<p>As far as I can tell, P2TR is better than P2WSH in almost every case. The leading assumption in the design of P2TR is of course, that you will prefer to use the keypath whenever possible, and that many more complex spending conditions can be shortcut by getting everyone to agree on signing off on the outcome directly in form of a keypath spend when the scriptpath spend would be able to enforce the same outcome.</p>
<p>Especially in the context of multisig and script trees with several leaves, the P2TR construction is superior, but there is one except in which you should always prefer P2WSH. Whenever you only have a single script in the tree, anticipate that you will never use the keypath, and cannot benefit from public key aggregation, you should use a P2WSH output. The P2WSH output efficiently commits to a single script, whereas a P2TR scriptpath requires the controlblock to reveal the leafscript in the tree that adds 34 weight units to the input’s witness stack. Another advantage is of course that some senders will not be able to create P2TR outputs at first while sending support for P2WSH is already broadly implemented.</p>
<h2>Privacy</h2>
<p>P2TR outputs will stand out at first since there will be few of them. In the long term, the anonymity set of P2TR is likely to be larger since both single-sig uses and more complex conditions look the same when they are spent via the keypath.</p>
<h2>Engineering effort to adopt</h2>
<p>Sending to P2TR addresses will require wallets to implement support for Bech32m. Wallets that want to receive and spend P2TR outputs will need to implement the Schnorr signing algorithm, and reengineer any <code>OP_CHECKMULTISIG</code> based schemas with the op-codes available in Tapscript.</p>
<hr />
<p><sup>H/T to  Vojtěch Strnad for <a href="https://bitcoin.stackexchange.com/questions/123500/is-there-an-economic-incentive-to-use-p2wsh-over-p2tr?noredirect=1&amp;lq=1">correcting my original answer</a> by pointing out that P2WSH is more efficient in a single-script use-case. </sup></p>

CC BY-SA 4.0
2021-07-07T15:19:53.187Z
"both single-sig and multisig will look the same until spent" - don't you mean "when spent"?
Vojtěch Strnad
CC BY-SA 4.0
2021-07-08T01:40:09.627Z
@VojtěchStrnad: If you are thinking that the multiparty payment is implemented as an aggregated key, yes, either would be spent as a keypath-spend, but I was thinking here that the multisig would mean that the spenders use the scriptpath.
Murch
CC BY-SA 4.0
2021-07-08T01:59:50.687Z
Yes, keypath spends are an obvious method of increasing privacy of multisig transactions. I'm not really sure what privacy benefits would come from revealing the multisig script only after the spend – I see privacy as not having to reveal something, ever.
Vojtěch Strnad
CC BY-SA 4.0
2024-07-30T16:02:37.820Z
@VojtěchStrnad: I updated my answer to incorporate your comment.
Murch
CC BY-SA 4.0
2021-06-12T14:10:32.937Z
2024-07-30T16:02:21.993Z
2024-07-30T16:02:21.993Z
Murch
<p>Assuming users have upgraded their wallets to handle P2TR outputs and trust the validation rules of P2TR, would there be any advantage of using P2WSH over P2TR?</p>

<segregated-witness><taproot><p2wsh><p2tr>
Will P2TR make P2WSH obsolete?
Darius
# Will P2TR make P2WSH obsolete?

(Asked by: username_0 on 2021-06-12)

Assuming users have upgraded their wallets to handle P2TR outputs and trust the validation rules of P2TR, would there be any advantage of using P2WSH over P2TR?

**Tags:** segregated-witness, taproot, p2wsh, p2tr


---

## 1 answers

### Answer by username_1 on 2021-06-12. Score: 7 | Accepted answer

As far as I can tell, P2TR is better than P2WSH in almost every case. The leading assumption in the design of P2TR is of course, that you will prefer to use the keypath whenever possible, and that many more complex spending conditions can be shortcut by getting everyone to agree on signing off on the outcome directly in form of a keypath spend when the scriptpath spend would be able to enforce the same outcome.

Especially in the context of multisig and script trees with several leaves, the P2TR construction is superior, but there is one except in which you should always prefer P2WSH. Whenever you only have a single script in the tree, anticipate that you will never use the keypath, and cannot benefit from public key aggregation, you should use a P2WSH output. The P2WSH output efficiently commits to a single script, whereas a P2TR scriptpath requires the controlblock to reveal the leafscript in the tree that adds 34 weight units to the input’s witness stack. Another advantage is of course that some senders will not be able to create P2TR outputs at first while sending support for P2WSH is already broadly implemented.

## Privacy

P2TR outputs will stand out at first since there will be few of them. In the long term, the anonymity set of P2TR is likely to be larger since both single-sig uses and more complex conditions look the same when they are spent via the keypath.

## Engineering effort to adopt

Sending to P2TR addresses will require wallets to implement support for Bech32m. Wallets that want to receive and spend P2TR outputs will need to implement the Schnorr signing algorithm, and reengineer any `OP_CHECKMULTISIG` based schemas with the op-codes available in Tapscript.

---

H/T to username_2 for [correcting my original answer](https://bitcoin.stackexchange.com/questions/123500/is-there-an-economic-incentive-to-use-p2wsh-over-p2tr?noredirect=1&lq=1) by pointing out that P2WSH is more efficient in a single-script use-case.

> **Comments:**
> **username_2**: "both single-sig and multisig will look the same until spent" - don't you mean "when spent"?  
> **username_1**: @username_2: If you are thinking that the multiparty payment is implemented as an aggregated key, yes, either would be spent as a keypath-spend, but I was thinking here that the multisig would mean that the spenders use the scriptpath.  
> **username_2**: Yes, keypath spends are an obvious method of increasing privacy of multisig transactions. I'm not really sure what privacy benefits would come from revealing the multisig script only after the spend – I see privacy as not having to reveal something, ever.  
> **username_1**: @username_2: I updated my answer to incorporate your comment.  

---

