BIP47 (Reusable Payment Codes / PayNym)

BIP47 defines reusable payment codes: a way to publish a single, permanent code that anyone can pay without the address reuse that normally destroys privacy. A PayNym is the friendly representation of a BIP47 code — a robot avatar and handle (like +example) mapping to the underlying cryptographic payment code. Sender and receiver use the code to deterministically derive a fresh on-chain address for every payment, so repeated payments to the same person are not publicly linkable to each other or to the code itself.

The problem it solves

Bitcoin's privacy model assumes a new address per payment, but handing out fresh addresses requires interaction — fine for a one-off invoice, hopeless for a tip jar, a donation page, or a recurring payer. The naive fix, posting one static address, means every payment lands in public view on the same spot in the chain, letting anyone total your income and trace your spending. BIP47 keeps the convenience of a static identifier while restoring the privacy of fresh addresses: the code you publish is not an address at all, and nothing paid to you is visible under it. Under the hood, sender and receiver combine their keys — a Diffie–Hellman exchange between wallets — to derive a shared sequence of addresses only the two of them can compute, the same family of ideas as a stealth address.

The notification transaction

The first time Alice pays Bob's payment code, her wallet broadcasts a one-time notification transaction: a small payment to Bob's notification address carrying Alice's payment code, encrypted so only Bob can read it, in an OP_RETURN output. Bob's wallet watches that address, decrypts the payload with his private key, and can thereafter derive every address Alice will send to — and watch for incoming funds without any further coordination. The notification is visible on-chain, but outside observers learn only that someone connected to Bob's code; the subsequent payment addresses are computable by Alice and Bob alone.

Strengths and limits

BIP47 lets you advertise a stable identity on a website, a social profile, or a shop page while keeping your actual receiving addresses confidential — and PayNym directories made those identities human-friendly and discoverable. The trade-offs are real, though: establishing each new sender costs an on-chain notification transaction (a fee, and a public if encrypted footprint that a careless wallet can link to the sender's coins), and both wallets must implement the standard, which only a minority ever did. These limitations directly motivated Silent Payments (BIP352), which achieves the same reusable-identifier goal with no notification step at all, at the cost of heavier scanning for the receiver.

Using it well

If you run a wallet that supports payment codes, pair them with deliberate coin control so the notification transaction is not funded from coins that identify you. D-Central has published a hands-on guide to PayNyms and BIP47 for readers who want to set one up — a small privacy upgrade that costs little and teaches a lot about how Bitcoin privacy actually works.

The broader lesson of BIP47 outlives any single standard: identity and addresses must be decoupled for on-chain privacy to coexist with being findable. Whether the mechanism is a payment code, a silent-payments address, or whatever succeeds them, the pattern is the same — publish something safe, derive something private. For anyone building a public-facing Bitcoin presence, from a donation page to a Nostr profile, that pattern is the difference between accepting money in public and doing your accounting in public. BIP47 walked so its successors could run, and the wallets that implemented it proved the demand was real.