𝒮 Schnorr Verifier

Taproot math playground — real secp256k1

1 Lift x-only coordinate to a point

In BIP 340, points are stored as 32 bytes (the x-coordinate only). To recover the full point, solve y² = x³ + 7 (mod p) and pick the even-y solution.

x (hex):

2 Scalar multiplication: compute k·P

Multiply a scalar k (a 256-bit integer) by a point P, using the double-and-add algorithm. Defaults to the secp256k1 generator G.

k (hex):

P.x (hex):

P.y (hex): blank = lift P.x

3 Full Schnorr verification — sG ?= R + eQ

Paste a signature (R_x, s), an output key (Q_x), and a message m. The tool computes each step of the BIP 340 verification equation.

R.x (hex):

s (hex):

Q.x (hex): output key

m (hex): 32-byte digest

All computations run in-browser on real secp256k1. No external API calls. Scalars reduced mod n; coordinates reduced mod p = 2²⁵⁶ − 2³² − 977.