Why does PayJoin matter for Bitcoin security?

PayJoin is one of the most powerful privacy tools because it poisons the fundamental assumption of chain analysis — that all inputs in a transaction belong to the same person. If PayJoin becomes widely adopted, it renders common input ownership heuristics unreliable across the entire network, improving privacy for all Bitcoin users.

Privacy

PayJoin

PayJoin (also called P2EP or Pay-to-EndPoint) is a privacy technique where both the sender and receiver contribute inputs to a Bitcoin transaction. This breaks the common input ownership heuristic that chain analysis relies on, making the transaction look like a normal payment while obscuring the true amounts.

How It Works

In a standard Bitcoin transaction, the sender provides all the inputs and the receiver gets an output. Chain analysis assumes all inputs belong to the sender (common input ownership heuristic). PayJoin breaks this assumption by having the receiver also contribute an input to the transaction. The result is a transaction that looks like a normal payment on the blockchain but contains inputs from two different parties.

For example, Alice wants to pay Bob 0.5 BTC. In a normal transaction, Alice provides one input of 0.8 BTC, Bob receives 0.5 BTC, and Alice gets 0.3 BTC in change. In a PayJoin, Bob also contributes an input of 0.3 BTC. The transaction now has two inputs (0.8 from Alice, 0.3 from Bob) and two outputs (0.8 to Bob, 0.3 to Alice). An observer sees a transaction that looks like someone spent 1.1 BTC and received 0.3 BTC in change — the actual payment amount of 0.5 BTC is hidden, and the common input ownership assumption produces a false conclusion.

PayJoin requires cooperation between sender and receiver, which means both parties' wallet software must support the protocol. BIP78 standardized the PayJoin protocol, and wallets like BTCPay Server, Sparrow Wallet, and others support it. The beauty of PayJoin is that it doesn't require a large anonymity set or a mixing pool. Every PayJoin transaction directly undermines chain analysis heuristics, and the more people use it, the less reliable those heuristics become for all transactions — even non-PayJoin ones. If any transaction could be a PayJoin, analysts can never be certain that common input ownership holds.

Key Points

Both sender and receiver contribute inputs, breaking the common input ownership heuristic
Transactions look identical to normal payments on the blockchain — no special fingerprint
Hides the true payment amount by mixing sender and receiver funds in the transaction
Standardized in BIP78 and supported by BTCPay Server, Sparrow Wallet, and other software
Widespread adoption would undermine chain analysis heuristics for all Bitcoin transactions