PayJoin

A PayJoin is a special type of Bitcoin transaction where the recipient of a payment also contributes at least one input to the transaction. This breaks the common common-input-ownership heuristic used by blockchain analysis firms, which assumes all inputs in a transaction belong to the same entity (the sender). By mixing sender and receiver funds in a single, cooperative transaction, PayJoin makes it significantly harder for third parties to determine the true payment flow and de-anonymize the participants. It is a non-custodial privacy technique that does not require a trusted third party.

The protocol works through a collaborative handshake. When a payer initiates a payment, the recipient's wallet software (which must support PayJoin, like BTCPay Server) generates a special payment request containing a partially signed Bitcoin transaction (PSBT). The payer's wallet adds its inputs and outputs, signs its portion, and returns it. The recipient then adds their own input, signs, and broadcasts the final transaction. Crucially, the transaction appears as a standard multi-input payment on-chain, but the economic reality—a net transfer of value from one party to another—is concealed.

Key benefits of PayJoin include improved privacy for both parties, cost efficiency (as it can reduce transaction fees by consolidating UTXOs), and regulatory compliance-friendliness compared to mixing services, as it involves only the direct counterparties. A major implementation is BIP 78, which standardizes the communication protocol between wallets. While powerful, its adoption depends on wallet support and requires both sender and receiver to use compatible software, making it a cooperative opt-in privacy solution within the existing Bitcoin protocol.

The word PayJoin is a compound of "Pay" and "Join", directly describing the protocol's core mechanism: a payment where the sender and receiver join their unspent transaction outputs (UTXOs) as inputs in a single, collaborative transaction. This stands in contrast to a standard Bitcoin payment, where only the sender's UTXOs are used as inputs. The term emerged from the broader Bitcoin privacy community as a more specific and descriptive name for what was previously known as a P2EP (Pay to EndPoint) transaction or a CoinJoin-style payment.

The conceptual origin of PayJoin is deeply rooted in addressing a fundamental privacy leak in Bitcoin's UTXO model. Blockchain analysts use common-input-ownership heuristic, which assumes all inputs to a transaction are controlled by the same entity. By having two parties co-sign a transaction with their respective inputs, this heuristic is broken, making it significantly harder for third parties to determine the payment's sender, receiver, and amount. The protocol was formally proposed and refined by developers and researchers like Adam Ficsor and others, building upon the privacy foundations laid by earlier concepts like CoinJoin.

The development of the BIP 78 standard was a pivotal moment in PayJoin's history. This Bitcoin Improvement Proposal provides a standardized, interoperable protocol for wallets to negotiate and construct these transactions. Before BIP 78, implementing PayJoin required custom, non-interoperable solutions. The standardization effort, led by developers including Dan Gould, aimed to make the privacy-enhancing technique accessible to any wallet that chose to implement it, promoting wider adoption and better user privacy across the ecosystem.

In practice, a PayJoin transaction appears on-chain as a perfectly ordinary transaction, but its internal structure tells a different story. For example, if Alice pays Bob 0.5 BTC, a classic PayJoin would have one input from Alice (1.0 BTC) and one from Bob (0.2 BTC), with outputs going to Bob (0.7 BTC change) and a new address for Alice (0.5 BTC). To an external observer, it is unclear if this was a payment from Alice to Bob, Bob to Alice, or a payment to a third party, effectively adding plausible deniability to the transaction graph.

A PayJoin transaction, also known as a P2EP (Pay to Endpoint), is a collaborative Bitcoin transaction initiated when a sender pays a receiver. Unlike a standard payment where the receiver provides only a destination address, in a PayJoin, the receiver also contributes at least one of their own unspent transaction outputs (UTXOs) to the transaction. This creates a single transaction with inputs from both parties, which is then cooperatively signed and broadcast to the network. The critical privacy benefit is that on-chain observers cannot definitively distinguish which output is change and which is the payment, breaking the common-input-ownership heuristic used by chain analysis firms.

The protocol begins with the BIP78 specification, which standardizes the communication. The sender's wallet first requests a payment from the receiver's server using a BIP21 URI that includes a pj= parameter. The receiver's server responds with a PSBT (Partially Signed Bitcoin Transaction) that is partially constructed. This PSBT already contains the receiver's contribution: one or more of their UTXOs as inputs and a corresponding output back to themselves. The sender's wallet then adds its own payment input and destination output, ensures the transaction is balanced, signs its part, and returns the PSBT to the receiver for final signing.

A key operational requirement is that the transaction must obey the No Value Increase rule. The total output value cannot exceed the total input value; otherwise, the transaction would create money. To prevent this, the receiver typically designates one of their outputs as a change output. The sender verifies this rule before signing. Furthermore, implementations often use output swapping, where the order of outputs is randomized between the payment and change outputs to further obfuscate their purpose. Wallets must also handle edge cases like fee management and ensuring the collaborative transaction remains economically rational for both participants.

From a network perspective, a completed PayJoin transaction appears as a standard Bitcoin transaction with multiple inputs and multiple outputs. However, its internal structure subverts analytical assumptions. Chain surveillance tools that rely on identifying the sender's change output based on new address creation or precise output values are confounded, as both outputs are effectively new to the network and their values do not neatly conform to a simple 'payment minus fee' pattern. This increases the anonymity set for the coins of both parties, providing stronger privacy guarantees than sequential, independent transactions.