BA-10 · LESSON 03

PayJoin and silent payments

KEY DEFINITIONS

Terms used in this lesson

ECDH: Elliptic-curve Diffie-Hellman: a key-agreement calculation that lets two parties independently derive the same shared point without publishing their private scalars.
IP address: Internet Protocol address: a network identifier that can reveal where a connection originated.

Receiver-assisted construction and reusable scanning addresses reduce common transaction graph signals.

55 min Difficulty 3/5 Not started

VISUAL MODEL

See the whole mechanism before going step by step

Use the diagrams to orient yourself. Then the guided explanation below teaches every part in depth.

4 explanatory views

CONCEPT-SPECIFIC MAP · privacy boundaryObservable evidence creates inferences, not automatic proofSelect any state to inspect its exact role.

RELATIONSHIP MAPCompeting paths and resolution

01
OBSERVABLEAmount, script, timing
Chain and network observers see different subsets of transaction and propagation data.
02
HEURISTICProbabilistic link
Wallet patterns can support a guess but do not prove a real-world identity.
03
RISKPayJoin and silent payments
The PayJoin and silent payments lesson identifies which evidence or failure is in scope.
04
CONTROLReduce or separate evidence
Address discipline, coin selection, local verification, and routing choices change exposure.
05
RESIDUALExplicit remaining observer
Every mitigation leaves assumptions and observers that must be named honestly.

Rule shown: Privacy improves by reducing linkable evidence and separating observers, while preserving verifiable spending rules.

STAGE 1 OF 5OBSERVABLE: Amount, script, timing

Chain and network observers see different subsets of transaction and propagation data.

Governing relationship: Privacy improves by reducing linkable evidence and separating observers, while preserving verifiable spending rules. Complete path: 1. OBSERVABLE, Amount, script, timing. Chain and network observers see different subsets of transaction and propagation data. 2. HEURISTIC, Probabilistic link. Wallet patterns can support a guess but do not prove a real-world identity. 3. RISK, PayJoin and silent payments. The PayJoin and silent payments lesson identifies which evidence or failure is in scope. 4. CONTROL, Reduce or separate evidence. Address discipline, coin selection, local verification, and routing choices change exposure. 5. RESIDUAL, Explicit remaining observer. Every mitigation leaves assumptions and observers that must be named honestly.

1. State transitionWhat exists, what changes, and what results

BEFORE

Sender intends to pay receiver 50,000 sats. Receiver adds a 30,000-sat input and the final PayJoin creates an 80,000-sat receiver output plus sender change.

MECHANISM

For PayJoin, the sender creates or describes an initial transaction and contacts a receiver endpoint over an authenticated or privacy-aware channel.

AFTER

PayJoin creates ambiguity through joint inputs; silent payments avoid address reuse through per-transaction derived output keys.

Text equivalent: Starting from Sender intends to pay receiver 50,000 sats. Receiver adds a 30,000-sat input and the final PayJoin creates an 80,000-sat receiver output plus sender change. The mechanism begins when For PayJoin, the sender creates or describes an initial transaction and contacts a receiver endpoint over an authenticated or privacy-aware channel. The resulting lesson is PayJoin creates ambiguity through joint inputs; silent payments avoid address reuse through per-transaction derived output keys.

2. Mechanism pathSelect a stage to inspect its job

STAGE 1 OF 5

Begin from an ordinary payment

For PayJoin, the sender creates or describes an initial transaction and contacts a receiver endpoint over an authenticated or privacy-aware channel.

Complete path: 1. Begin from an ordinary payment: For PayJoin, the sender creates or describes an initial transaction and contacts a receiver endpoint over an authenticated or privacy-aware channel. 2. Add receiver contribution: The receiver proposes one of its inputs and adjusted outputs. The sender checks that payment intent, fees, and ownership constraints remain safe. 3. Sign only owned inputs: Each party signs its own inputs after validating the complete revised transaction. The result resembles a multi-input payment but inputs have different owners. 4. Derive silent-payment outputs: For a silent payment, the sender combines input secret data with the receiver's published scan and spend keys to derive a one-time output key. 5. Scan and spend privately: The receiver scans relevant transactions, derives candidate shared secrets, recognizes matching outputs, and later spends with the corresponding derived private key.

3. Rule and failure boundaryWhat accepts the result and where it can stop

ACCEPTED PATH

PayJoin conserves the collaborative transaction and checks each party's net flow; silent output derivation makes sender and receiver secp256k1 shared points and tweaked keys agree.

CHANGED CONDITION

An unauthorized sender debit is rejected before signing, while changing output index changes the one-time key and endpoint metadata remains outside on-chain privacy.

Important distinction: PayJoin and silent payments provide anonymity against every network and wallet observer. They improve on-chain patterns. Endpoint communication, IP data, input history, scanning behavior, wallet compromise, and later spending can still reveal links.

Text equivalent: The accepted path is enforced by PayJoin conserves the collaborative transaction and checks each party's net flow; silent output derivation makes sender and receiver secp256k1 shared points and tweaked keys agree. If the required condition changes, An unauthorized sender debit is rejected before signing, while changing output index changes the one-time key and endpoint metadata remains outside on-chain privacy.

Loading lesson visuals...

Learn the idea

PayJoin is an interactive payment where the receiver contributes an input and the sender builds a revised transaction, weakening simple common-input and payment-amount heuristics. A silent payment address is a reusable public identifier from which each sender derives a unique on-chain output key. Sender and receiver use elliptic-curve Diffie-Hellman (ECDH), a key-agreement calculation that lets them independently derive the same shared point without publishing their private scalars. The receiver scans transaction input keys to detect outputs without publishing a fresh address for every payment.

GUIDED EXPLANATION1/5 ideas inspected

Begin from an ordinary payment

For PayJoin, the sender creates or describes an initial transaction and contacts a receiver endpoint over an authenticated or privacy-aware channel.

The worked example follows the explanation

Inspect every idea above to open it.

Important distinction“PayJoin and silent payments provide anonymity against every network and wallet observer.”

They improve on-chain patterns. Endpoint communication, IP data, input history, scanning behavior, wallet compromise, and later spending can still reveal links.

FINISH LEARNING FIRST

The questions unlock after every required learning activity

Inspect every guided idea, open the worked example, rebuild its mechanism, and complete the deterministic lesson tool. Your progress is saved automatically.