Get certified
Guide

BIP-322 vs BIP-137: Bitcoin message signing explained

Bitcoin has two ways to sign a message. They prove the same thing, but tools that only understand one will reject the other.

Updated 13 Oct 2026

The classic format (BIP-137)

The original "Bitcoin Signed Message" dates back to the first Bitcoin client. The wallet hashes the text with a fixed prefix (Bitcoin Signed Message:) and signs it with the address's key, producing a 65-byte signature. The first byte says how to recover the public key, and the checker recovers it and compares it with the address.

It was designed for legacy 1… addresses. BIP-137 later defined header bytes for SegWit addresses (3… and bc1q…), but not every wallet adopted them: Electrum and Trezor mark SegWit signatures differently. A good checker accepts both.

Used by: Electrum, Trezor Suite, Bitcoin Core (legacy only), Sparrow's "Standard (Electrum)" format, and Xverse for its payment address in some versions.

The modern format (BIP-322)

BIP-322 works with any address type, including Taproot (bc1p…), which the classic format can't handle at all. Instead of a special signature type, it builds two virtual transactions that can never be broadcast: one "receives" to your address, committing to a hash of the message, and one "spends" it. Your wallet signs the spending one exactly as it would sign a real payment, and the signature is that transaction's witness data.

Because it reuses the normal spending rules, it can in principle prove ownership of any script, including multisig and time-locked ones (the "full" variant). For single-key addresses, the short "simple" variant is just the witness.

Used by: Xverse, Leather, UniSat, Sparrow ("BIP322" format), and other recent wallets.

How to tell them apart

  • BIP-137: exactly 88 characters of base64, starting with a capital letter from G to K.
  • BIP-322: longer, often starting AkcwRAIg or AkgwRQIh (SegWit) or AUA / AUE (Taproot). The latest version of the BIP also defines an optional prefix: smp for simple, ful for full.

Which one does VerifiedWallet use?

Both. Whatever your wallet produces, we check it: BIP-137 (including Electrum's and Trezor's SegWit variants) and BIP-322 simple and full, for 1…, 3…, bc1q… and bc1p… addresses. Our checker passes every official BIP-322 test vector for single-key addresses and refuses every one of the official "must fail" cases. The same code runs in the visitor's browser on each certificate page, so nobody has to take our word for it.

Multisig and other script addresses aren't certified yet: they need several signers and a full script check.

Further reading

Get a certificate anyone can check

Sign once with your wallet: free, no transaction. We counter-sign it and give you a link anyone can verify. From $1.

Get certified

More guides

How to prove you own a Bitcoin address

Sign a message with the address's key: free, instant, nothing on the blockchain.

How to sign a message with a Bitcoin wallet

Step by step in Xverse, Electrum, Sparrow, Trezor, Ledger and Bitcoin Core.

How to prove you own an Ethereum wallet

One signed message, no gas, and it covers every EVM network at once.

How to prove you own a Tron (USDT) wallet

Sign a message in TronLink: no transaction, no TRX burned, works for USDT addresses.

Questions

Why won't my Taproot signature verify in Electrum?

Taproot (bc1p) addresses can only sign with BIP-322, and Electrum's Verify message only checks the classic format. Use a BIP-322 checker such as Sparrow, or a VerifiedWallet certificate.

Is one format more secure than the other?

Both prove control of the address's key. BIP-322 is more general (it works for every address type), which is why newer wallets use it.