Pay-to-EndPoint (P2EP)

Pay-to-EndPoint (P2EP) is a cryptographic technique designed to improve financial privacy on transparent blockchains like Bitcoin. It operates as an extension of the CoinJoin concept, where multiple parties combine their funds into a single transaction to break the common-input-ownership heuristic used by blockchain analysts. In a standard P2EP transaction, a user and a cooperating service provider (the "endpoint") create a transaction with two inputs—one from each party—and two corresponding outputs. Crucially, the output belonging to the user is constructed using the provider's public key, and vice-versa, making it computationally difficult for external observers to determine which output belongs to which input owner.

The core innovation of P2EP is its use of Elliptic Curve Diffie-Hellman (ECDH) key exchange. When constructing the transaction, the user and provider exchange public keys and use ECDH to derive a shared secret. This secret is then used to generate a one-time, stealth address for the recipient's output. This process ensures that only the intended recipient can calculate the private key needed to spend the output, while onlookers see only seemingly unrelated public keys. This method effectively breaks the transaction graph by severing the visible link between a user's input address and their new output address, providing stronger anonymity than basic CoinJoin.

A practical implementation of P2EP is found in the BIP 78 PayJoin specification, which standardizes the protocol for Bitcoin. In a PayJoin, a merchant and a customer collaborate: the customer pays for goods, and the merchant adds an input and receives change, creating a transaction that looks like a simple self-transfer or change output to chain analysis tools. This not only enhances privacy for both parties but also improves UTXO management by consolidating coins without creating a privacy leak. The protocol is non-custodial and trust-minimized, as the collaborative construction happens interactively without either party gaining control over the other's funds.

Compared to other privacy solutions, P2EP offers distinct advantages and trade-offs. Unlike Confidential Transactions or zk-SNARKs, it does not require a consensus change or introduce new cryptographic assumptions to Bitcoin; it works within the existing script system. However, it requires active participation from a cooperative counterparty (the endpoint), which can limit spontaneity. Its privacy guarantee is also probabilistic and strengthens with adoption—the more entities that use PayJoin, the harder it becomes for analysts to distinguish private transactions from regular economic activity on the blockchain.

The development and adoption of P2EP represent a significant step toward practical, incremental privacy on Bitcoin. By integrating seamlessly with existing wallets and payment processors, it provides a viable on-ramp for users seeking better financial opacity without relying on separate mixing services or sidechains. As blockchain surveillance becomes more sophisticated, protocols like Pay-to-EndPoint demonstrate how collaborative cryptography can be leveraged to reclaim transactional privacy at the protocol level, making it a foundational tool for a more fungible digital cash system.

Pay-to-EndPoint (P2EP) is a collaborative transaction protocol designed to enhance privacy on UTXO-based blockchains like Bitcoin by breaking the common-input-ownership heuristic. It works by having two parties—a sender and a cooperative third-party endpoint—jointly create a single transaction where their inputs are mixed. Crucially, the transaction output structure is crafted so that an external observer cannot determine which input belongs to which participant, effectively obfuscating the link between the sender's coins and their ultimate destination. This method provides a form of coin mixing without requiring a dedicated mixing service or complex cryptographic constructs like Confidential Transactions.

The core mechanism involves the endpoint providing one or more of its own UTXOs as inputs alongside the sender's. The transaction is then constructed with at least two outputs: one that pays the sender's intended recipient and another that returns the endpoint's funds, minus a fee, back to an address they control. Because all participants' inputs are spent together and the outputs are not clearly mapped to individual inputs, blockchain analysts cannot reliably determine which output is the true payment and which is the change. This breaks the fundamental chain analysis assumption that all inputs to a transaction are controlled by the same entity.

A practical example is BIP 78, which standardizes P2EP for PayJoin transactions. In a retail scenario, a customer (sender) pays a merchant (endpoint). Instead of a simple one-input, two-output payment, the merchant contributes an input. The resulting transaction has outputs to the merchant's new receiving address and back to the customer's change address. To an outsider, it appears as a multi-party transaction with no clear spending trail, increasing privacy for both parties. This is more efficient than traditional CoinJoin as it integrates mixing into a legitimate economic transaction.

Key advantages of P2EP include its trust-minimized design—the endpoint cannot steal funds as the transaction is collaboratively signed—and its positive impact on the UTXO set by not creating additional wasteful outputs. However, its privacy guarantees depend on the endpoint's cooperation and the inability of analysts to deanonymize participants through other metadata or timing analysis. It represents a significant step towards practical, incremental privacy for blockchain payments, making surveillance more costly and less reliable without altering the base protocol's security model.

A Pay-to-EndPoint (P2EP) transaction is a collaborative Bitcoin transaction where the payment sender and receiver each contribute at least one input, blending their coins in a way that obscures the true payment path from external blockchain observers. This technique, a form of coinjoin, was first proposed by developers Gregory Maxwell and Tadge Dryja as a practical privacy enhancement for everyday payments. Unlike a standard transaction where only the payer's inputs are visible, P2EP creates a single transaction with inputs from both parties, making it computationally difficult for chain analysis firms to determine which output constitutes the actual payment.

The protocol works by having the payment receiver generate a special, partially-signed transaction template. This template includes a placeholder for the sender's input and specifies the receiver's change output. The sender receives this template, adds their own input and output for the payment amount, signs their portion, and broadcasts the completed transaction. Crucially, from the perspective of the blockchain, all inputs and outputs appear equally valid, breaking the common-input-ownership heuristic—a fundamental assumption used by surveillance tools to cluster addresses belonging to the same entity.

A key innovation of P2EP is its use of BIP 78, the Pay-to-EndPoint Receiver Protocol, which standardizes the communication between wallets. The receiver's wallet generates a Payjoin URI (similar to a BIP21 Bitcoin URI) that contains the necessary transaction data. When the sender's wallet scans this URI, it initiates the collaborative construction process. This standardization ensures interoperability between different wallet implementations, moving P2EP from a theoretical concept to a deployable feature.

Visualizing the transaction on a block explorer reveals its defining characteristic: multiple inputs from seemingly unrelated parties funding multiple outputs. For example, a transaction might show two inputs (one from Alice, one from Bob's store) and two outputs (one for the payment to Bob, one for Alice's change). Without P2EP, the transaction would clearly show Alice paying Bob. With P2EP, an analyst cannot definitively say if Alice paid Bob, or if Bob paid Alice, or if it was a simple coin swap between peers, thereby providing probabilistic privacy.

While powerful, P2EP has limitations. It requires active cooperation from the receiving wallet/service, which must be online and configured to support the protocol. It also slightly increases transaction size and fees due to the extra input. Despite this, P2EP represents a significant step toward fungibility in Bitcoin, offering improved privacy without requiring changes to the network's consensus rules and making surveillance economically less viable for small-value transactions.