Glossary / Privacy & security
Payjoin
Also known as P2EP, Pay-to-endpoint.
- Definition
- Payjoin is a payment where the person receiving the coins quietly adds one of their own inputs to your transaction, so the amount on chain no longer matches the amount you actually paid.
Specified in BIP-78.
Both sides contribute inputs, which breaks the rule analysts use to group addresses into wallets. Nicolas Dorier specified it as BIP78 in May 2019, and it is deployed rather than theoretical: BTCPay Server shipped support in 2020. For the payer, the transaction costs a little more in fees and looks completely ordinary.
How it works
The payjoin protocol is a short conversation that happens between the moment you hit send and the moment the transaction is broadcast.
Your wallet builds the payment as an unsigned PSBT, exactly as it would for a normal spend, and posts it to an endpoint the receiver advertised in the payment request. The receiver adds one of their own unspent outputs as a second input, increases their own output by that same amount so they still receive the correct payment, and sends the modified PSBT back. Your wallet checks that the destination and amount are unchanged, signs, and broadcasts.
What lands on chain has two inputs owned by two different people. An analyst applying the standard clustering rule will merge two strangers into one wallet, which is a false conclusion recorded permanently in their dataset. The payment amount is also gone: neither output equals what you paid, because the receiver's output is the payment plus their own contributed input. A watcher can no longer read the invoice off the transaction.
BIP78 caps the cost to you. The maxadditionalfeecontribution parameter states how many satoshis you are willing to pay for the extra input the receiver adds, so a receiver cannot quietly bloat your fee. If anything goes wrong, the endpoint is unreachable, the response is malformed, the amounts do not check out, your wallet falls back to broadcasting the original transaction. A failed payjoin is still a completed payment, which is why this can be enabled by default without breaking anything.
Receivers get a second benefit that has nothing to do with privacy. Every payjoin lets them fold one of their own coins into a transaction someone else is largely paying for, which is free housekeeping against a wallet full of small outputs.
Where you see it
Payjoin lives on the merchant side, so most people meet it without noticing.
BTCPay Server was the first production implementation and offers payjoin on invoices, which is why donation pages and self-hosted checkouts are where it turns up most. Wasabi and Sparrow can send to a payjoin endpoint from the desktop.
The original design's weakness was that the receiver had to run a public server and be online at the moment of payment, which limited it to merchants. BIP77, "Async Payjoin" by Dan Gould and Yuval Kogman, created in August 2023 and still a draft, replaces the direct endpoint with a store-and-forward directory reached over Oblivious HTTP, so two phone wallets can complete a payjoin without either being online at the same time. Bull Bitcoin and Cake Wallet have shipped that version in mobile apps, which is the first time payjoin has been available for ordinary person-to-person payments.
The strongest argument for using it is one you never see personally. Every payjoin in the dataset makes the common-input-ownership rule less reliable for everybody, including people who have never made one. Privacy techniques that only help their user are rare; this one degrades surveillance for the whole network with each transaction.