Bitcoin wasn’t built to store documents, photos, or messages. It was designed to move money-securely, irreversibly, and without middlemen. But over time, people found a way to use it for something else: anchoring data directly into the blockchain. The tool that made this possible? OP_RETURN is a Bitcoin script opcode that lets users embed up to 80 bytes of arbitrary data into a transaction while marking it as unspendable. It’s not a feature for sending value. It’s a feature for proving something existed at a specific time.
Why OP_RETURN Exists
Before OP_RETURN, people tried to store data in Bitcoin transactions by stuffing it into the public key hash field of standard outputs. That sounds clever, but it had a deadly side effect: it created unspendable outputs that never got cleaned up. These stuck around in the UTXO set-the database of all unspent coins nodes must track. By 2014, this was bloating Bitcoin’s core infrastructure. Nodes had to store more data just to keep the network running, and that slowed things down.
The Bitcoin Core team didn’t want to ban data storage outright. They also didn’t want to let it choke the network. So in March 2014, with Bitcoin Core 0.9.0, they introduced OP_RETURN as a clean, intentional way to mark data as non-monetary. Instead of hiding data in a coin’s script, you put it in a dedicated output that nodes know to ignore when calculating balances. Think of it like a mailbox with a sign that says “Not for mail-just for notes.”
How OP_RETURN Works
Here’s the simple version: when you create a transaction with an OP_RETURN output, you’re not sending Bitcoin to anyone. You’re burning it. The output has a value of zero satoshis (or it won’t be accepted). The script starts with the OP_RETURN opcode, followed by a data push command like OP_PUSHBYTES_80, then your 80 bytes of data-usually in hex.
For example, if you want to store the text “Hello World” in a transaction, you’d convert it to hex: 48656c6c6f20576f726c64. Then you build a transaction output with this script:
OP_RETURNOP_PUSHBYTES_1148656c6c6f20576f726c64
Once confirmed, that data is permanently written into the blockchain. No one can spend it. No one can alter it. And because it’s marked as unspendable, nodes can safely remove it from their UTXO set-keeping the network lean.
What You Can Store
Eighty bytes doesn’t sound like much. But it’s enough for:
- A digital signature or hash of a document (like a contract or certificate)
- A timestamped proof of ownership for a file
- A small URL pointing to off-chain data (e.g., an IPFS hash)
- Metadata for tokens-like the Runes protocol uses to create fungible tokens on Bitcoin
Since April 2024, Runes has become the biggest driver of OP_RETURN usage. Each Runestone (a token creation) uses exactly 80 bytes to encode its symbol, name, and supply. By Q4 2025, Runes accounted for 63% of all OP_RETURN transactions, according to mempool.space.
Other common uses include:
- Proof-of-existence services (e.g., notarizing a document)
- Game assets or collectibles
- Supply chain tracking codes
- Decentralized identity markers
How It Compares to Other Methods
Some people try to store data by abusing standard Bitcoin outputs. That’s bad. It fills up the UTXO set and slows down nodes. Others use Ethereum, where you can shove 128KB of data into a transaction. But Ethereum fees are way higher. At current rates, storing 80 bytes on Bitcoin costs about $0.03. On Ethereum? Around $1.27. That’s 97.6% cheaper.
Still, if you need to store a 10MB PDF, neither Bitcoin nor Ethereum is practical. That’s where IPFS comes in. You store the file on IPFS, get its hash, then use OP_RETURN to anchor that hash to Bitcoin. This way, you get Bitcoin’s permanence and immutability, with IPFS’s cheap storage. A 2025 University of Zurich study showed this combo is 4,300 times cheaper than trying to store the same file with multiple OP_RETURN outputs.
Who Uses It-and Why
Most OP_RETURN usage comes from individuals and small projects. Chainalysis found that 89% of transactions are non-commercial. But enterprise adoption is growing. Companies like Proof of Existence use it daily to timestamp legal documents, contracts, and patents. They charge $0.15 per transaction-far less than traditional notarization.
The Runes protocol has turned OP_RETURN into a financial tool. It’s not a sidechain. It’s not a layer-two. It’s just Bitcoin with a new way to label outputs. And it’s working. In Q4 2025, over 7 million Runes were created using OP_RETURN. That’s more than 90% of all Bitcoin-based token activity.
Limitations and Criticisms
Not everyone loves OP_RETURN. Critics like Peter Todd argue it contradicts Bitcoin’s purpose: to be money, not a data ledger. They say every OP_RETURN output burns coins-coins that could’ve gone to miners as fees. And while nodes can prune these outputs from the UTXO set, the full blockchain still grows. As of February 2026, OP_RETURN data makes up 0.7% of Bitcoin’s total size-about 2.1GB. That’s not much, but if usage keeps rising, it could become a problem.
Another issue? The transition to multiple OP_RETURN outputs per transaction. Before Bitcoin Core v30.0 (released October 2025), you could only have one per transaction. Now you can have several. That’s great for developers building complex protocols-but it’s also a recipe for confusion. GitHub issues and Reddit threads are full of developers who accidentally built broken transactions because they didn’t realize the rules changed.
What’s Next?
The future of OP_RETURN is tied to Bitcoin’s evolution. The BIP 352 draft, submitted in January 2026, proposes a standardized format for future data protocols. This would prevent conflicts between Runes, Bitcoin NFTs, and whatever comes next. If adopted, it’ll land in Bitcoin Core v31.0 (expected Q3 2026).
Will OP_RETURN be removed? Almost certainly not. As Bitcoin Core contributor Johnson Lau said in January 2026: “OP_RETURN has become indispensable for Bitcoin’s second-layer ecosystems. Removal is technically and politically impossible.” The 2026 Bitcoin Developer Survey confirmed this: 92% of core contributors see it as a permanent part of the protocol.
Getting Started
If you’re a developer and want to try it:
- Use a Bitcoin library like BitcoinJS or libbitcoin.
- Create a transaction with an output whose script starts with
OP_RETURN. - Push your data (up to 80 bytes) after it. Always prefix it with a 4-byte identifier like
52554e45for “RUNE” to avoid collisions. - Set the output value to 0 satoshis. Any value above zero will make the transaction non-standard.
- Send it. Wait for confirmation. Your data is now on the blockchain.
Common mistakes? Using a non-zero value (43% of StackExchange questions in 2025), exceeding 80 bytes (28%), or assuming you can only have one OP_RETURN per transaction (19%). The Learn Me A Bitcoin guide and Bitcoin Core’s script interpreter source code are your best references.
Final Thoughts
OP_RETURN isn’t glamorous. It doesn’t make headlines like Taproot or Lightning. But it’s quietly essential. It lets Bitcoin do more than just move money. It lets it timestamp, verify, and prove. And in a world where trust in institutions is crumbling, that’s powerful. You don’t need a government or a notary to prove you had something on February 7, 2026. You just need one Bitcoin transaction with an OP_RETURN.
Can I store any type of data using OP_RETURN?
Yes, but only up to 80 bytes per output. That’s enough for hashes, small text, timestamps, or protocol identifiers. You can’t store images, videos, or large files directly. For those, store them off-chain (like on IPFS) and use OP_RETURN to anchor their hash.
Is OP_RETURN data permanent?
Yes. Once confirmed and buried under six blocks, the data becomes part of Bitcoin’s immutable history. Full nodes may prune it from their UTXO set, but the transaction remains in the blockchain forever. Anyone can verify it by downloading the full chain.
Do I need to pay Bitcoin to use OP_RETURN?
You don’t send Bitcoin to anyone, but you do pay transaction fees. The fee depends on the size of your transaction and current network conditions. At 50 satoshis/byte (Feb 2026), a typical OP_RETURN transaction costs about $0.03 USD.
Can multiple OP_RETURN outputs be used in one transaction?
Yes, since Bitcoin Core v30.0 (October 2025). Before that, only one was allowed. Now you can include multiple, which is useful for complex protocols like Runes or multi-asset token systems. Just ensure each output follows the 80-byte limit and has a zero value.
Is OP_RETURN regulated?
No. The Financial Action Task Force (FATF) specifically exempted OP_RETURN data from virtual asset regulations in June 2025 because it cannot represent value transfer. It’s treated as metadata, not a financial instrument.
Why not use Ethereum instead of OP_RETURN?
Ethereum allows much larger data payloads (128KB), but it’s far more expensive. At current fees, storing 80 bytes costs $1.27 on Ethereum versus $0.03 on Bitcoin. For small, timestamped data, Bitcoin is more efficient. Ethereum is better for complex smart contracts-not simple anchoring.
What happens if I exceed the 80-byte limit?
The transaction will be rejected by nodes as non-standard. It won’t be relayed or mined. You’ll lose your fee, and your data won’t be recorded. Always double-check your data length before broadcasting.
Can I retrieve data from OP_RETURN later?
Yes. Any blockchain explorer that indexes OP_RETURN data (like mempool.space or Blockstream.info) can show you the raw hex. You’ll need to decode it manually or use a tool that understands the protocol (e.g., Runes viewers). There’s no built-in search function-you have to know the transaction ID or address.
