<p>the output address is derived solely from the output script starting <a href="https://en.bitcoin.it/wiki/Technical_background_of_Bitcoin_addresses" rel="noreferrer">from step 4 in the wiki</a> like so:</p>

<p>first add leading zeros:</p>

<pre><code>0012ab8dc588ca9d5787dde7eb29569da63c3a238c
</code></pre>

<p>then hash with sha256 (<a href="https://en.bitcoin.it/wiki/Script" rel="noreferrer">if you look in the wiki</a> this is actually part of the OP_HASH160 operation) to give:</p>

<pre><code>e158c4be10913422dadcf1c36843020ebb3ffe9d0cb13fb9e8c0a564a53c7832
</code></pre>

<p>then hashed with sha256 again (the wiki is wrong here - it says to use ripemd160, but actually sha256 is required again) to give:</p>

<pre><code>96bf1d277213bbcd91145138e4c7ad8dcd6e1de1c39884fcbc1f5a6d4d7aee93
</code></pre>

<p>then grab the first 4 bytes of this result (<code>96bf1d27</code>) and stick them on the end of the original hash160 public key with leading zeros:</p>

<pre><code>0012ab8dc588ca9d5787dde7eb29569da63c3a238c96bf1d27
</code></pre>

<p>convert to decimal:</p>

<pre><code>457790304922245030616719694560989441716273193824169172263
</code></pre>

<p>base58 encode to give:</p>

<pre><code>2higDjoCCNXSA95xZMWUdPvXNmkAduhWv
</code></pre>

<p>and stick a 1 in front of it all to get the bitcoin output address:</p>

<pre><code>12higDjoCCNXSA95xZMWUdPvXNmkAduhWv
</code></pre>

<p>now to figure out how to get the input addresses...</p>

<p><a href="https://bitcoin.stackexchange.com/a/12556/2116">thanks to this answer</a>, we can see that both the signatures are der encoded in the following format:</p>

<ul>
<li>0x30: a header byte indicating a compound structure</li>
<li>a 1-byte length descriptor for all what follows</li>
<li>0x02: a header byte indicating an integer</li>
<li>a 1-byte length descriptor for the r value</li>
<li>the r coordinate, as a big-endian integer</li>
<li>0x02: a header byte indicating an integer</li>
<li>a 1-byte length descriptor for the s value</li>
<li>the s coordinate, as a big-endian integer</li>
<li>a hashtype byte</li>
</ul>

<p>so, decoding the raw script signatures:</p>

<pre><code>493046022100e26d9ff76a07d68369e5782be3f8532d25ecc8add58ee256da6c550b52e8006b022100b4431f5a9a4dcb51cbdcaae935218c0ae4cfc8aa903fe4e5bac4c208290b7d5d01
</code></pre>

<ul>
<li>0x49 = OP_PUSHDATA0 - push 73 bytes onto the stack (script command not part of the signature value)</li>
<li>0x30 = header byte</li>
<li>0x46 = length descriptor (70 bytes)</li>
<li>0x02 = header byte</li>
<li>0x21 = r value length descriptor (33 bytes)</li>
<li><code>00e26d9ff76a07d68369e5782be3f8532d25ecc8add58ee256da6c550b52e8006b</code> the r coordinate as a big endian integer</li>
<li>0x02 = header byte</li>
<li>0x21 = s value length descriptor (33 bytes)</li>
<li><code>00b4431f5a9a4dcb51cbdcaae935218c0ae4cfc8aa903fe4e5bac4c208290b7d5d</code> the s coordinate as a big endian integer</li>
<li>0x01 = hashtype byte</li>
</ul>

<p>and the second raw signature has the same format too:</p>

<pre><code>493046022100a2ab7cdc5b67aca032899ea1b262f6e8181060f5a34ee667a82dac9c7b7db4c3022100911bc945c4b435df8227466433e56899fbb65833e4853683ecaa12ee840d16bf01
</code></pre>

<ul>
<li>0x49 = OP_PUSHDATA0 - push 73 bytes onto the stack (script command not part of the signature value)</li>
<li>0x30 = header byte</li>
<li>0x46 = length descriptor (70 bytes)</li>
<li>0x02 = header byte</li>
<li>0x21 = r value length descriptor (33 bytes)</li>
<li><code>00a2ab7cdc5b67aca032899ea1b262f6e8181060f5a34ee667a82dac9c7b7db4c3</code> the r coordinate as a big endian integer</li>
<li>0x02 = header byte</li>
<li>0x21 = s value length descriptor (33 bytes)</li>
<li><code>00911bc945c4b435df8227466433e56899fbb65833e4853683ecaa12ee840d16bf</code> the s coordinate as a big endian integer</li>
<li>0x01 = hashtype byte</li>
</ul>

<p>so this confirms that the signature values in the transaction inputs actually do not contain public keys at all. the input addresses actually come from the previous transaction outputs which can be identified through the input hash and input index in the current tx.</p>

CC BY-SA 3.0
2013-12-22T22:16:01.227Z
this may provide a method of getting the public key from the signature alone https://github.com/nanotube/supybot-bitcoin-marketmonitor/blob/master/GPG/local/bitcoinsig.py
mulllhausen
CC BY-SA 3.0
2013-12-23T07:44:52.050Z
also, this shows how the signature is created http://bitcoin.stackexchange.com/a/5241/2116
mulllhausen
CC BY-SA 3.0
2017-12-16T14:43:45.413Z
Great answer. Wish I could up vote more.
Jus12
CC BY-SA 3.0
2013-12-20T12:56:42.613Z
2015-03-10T06:03:17.237Z
2017-04-13T12:47:32.940Z
mulllhausen
<p>my solution was, that I passed the hex string to:</p>

<pre><code>    def publicKeyDecode(pub):
            hash1 = hashlib.sha256(binascii.unhexlify(pub))
            hash2 = hashlib.new('ripemd160', hash1.digest())
            padded = (b'\x00') + hash2.digest()
            hash3 = hashlib.sha256(padded)
            hash4 = hashlib.sha256(hash3.digest())
            padded += hash4.digest()[:4]
            return base58.b58encode(padded)
</code></pre>

CC BY-SA 3.0
2018-03-13T23:55:57.133Z
had to use `sha256` instead of `ripemd160` to get the correct address
Miguel
CC BY-SA 4.0
2019-12-14T21:53:07.153Z
Had to comment out the first line (pub = pub[2:-2]) to work with the public key (0250863ad64a87ae8a2fe83c1af1a8403cb53f53e486d8511dad8a04887e5b2352) on the wiki (https://en.bitcoin.it/wiki/Technical_background_of_version_1_Bitcoin_addresses)
Pedro
CC BY-SA 4.0
2020-02-10T09:26:55.190Z
Everything depends on the script itself. because it is a program. so you have to interpret it on your own. The above solution was a standard script decoding. Someone edited it, so its not correct for all scripts.
Erhard Dinhobl
CC BY-SA 4.0
2016-06-01T07:45:18.657Z
2020-02-01T19:28:38.797Z
2020-02-01T19:28:38.797Z
Erhard Dinhobl
<p>Here's a python3+ implementation for @mulllhausen's answer on parsing the Bitcoin address from the P2PKH script:</p>

<pre><code>import binascii
import hashlib
import base58

def P2PKHToAddress(pkscript, istestnet=False):
    pub = pkscript[6:-4] # get pkhash, inbetween first 3 bytes and last 2 bytes
    p = '00' + pub # prefix with 00 if it's mainnet
    if istestnet:
        p = '6F' + pub # prefix with 0F if it's testnet
    h1 = hashlib.sha256(binascii.unhexlify(p))
    h2 = hashlib.new('sha256', h1.digest())
    h3 = h2.hexdigest()
    a = h3[0:8] # first 4 bytes
    c = p + a # add first 4 bytes to beginning of pkhash
    d = int(c, 16) # string to decimal
    b = d.to_bytes((d.bit_length() + 7) // 8, 'big') # decimal to bytes
    address = base58.b58encode(b) # bytes to base58
    if not istestnet:
        address = '1' + address # prefix with 1 if it's mainnet
    return address

print(P2PKHToAddress("76a91412ab8dc588ca9d5787dde7eb29569da63c3a238c88ac")) # 12higDjoCCNXSA95xZMWUdPvXNmkAduhWv
</code></pre>

CC BY-SA 3.0
2018-03-13T23:51:14.163Z
2018-03-15T17:57:32.147Z
2018-03-15T17:57:32.147Z
Miguel
<p>can someone walk me through the process of combining script inputs and outputs to reveal the base58 encoded input and output addresses. take for example, <a href="http://blockexplorer.com/block/00000000d14f2e97678951ad004d6699babd27e07ca722c46b30dc24c67eed7a">block 728</a>. this has two raw script inputs:</p>

<pre><code>493046022100e26d9ff76a07d68369e5782be3f8532d25ecc8add58ee256da6c550b52e8006b022100b4431f5a9a4dcb51cbdcaae935218c0ae4cfc8aa903fe4e5bac4c208290b7d5d01

and

493046022100a2ab7cdc5b67aca032899ea1b262f6e8181060f5a34ee667a82dac9c7b7db4c3022100911bc945c4b435df8227466433e56899fbb65833e4853683ecaa12ee840d16bf01
</code></pre>

<p>the first byte of each (49 hex = 73 dec) is the instruction to push 73 bytes onto the stack. <a href="https://en.bitcoin.it/wiki/Script#Standard_Transaction_to_Bitcoin_address_.28pay-to-pubkey-hash.29">according to the wiki</a> each of these input scripts consists of a signature and a public key.</p>

<p>the raw output script is</p>

<pre><code>76a91412ab8dc588ca9d5787dde7eb29569da63c3a238c88ac
</code></pre>

<p>which translates to the instructions</p>

<pre><code>OP_DUP OP_HASH160 OP_PUSHDATA0(20 bytes) 12ab8dc588ca9d5787dde7eb29569da63c3a238c OP_EQUALVERIFY OP_CHECKSIG
</code></pre>

<p><strong>so given this information, how can i extract input addresses (as shown in blockexplorer.com)? is this even possible?</strong></p>

<pre><code>1Miuw7ifaTYY5qrzKYFcTDiojSFxRfAqwP and 18KrJNtPVu6LWRNPQReqF29iFm7vDhirMk
</code></pre>

<p>and output address</p>

<pre><code>12higDjoCCNXSA95xZMWUdPvXNmkAduhWv
</code></pre>

<script><public-key><signature>
parsing bitcoin input and output addresses from scripts
mulllhausen
# parsing bitcoin input and output addresses from scripts

(Asked by: username_0 on 2013-12-20)

can someone walk me through the process of combining script inputs and outputs to reveal the base58 encoded input and output addresses. take for example, block 728. this has two raw script inputs:
493046022100e26d9ff76a07d68369e5782be3f8532d25ecc8add58ee256da6c550b52e8006b022100b4431f5a9a4dcb51cbdcaae935218c0ae4cfc8aa903fe4e5bac4c208290b7d5d01

and

493046022100a2ab7cdc5b67aca032899ea1b262f6e8181060f5a34ee667a82dac9c7b7db4c3022100911bc945c4b435df8227466433e56899fbb65833e4853683ecaa12ee840d16bf01

the first byte of each (49 hex = 73 dec) is the instruction to push 73 bytes onto the stack. according to the wiki each of these input scripts consists of a signature and a public key.
the raw output script is
76a91412ab8dc588ca9d5787dde7eb29569da63c3a238c88ac

which translates to the instructions
OP_DUP OP_HASH160 OP_PUSHDATA0(20 bytes) 12ab8dc588ca9d5787dde7eb29569da63c3a238c OP_EQUALVERIFY OP_CHECKSIG

so given this information, how can i extract input addresses (as shown in blockexplorer.com)? is this even possible?
1Miuw7ifaTYY5qrzKYFcTDiojSFxRfAqwP and 18KrJNtPVu6LWRNPQReqF29iFm7vDhirMk

and output address
12higDjoCCNXSA95xZMWUdPvXNmkAduhWv

**Tags:** script, public-key, signature


---

## 3 answers

### Answer by username_0 on 2013-12-20. Score: 12

the output address is derived solely from the output script starting from step 4 in the wiki like so:
first add leading zeros:
0012ab8dc588ca9d5787dde7eb29569da63c3a238c

then hash with sha256 (if you look in the wiki this is actually part of the OP_HASH160 operation) to give:
e158c4be10913422dadcf1c36843020ebb3ffe9d0cb13fb9e8c0a564a53c7832

then hashed with sha256 again (the wiki is wrong here - it says to use ripemd160, but actually sha256 is required again) to give:
96bf1d277213bbcd91145138e4c7ad8dcd6e1de1c39884fcbc1f5a6d4d7aee93

then grab the first 4 bytes of this result (96bf1d27) and stick them on the end of the original hash160 public key with leading zeros:
0012ab8dc588ca9d5787dde7eb29569da63c3a238c96bf1d27

convert to decimal:
457790304922245030616719694560989441716273193824169172263

base58 encode to give:
2higDjoCCNXSA95xZMWUdPvXNmkAduhWv

and stick a 1 in front of it all to get the bitcoin output address:
12higDjoCCNXSA95xZMWUdPvXNmkAduhWv

now to figure out how to get the input addresses...
thanks to this answer, we can see that both the signatures are der encoded in the following format:

0x30: a header byte indicating a compound structure
a 1-byte length descriptor for all what follows
0x02: a header byte indicating an integer
a 1-byte length descriptor for the r value
the r coordinate, as a big-endian integer
0x02: a header byte indicating an integer
a 1-byte length descriptor for the s value
the s coordinate, as a big-endian integer
a hashtype byte

so, decoding the raw script signatures:
493046022100e26d9ff76a07d68369e5782be3f8532d25ecc8add58ee256da6c550b52e8006b022100b4431f5a9a4dcb51cbdcaae935218c0ae4cfc8aa903fe4e5bac4c208290b7d5d01


0x49 = OP_PUSHDATA0 - push 73 bytes onto the stack (script command not part of the signature value)
0x30 = header byte
0x46 = length descriptor (70 bytes)
0x02 = header byte
0x21 = r value length descriptor (33 bytes)
00e26d9ff76a07d68369e5782be3f8532d25ecc8add58ee256da6c550b52e8006b the r coordinate as a big endian integer
0x02 = header byte
0x21 = s value length descriptor (33 bytes)
00b4431f5a9a4dcb51cbdcaae935218c0ae4cfc8aa903fe4e5bac4c208290b7d5d the s coordinate as a big endian integer
0x01 = hashtype byte

and the second raw signature has the same format too:
493046022100a2ab7cdc5b67aca032899ea1b262f6e8181060f5a34ee667a82dac9c7b7db4c3022100911bc945c4b435df8227466433e56899fbb65833e4853683ecaa12ee840d16bf01


0x49 = OP_PUSHDATA0 - push 73 bytes onto the stack (script command not part of the signature value)
0x30 = header byte
0x46 = length descriptor (70 bytes)
0x02 = header byte
0x21 = r value length descriptor (33 bytes)
00a2ab7cdc5b67aca032899ea1b262f6e8181060f5a34ee667a82dac9c7b7db4c3 the r coordinate as a big endian integer
0x02 = header byte
0x21 = s value length descriptor (33 bytes)
00911bc945c4b435df8227466433e56899fbb65833e4853683ecaa12ee840d16bf the s coordinate as a big endian integer
0x01 = hashtype byte

so this confirms that the signature values in the transaction inputs actually do not contain public keys at all. the input addresses actually come from the previous transaction outputs which can be identified through the input hash and input index in the current tx.

> **Comments:**
> **username_0**: this may provide a method of getting the public key from the signature alone https://github.com/nanotube/supybot-bitcoin-marketmonitor/blob/master/GPG/local/bitcoinsig.py  
> **username_0**: also, this shows how the signature is created http://bitcoin.stackexchange.com/a/5241/2116  
> **username_1**: Great answer. Wish I could up vote more.  

---

### Answer by username_2 on 2016-06-01. Score: 2

my solution was, that I passed the hex string to:
    def publicKeyDecode(pub):
            hash1 = hashlib.sha256(binascii.unhexlify(pub))
            hash2 = hashlib.new('ripemd160', hash1.digest())
            padded = (b'\x00') + hash2.digest()
            hash3 = hashlib.sha256(padded)
            hash4 = hashlib.sha256(hash3.digest())
            padded += hash4.digest()[:4]
            return base58.b58encode(padded)

> **Comments:**
> **username_3**: had to use `sha256` instead of `ripemd160` to get the correct address  
> **username_4**: Had to comment out the first line (pub = pub[2:-2]) to work with the public key (0250863ad64a87ae8a2fe83c1af1a8403cb53f53e486d8511dad8a04887e5b2352) on the wiki (https://en.bitcoin.it/wiki/Technical_background_of_version_1_Bitcoin_addresses)  
> **username_2**: Everything depends on the script itself. because it is a program. so you have to interpret it on your own. The above solution was a standard script decoding. Someone edited it, so its not correct for all scripts.  

---

### Answer by username_3 on 2018-03-13. Score: 1

Here's a python3+ implementation for @username_0's answer on parsing the Bitcoin address from the P2PKH script:
import binascii
import hashlib
import base58

def P2PKHToAddress(pkscript, istestnet=False):
    pub = pkscript[6:-4] # get pkhash, inbetween first 3 bytes and last 2 bytes
    p = '00' + pub # prefix with 00 if it's mainnet
    if istestnet:
        p = '6F' + pub # prefix with 0F if it's testnet
    h1 = hashlib.sha256(binascii.unhexlify(p))
    h2 = hashlib.new('sha256', h1.digest())
    h3 = h2.hexdigest()
    a = h3[0:8] # first 4 bytes
    c = p + a # add first 4 bytes to beginning of pkhash
    d = int(c, 16) # string to decimal
    b = d.to_bytes((d.bit_length() + 7) // 8, 'big') # decimal to bytes
    address = base58.b58encode(b) # bytes to base58
    if not istestnet:
        address = '1' + address # prefix with 1 if it's mainnet
    return address

print(P2PKHToAddress("76a91412ab8dc588ca9d5787dde7eb29569da63c3a238c88ac")) # 12higDjoCCNXSA95xZMWUdPvXNmkAduhWv


---

