Pay-to-EndPoint (P2EP)

Pay-to-EndPoint (P2EP) is the conceptual ancestor of PayJoin. It describes a payment in which the receiver contributes one or more of their own inputs to the same transaction the sender is funding. Because the resulting transaction contains inputs owned by two different parties, it directly poisons one of blockchain analysis's most relied-upon assumptions — that all inputs to a transaction belong to a single entity. The idea circulated in the Bitcoin privacy community around 2018 before being refined and standardized as BIP78.

From concept to standard

The "endpoint" in the name refers to a communication endpoint — typically an HTTP(S) server the receiver runs — that the sender's wallet contacts to negotiate the joint transaction. The flow is short: the sender drafts a normal payment and submits it to the receiver's endpoint; the receiver verifies it, adds one or more of their own inputs, adjusts their output to collect both the payment and their own contributed value, and returns the modified transaction; the sender re-signs and broadcasts. Partially-signed Bitcoin transactions (PSBTs) are the interchange format that makes the negotiation clean. Early proposals such as Bustapay (BIP79) explored the same territory; the modern, widely implemented version is the BIP78 PayJoin protocol, and in practice the terms P2EP and PayJoin are used interchangeably, though PayJoin is the name that stuck. A crucial safety property is built in: if the endpoint is unreachable or the negotiation fails, the sender simply broadcasts the original transaction — the payment always succeeds, privacy enhancement or not.

Why receiver inputs break surveillance

Chain-analysis clustering leans on the common-input-ownership heuristic: every input in a transaction is presumed to belong to one wallet. When the receiver silently adds an input, that presumption manufactures a false cluster — the analyst merges two unrelated entities into one. Just as damaging, the visible output no longer reflects the true amount paid: an observer reading the transaction infers a payment size that is wrong by the value of the receiver's contribution, corrupting amount-based analysis and output-linking alike. And because a P2EP transaction has no structural signature — it looks like any consolidation-plus-payment — analysts cannot even filter them out. Every undetectable joint payment degrades confidence in every cluster, which makes P2EP one of the rare techniques that damages the surveillance industry's data quality wholesale rather than protecting only its own users.

Practical benefits beyond privacy

For merchants there is a mundane bonus: contributing an input to each incoming payment consolidates small UTXOs continuously, at the sender's fee expense for the shared portion, avoiding the periodic — and privacy-leaking — batch consolidations most businesses eventually perform. The receiver's wallet also gains a naturally larger output, reducing future change output fragmentation.

The adoption problem

P2EP's weakness has always been deployment: the receiver must run a reachable endpoint, which is friction for ordinary users, and both wallets must speak the protocol. Later protocol work has chipped away at the always-online requirement, but support remains a wallet-by-wallet checkbox worth verifying. The lesson of P2EP endures regardless of adoption curves — the transaction graph only incriminates because wallets follow predictable conventions, and two cooperating parties can quietly refuse to.

For an individual, the on-ramp is wallet choice: several maintained wallets implement BIP78 as sender, receiver, or both, and payment processors used by self-hosted merchants can serve the receiving endpoint as a built-in feature. Check the current support matrix before assuming — implementations come and go, and a PayJoin only happens when both ends cooperate. When it does work, the experience is deliberately boring: the payment looks and feels ordinary, which is the entire point. That quality makes P2EP one of the most honest privacy techniques available — no flashy anonymity claims, just a quiet refusal to hand chain observers the assumption their clustering depends on. Every such transaction slightly degrades the surveillance model for everyone, which is the decentralized way to fix a systemic problem: not one grand protocol change, but thousands of wallets independently declining to be predictable.