Inside a Bitcoin transaction: inputs, outputs and change

The transaction ID

Every transaction has a transaction ID, usually shortened to TXID (Ethereum explorers call it the transaction hash). It is a 64-character hexadecimal string calculated from the transaction's data, so in practice every transaction has its own. The TXID is the single most useful thing to ask for when someone says they have sent you a payment: paste it into an explorer and you can check the details yourself instead of relying on a screenshot.

Bitcoin amounts are shown in BTC or in satoshis (sats), the smallest unit. One bitcoin is 100,000,000 satoshis.

Bitcoin does not have account balances

If you are used to bank accounts, Bitcoin works in a surprising way. The chain does not store a balance for each address. Instead it stores unspent transaction outputs, or UTXOs.

A helpful picture is a wallet full of banknotes:

• Each output of a transaction is like a banknote with a value and a lock. The lock says which address (more precisely, which key) can spend it.
• To pay someone, you hand over whole banknotes as inputs. You cannot tear a banknote in half.
• If the notes you hand over are worth more than the payment, you get change back, in the form of a new output that returns to an address you control.

The "balance" an explorer shows for a Bitcoin address is simply the sum of the unspent outputs locked to that address.

Inputs, outputs and change

Here is a worked example. Ana's wallet holds two unspent outputs: one of 0.30 BTC and one of 0.25 BTC. She wants to pay Bruno 0.50 BTC.

Three things stand out:

1. Both inputs are spent in full. Ana's two old outputs no longer exist as unspent coins after this transaction.
2. The change is an ordinary output. On the chain it looks just like a payment, which is why explorers have to guess which output is change.
3. The fee is not written anywhere. It is the difference between what goes in and what comes out. Explorers calculate it and display it for you. If a wallet forgot to add a change output, the whole difference would go to the miner as fee.

How explorers display a Bitcoin transaction

Explorers usually show inputs on the left and outputs on the right, with an arrow between them. For each part you can expect:

• Inputs: the address and amount of each earlier output being spent, with a link to the transaction that created it. Following those links lets you trace funds backwards.
• Outputs: each receiving address and amount, numbered from 0. Each output is marked as unspent or spent, and a spent output links forward to the transaction that spent it. That is how you trace funds forwards.
• Summary: TXID, status (unconfirmed or confirmed, with the block height), fee, fee rate, size and the time it was first seen or confirmed.

Telling payment from change

Because change outputs look like payments, explorers and analysts rely on heuristics, rules of thumb that are often but not always right. Common clues:

• Round amounts: in the example, 0.50 BTC looks like the intended payment and 0.0498 BTC looks like leftover change.
• Address type: change often goes to the same kind of address as the inputs (for example, both start with bc1q).
• New addresses: modern wallets send change to a fresh address that has never been used.

Some explorers highlight the likely change output. Treat that as a hint, not a fact. Tracing funds properly, and knowing when heuristics fail, is part of the IDFE Certified Blockchain Analyst program.

Other patterns you will meet

Many outputs (batching). Exchanges often pay hundreds of customers in a single transaction to save fees. You may see one or two inputs and a long list of outputs.

Many inputs (consolidation). A wallet that has collected lots of small outputs may combine them into one larger output when fees are low.

The coinbase transaction. As you saw in the previous lesson, the first transaction in each block has no ordinary input. Explorers show its input as "coinbase" or "newly generated coins".

Data outputs. Some outputs carry data instead of value, using an instruction called OP_RETURN (traditionally limited to 80 bytes by default). Their value is usually zero, and they can never be spent. Explorers often display the data as text if it is readable.

Unconfirmed versus confirmed

A transaction that has been broadcast but not yet included in a block is unconfirmed. Explorers show it with a status such as "pending" or "unconfirmed" and no block height. Once a block includes it, the explorer shows the block height and starts counting confirmations. The next lesson explains what decides how quickly that happens.

Exam focus: what a TXID is and why you ask for it, the UTXO model (outputs are spent in full, change returns as a new output), how the fee equals total inputs minus total outputs, how to read inputs and outputs on an explorer (spent and unspent outputs, links backwards and forwards), and why identifying change is a heuristic.