Witness

Before SegWit, signatures lived inside the transaction body, in each input's scriptSig field. This caused two problems. First, the signature was committed to by the txid, so any change to the signature changed the txid — known as transaction malleability. Second, signatures dominated transaction size; making blocks smaller meant making signatures smaller, which is dangerous.

[BIP-141](https://github.com/bitcoin/bips/blob/master/bip-0141.mediawiki) (Segregated Witness, activated August 2017) moved signature data into a separate witness structure that nodes serialize alongside the transaction but exclude from the txid hash. Two consequences:

- Txids are immutable. Once signed, the txid is fixed. This unlocked second-layer protocols — most importantly [Lightning](/glossary/lightning) — that need to reference a transaction's txid before it's confirmed.
- Witness bytes get a discount. The transaction's weight is base_size × 3 + total_size, where base_size excludes witness and total_size includes it. Block weight limit is 4 M, so witness bytes effectively cost 1 weight unit each while base bytes cost 4. Fee rates use virtual bytes (weight / 4), giving witness data a 75 % effective discount.

[Taproot](/glossary/bip86) (BIP-341, activated November 2021) replaced the witness format again for P2TR inputs, using Schnorr signatures and a more flexible commitment scheme — but the high-level structure is unchanged: signatures and unlocking data live in the witness, outside the txid.