Glossary / Privacy & security
Silent payments
Also known as BIP352.
- Definition
- Silent payments let you publish one reusable address that never appears on the blockchain, because the sender uses it to compute a fresh, unlinkable destination for every payment.
Specified in BIP-352.
The static string you hand out is a pair of public keys, not a place coins go. Specified as BIP352 by josibake, Ruben Somsen, and Sebastian Falbesoner and created in March 2023, the scheme derives a new Taproot output for each payment from a secret only the sender and receiver can compute. You get the convenience of a reused address with none of the on-chain linkage.
How it works
In a silent payment, the sender does the address derivation, which is the trick that makes the rest work.
A silent payment address encodes two public keys, one for scanning and one for spending, in bech32m with the prefix sp1. The specification tells wallets to handle strings of at least 117 characters, so it is long enough that people share it as a QR code or a link rather than typing it. When someone pays you, their wallet performs a Diffie-Hellman exchange between the private keys of the inputs it is spending and your scan key. That produces a shared secret, the secret tweaks your spend key, and the result is an ordinary Taproot output that looks like every other Taproot output in the block. Nothing on chain connects it to the address you published, and two payments from two different senders share no visible relationship.
The cost lands on the receiver. Since no output carries your address, your wallet has to test candidate transactions in every block by repeating the same computation with your scan key. Wallets do this either by scanning locally, which costs sync time and battery but tells no server anything, or by leaning on an indexing service, which is faster and less private. Optional labels let you derive distinguishable variants of your address, so you can still tell a donation apart from a paycheck without publishing two identities.
Where you see it
Silent payment support is real but partial, and both ends of the payment need it.
Cake Wallet was the first mobile wallet with full sending and receiving, Sparrow covers the desktop, and Silentium exists as a reference implementation. Wasabi can send to an sp1 address. Bitcoin Core does not ship a silent payments wallet in any released version: the work has sat in pull request 28122 for years, although the cryptographic primitives now live in the bundled libsecp256k1 library.
The use case that justifies the complexity is public receiving. A donation address on a website, a tip address in a video description, a QR code on a poster, all of these are addresses that get reused by definition, and every payment to them stacks up in one public pile that shows the world your total take. A silent payment address solves that without an interactive step, which is the part earlier attempts at reusable addresses never managed.
Silent payments vs a unique address
A normal HD wallet already gives you a fresh address per payment, and for a two-person payment that is simpler, cheaper, and universally supported: you ask, they pay, nothing is derived. Silent payments matter when you cannot do the asking, because the address has to sit in public and be paid by strangers at unpredictable times. What you trade for that is scanning work and narrower wallet support, so most people should keep using fresh addresses for ordinary payments and reserve a silent payment address for the places their contact details are permanent.