PayJoin and Silent Payments — Next-Gen Bitcoin Privacy

PayJoin and Silent Payments

CoinJoin is powerful but has a visibility problem — chain analysis firms can identify CoinJoin transactions by their structure. PayJoin and Silent Payments are the next evolution of Bitcoin privacy, designed to be undetectable.

PayJoin (P2EP — Pay to Endpoint)

A PayJoin looks like a normal transaction but includes inputs from both the sender and receiver. This breaks the fundamental assumption chain analysis relies on: that all inputs belong to the sender.

How It Works

1. Alice wants to pay Bob 0.3 BTC
2. Instead of Alice creating a standard transaction, Bob's wallet also contributes an input (say 0.2 BTC)
3. The transaction has inputs from both Alice and Bob, and outputs to both
4. To an outside observer, it looks like Alice spent 0.5 BTC total — but actually 0.2 of that was Bob's

Chain analysis firm sees what looks like a normal transaction and draws completely wrong conclusions about the amounts and ownership. Every PayJoin poisons the dataset that analysis firms use.

Why PayJoin is Powerful

• Undetectable: PayJoins look identical to normal transactions
• Breaks amount analysis: Observed amounts don't match actual transfer amounts
• No extra fees: The transaction is the same size as a normal one
• Degrades surveillance for everyone: Even people not using PayJoin benefit because analysts can't be sure any transaction ISN'T a PayJoin

PayJoin Implementations

• BIP 78: The original PayJoin specification (requires receiver to be online)
• Serverless PayJoin (BIP 77): Newer proposal allowing asynchronous PayJoin using a relay directory
• Sparrow Wallet: Supports BIP 78 PayJoin
• BTCPay Server: PayJoin support for merchants

Silent Payments (BIP 352)

Silent Payments solve the address reuse problem without requiring interaction between sender and receiver.

The Problem

Currently, if you post a Bitcoin address publicly (for donations, for example), everyone who pays to it creates a linked transaction. An observer can see all incoming payments to that address.

You could generate unique addresses for each sender, but that requires interaction (the receiver must provide a fresh address for each payment).

How Silent Payments Work

1. Bob publishes a silent payment address (a special public key)
2. Alice's wallet uses Bob's silent payment address combined with her own transaction inputs to derive a unique, one-time address
3. The payment goes to this derived address — which only Bob can detect and spend from
4. Each sender automatically generates a different address for Bob. No interaction needed

The result: Bob posts one static address, but every payment creates a unique on-chain address. No linking between payments is possible.

Trade-offs

• Scanning cost: Bob's wallet must scan every transaction to find payments. This is computationally expensive
• Light client challenge: Full scanning requires access to all transactions, making light wallets harder
• New address format: Silent payment addresses are longer and require wallet support

The Combined Future

Imagine a world where PayJoin is default for every merchant payment and Silent Payments are standard for receiving. Every transaction looks normal but breaks analysis assumptions. Every address is unique without coordination. That's the privacy level Bitcoin should have.

The best privacy technology is the kind you don't know you're using. PayJoin and Silent Payments move us toward a future where Bitcoin privacy is automatic, not optional.

Set up privacy tools with our guides at the learning center.