PayJoin (P2EP)

PayJoin (P2EP) — also called Pay-to-EndPoint and standardized in BIP-78 — is a collaborative Bitcoin payment in which both the sender and the receiver contribute inputs to the same transaction. The coordination is mediated by an endpoint the receiver runs, communicated through a BIP-21 payment URI, and the whole exchange completes in the time of an ordinary checkout. Unlike a CoinJoin, which gathers many strangers into one deliberately conspicuous transaction, a PayJoin is an ordinary-looking spend that simply happens to include one of the recipient's own coins — and that quiet difference is the entire point.

How the privacy works

Blockchain surveillance leans heavily on one assumption: that every input in a transaction belongs to the same wallet. This common-input-ownership heuristic is the workhorse of address clustering — it is how analysts merge thousands of addresses into one "entity." PayJoin quietly violates it. Because the recipient secretly supplies an input, an analyst applying the heuristic will incorrectly merge the sender's and receiver's coins into a single cluster, poisoning the analysis with false connections. As a bonus, the transaction's visible amounts mislead: the output paying the receiver contains their contributed input plus the actual payment, so the observed transfer amount is wrong too. Yet on-chain the transaction looks like any other spend — there is no CoinJoin fingerprint, no equal-value outputs, nothing to filter on sight.

The mechanics in brief

The sender's wallet builds a normal transaction paying the receiver and sends it to the receiver's PayJoin endpoint. The receiver checks it, adds one of their own UTXOs as an additional input, adjusts the output to themselves accordingly, and returns the modified transaction. The sender re-signs and broadcasts. If anything fails — endpoint offline, malformed response — the sender simply broadcasts the original transaction, so a PayJoin attempt gracefully degrades to a normal payment. The receiver also gains a practical side benefit: consolidating a UTXO inside an incoming payment, at the sender's fee expense, instead of paying later to merge dust.

A network-wide effect

The clever property is that PayJoin's benefit is collective. Because PayJoins are indistinguishable from normal payments, even a small fraction of them degrades the reliability of input-ownership clustering for all Bitcoin transactions — once an analyst knows some payments break the heuristic invisibly, they can no longer fully trust it anywhere. Every merchant and individual who accepts PayJoin strengthens everyone's privacy, including people who have never used it. That is the decentralization pattern at its best: no coordinator, no privacy pool, just a protocol tweak that erodes surveillance assumptions one ordinary payment at a time. BIP-78 defines the original synchronous HTTPS protocol; later work (BIP-77, "PayJoin v2") adds an asynchronous, relay-based design so mobile wallets that are not always online can participate without hosting a live endpoint.

Where it fits in your toolkit

PayJoin complements rather than replaces other privacy tools. A CoinJoin breaks the link between your coins' past and future in one visible batch; a PayJoin corrupts clustering invisibly during real economic activity. For a sovereign holder practising self-custody, the practical takeaway is to prefer wallets and payment processors that support BIP-78/BIP-77 — support has been growing steadily — and to enable receiving via PayJoin if you sell goods or services for bitcoin. Privacy improves fastest when it is a default behaviour of normal commerce, not a special occasion.