: The signers create a single aggregated Schnorr signature.

• The Evidence: The blockchain sees only one signature and one public key.

• The Result: The transaction looks identical to a simple single-signature payment. This is the ultimate privacy win.

2. The Script Path (The Recovery Path)

The Script Path is used if the parties cannot agree or if a specific condition (like a timelock) is met.

• The Process: The spender reveals one specific branch of a hidden Merkle tree (a "Tapleaf").

• The Evidence: The blockchain sees the Witness Script for that branch and a "Merkle Proof" showing that this branch belongs to the address.

• The Result: The complex logic is finally revealed, but only the specific branch that was used. All other branches remain secret.

3. Why two paths?

Imagine a 2-of-3 multisig wallet for a business.

• Key Path: If the 3 partners agree, they sign a single Schnorr signature. It's cheap and private.

• Script Path: If one partner loses their key, the other 2 can reveal a hidden "2-of-3" script to move the funds.

4. Economic Incentive

Because the Key Path is significantly cheaper (fewer bytes revealed), users are incentivized to cooperate and use the private aggregated signature path whenever possible. This "encourages" privacy through economics.

Spending Path	Data Revealed	Privacy	Cost
Key Path	1 Signature	Highest	Lowest
Script Path	Script + Proof	Medium	Higher

In the next section, we will look at MAST, the technology that powers the Script Path.