PayJoin and PayNym

Introduction: Beyond Basic Privacy

In Stage 2, you learned the fundamentals of Bitcoin privacy: UTXO management, avoiding address reuse, and running your own node. Those techniques reduce information leakage, but they don't actively break blockchain analysis heuristics.

This module covers two powerful advanced privacy tools: PayJoin (BIP78) and PayNym (BIP47). These techniques actively confuse blockchain analysts and provide privacy that's "built into" regular transactions.

PayJoin (BIP78): Breaking the Common Input Heuristic

PayJoin (also called P2EP, Pay-to-Endpoint) is a protocol where the receiver contributes inputs to the transaction. This breaks the fundamental assumption that blockchain analysts rely on.

The Common Input Ownership Heuristic

Recall from Stage 2: analysts assume that all inputs in a transaction belong to the same entity. This is how they cluster addresses and track funds.

How PayJoin Breaks This

In a PayJoin transaction, BOTH the sender AND the receiver contribute inputs:

The transaction looks completely normal—analysts can't tell it's a PayJoin just by looking at it. But their clustering heuristic is now broken. They'll incorrectly link the sender's and receiver's addresses.

How PayJoin Works (Technically)

1. Sender creates a normal transaction (called the "Original PSBT")
2. Sender sends it to receiver's PayJoin endpoint (a URL, usually via BIP21 URI)
3. Receiver adds their own input(s) and modifies outputs
4. Receiver sends back the modified PSBT
5. Sender verifies it's correct (their payment is still included, no funny business)
6. Sender signs and broadcasts

PayJoin in Practice

Limitations of PayJoin

• Requires cooperation: Receiver must run a PayJoin server
• Receiver must be online: Can't do PayJoin to a static address
• Limited adoption: Not many merchants/receivers support it yet
• Detectable if repeated: If a receiver always adds the same UTXO, patterns emerge

PayNym (BIP47): Reusable Payment Codes

The second privacy tool in this module is PayNym, based on BIP47 (Reusable Payment Codes). It solves a different problem: how to receive payments repeatedly without reusing addresses or requiring interactive communication.

The Problem: Static Addresses vs. Privacy

Consider a freelancer who wants to put a Bitcoin address on their website for tips:

• Option 1: Single address — Address reuse destroys privacy. Everyone sees all payments.
• Option 2: Generate fresh address each time — Requires interaction ("email me for payment address")
• Option 3: Lightning invoice — Also requires interaction, expires quickly

PayNym provides a fourth option: a public payment code that can generate unlimited unique addresses, without the sender needing to contact you.

How PayNym Works

A PayNym is a public payment code that looks like this:

But humans don't use these directly. Instead, PayNym creates a friendly "Nym" identity:

• +silentpanda
• +mellowhawk
• +brightmoon

These human-readable names map to the full payment code and can be looked up via the PayNym directory.

The Connection Process

Before someone can pay your PayNym, they must "connect" to you. This is a one-time process:

1. Sender looks up your PayNym (+yourname)
2. Sender sends a "notification transaction" to establish the connection
3. Both wallets now share a secret (derived from ECDH key exchange)
4. Sender can generate unlimited unique addresses for you
5. Only you can spend from those addresses (your keys)

Privacy Benefits of PayNym

• No address reuse: Each payment goes to a unique address
• No public address leak: Your PayNym is public, but the actual addresses are not
• Non-interactive: After connection, sender doesn't need your cooperation
• Stealth addresses: Only you and the sender know which addresses belong to your PayNym

PayNym in Practice

Use Cases for PayNym

• Receiving donations: Put your PayNym on your website/profile instead of an address
• Paying friends regularly: Connect once, pay forever with fresh addresses
• Business payments: Clients connect to your PayNym, pay invoices privately
• Any recurring payment: Rent, subscriptions, allowances, etc.

Limitations of PayNym

• Notification transaction cost: First connection requires an on-chain transaction
• Not widely adopted: Both parties need BIP47-compatible wallets
• PayNym directory is centralized: The name lookup service (paynym.is) is a central point
• Notification transaction is visible: Creates an on-chain link (though obfuscated)

Combining Privacy Techniques

The most powerful privacy comes from combining multiple techniques. Here's how the tools you've learned work together:

Practical Privacy Levels