PayNym | Bitcoin Glossary | Mapping Bitcoin

Overview

A PayNym is a user-friendly implementation of BIP47 reusable payment codes. It allows two Bitcoin users to establish a private payment channel where every transaction automatically uses a fresh address, without requiring the recipient to generate and share new addresses each time. PayNyms are visually represented by a unique robot avatar and a human-readable identifier (like +silentwave123), making them easy to share publicly without compromising privacy.

The core problem PayNyms solve is address reuse. Posting a static Bitcoin address for donations or payments means every transaction to that address is publicly linkable on the blockchain. A PayNym can be posted on a website, social media profile, or business card, yet every sender who uses it will generate a distinct on-chain address that cannot be linked to other payments by an outside observer.

How BIP47 Works

Step 1: Notification Transaction
┌──────────┐                      ┌──────────┐
│  Alice    │  notification tx    │   Bob     │
│ (sender)  │ ──────────────────► │(receiver) │
│           │  Contains Alice's   │           │
│           │  payment code in    │           │
│           │  an OP_RETURN       │           │
└──────────┘                      └──────────┘

Step 2: Shared Secret Derivation
  Alice's payment code + Bob's payment code
                    │
              ECDH (Elliptic Curve Diffie-Hellman)
                    │
              Shared Secret
                    │
         ┌──────────┴──────────┐
         │                     │
    Address 0             Address 1          ...
   (1st payment)        (2nd payment)

Step 3: Payments (no further coordination needed)
  Alice sends to Address 0  →  Only Bob can detect/spend
  Alice sends to Address 1  →  Only Bob can detect/spend
  Each address is unique and unlinkable to Bob's PayNym

The Notification Transaction

The one drawback of BIP47 is the notification transaction. Before Alice can start paying Bob using his PayNym, she must send a one-time on-chain transaction that embeds her payment code in an OP_RETURN output. This links Alice's address to Bob's notification address on-chain, creating a visible connection between the two parties. However, this link only reveals that a payment channel was opened, not the amounts or addresses of subsequent payments.

Various improvements have been proposed to mitigate this privacy leak, including using PayJoin for the notification transaction or sending notifications via off-chain channels.

PayNym vs. Silent Payments

Both PayNyms (BIP47) and Silent Payments (BIP352) aim to solve the address reuse problem, but they take fundamentally different approaches:

Silent Payments eliminate the notification transaction entirely but require recipients to scan every transaction on the blockchain to detect payments, which is computationally heavier. PayNyms require the initial notification but then allow efficient detection of subsequent payments.

Privacy Considerations

While PayNyms significantly improve privacy over static address reuse, users should be aware of several nuances:

• The notification transaction creates a one-time on-chain link between sender and receiver payment codes
• If Alice's notification address is linked to her identity (e.g., through chain analysis), an observer can determine she opened a channel with Bob's PayNym
• Post-notification payments are fully private, using unique addresses derived from the shared secret
• Combining PayNym usage with CoinJoin for the notification transaction can mitigate the initial linkage

Related Concepts

• Silent Payments — a newer protocol solving the same problem without a notification transaction
• PayJoin — can be combined with PayNym notification to improve privacy
• CoinJoin — privacy technique complementary to PayNym usage
• Chain Analysis — the surveillance threat that PayNyms help defend against