PayNym

A PayNym is a memorable, shareable handle layered on top of a BIP47 payment code. A raw payment code is a long, opaque string — accurate but hostile to humans — so a PayNym hashes that code into a unique fingerprint that yields both a readable name (for example +SilentSatoshi) and a deterministic robot avatar. The friendly identifier maps one-to-one to the underlying cryptographic code, so two people can recognize and verify each other at a glance — matching name and matching robot — without hand-copying error-prone key material. It is a small piece of user-experience engineering wrapped around serious privacy machinery.

From handle to private payment

Under the hood a PayNym is still a BIP47 payment code, so paying one inherits all of that standard's privacy properties. The first time a wallet pays a never-before-seen PayNym, it broadcasts a one-time notification transaction carrying the sender's blinded payment code to the recipient's notification address. From then on, the two wallets share an ECDH secret and can each derive an effectively unlimited sequence of fresh addresses: the sender computes the next address the recipient will recognize, and the recipient scans for exactly those. Every payment lands on a new address that no outside observer can link to the PayNym, to the payment code, or to any other payment in the sequence. No static address is ever posted publicly, so nobody can look up the recipient's balance or payment history from the handle alone. The robot avatar earns its keep here too: because it derives deterministically from the code, a spoofed handle backed by a different code produces a visibly different robot — a cheap visual checksum against impersonation.

What problem it actually solves

The deep problem is address reuse. A fixed donation or profile address is convenient precisely because it never changes — and catastrophic for privacy for the same reason: every payment piles onto one visible history, and chain-analysis firms cluster from there. The pre-PayNym alternatives were all awkward: hand out a fresh address for every payer (interactive, doesn't scale to a public profile), or run a payment server (infrastructure most people won't maintain). BIP47 solved the cryptography — one published code, unlimited unlinkable addresses — but adoption stalled on usability until PayNyms gave the codes names and faces. That pattern recurs across privacy tech: the math is rarely the bottleneck; the interface is.

Trade-offs worth knowing

Honest accounting matters here. The notification transaction is BIP47's known wart: it is an on-chain event that, to a sophisticated observer, can reveal that some connection between two payment codes was established — though not the payments that follow. PayNym directories, which resolve handles to codes and power the social features, are convenience infrastructure: useful for lookup, not required for the underlying payments, but a directory operator does learn who queried which handle. And both parties need BIP47-aware wallets, which remain a minority. The successor design, silent payments (BIP352), removes the notification transaction entirely at the cost of heavier scanning for the recipient — a different point on the same trade-off curve, covered under reusable payment address.

Why it matters for sovereignty

A sovereign Bitcoiner should be able to publish "pay me here" on a website, a Nostr profile, or a printed card without broadcasting their financial life. PayNyms made that practical for a real user base: one nym, unlimited payments, no address reuse, no exposed balance, and the wallet-clustering heuristics that chain-analysis firms depend on are starved of their easiest signal. This is defensive privacy — the digital equivalent of not taping your bank statement to the front door — and it supports the fungibility that makes every sat equal to every other. The handle is friendly; what it defends is fundamental.