PayJoin | Bitcoin Glossary | Mapping Bitcoin

Overview

PayJoin is a privacy technique that undermines one of the most fundamental assumptions used in blockchain analysis: that all inputs in a transaction belong to the same entity. In a PayJoin transaction, both the sender and the recipient contribute at least one input, making it impossible to determine the true payment amount from the transaction structure alone.

How PayJoin Works

In a standard Bitcoin payment, only the sender provides inputs. In a PayJoin, the recipient also adds one of their own UTXOs as an input:

Standard Payment:                 PayJoin Payment:
┌─────────────────────┐           ┌─────────────────────┐
│ Inputs (all Alice):  │           │ Inputs:             │
│  Alice UTXO: 0.5 BTC│           │  Alice UTXO: 0.5 BTC│
│                      │           │  Bob UTXO:   0.3 BTC│
├─────────────────────┤           ├─────────────────────┤
│ Outputs:             │           │ Outputs:             │
│  Bob:   0.2 BTC      │           │  Bob:   0.5 BTC      │
│  Alice: 0.3 BTC      │           │  Alice: 0.3 BTC      │
│         (change)     │           │         (change)     │
└─────────────────────┘           └─────────────────────┘

Analyst sees:                     Analyst sees:
"Alice paid Bob 0.2 BTC"          Two inputs, unclear who
                                   paid whom or how much

The PayJoin transaction above looks like it could be a payment in either direction, or a CoinJoin, or a self-transfer. The true payment amount (0.2 BTC) is obscured.

Protocol Flow

1. Alice creates a standard transaction paying Bob
2. Alice sends the PSBT to Bob via an HTTP endpoint (BIP78) or Payjoin V2 relay
3. Bob adds his own input(s) and adjusts the outputs
4. Bob sends the modified PSBT back to Alice
5. Alice verifies the changes, signs, and broadcasts

Advantages Over CoinJoin

• No coordinator needed — PayJoin happens directly between sender and receiver
• No extra fees — The transaction is the payment itself, not an additional mixing step
• Indistinguishable — PayJoin transactions look like ordinary payments, unlike CoinJoin which has identifiable equal-output patterns
• Breaks heuristics at scale — Even a small percentage of PayJoin adoption poisons chain analysis assumptions for all transactions

Payjoin V2

The original BIP78 PayJoin required the recipient to run a publicly reachable server. Payjoin V2 removes this requirement by using an untrusted relay, enabling asynchronous PayJoin where the recipient does not need to be online at the exact moment of payment. This dramatically lowers the barrier to adoption.

Common Misconception

PayJoin does not require equal-value outputs like a CoinJoin. It works with any payment amount, making it practical for everyday commerce. The privacy benefit comes from the ambiguity of input ownership, not from output uniformity.