PayJoin — the ordinary-looking payment that misleads the analyst

When a Bitcoin transaction spends several coins at once, whoever is watching the chain assumes those coins had one owner. That assumption is usually right — it is your wallet, gathering up enough of your own coins to cover what you are sending — and being usually right is exactly what makes it useful. It is the backbone of the software that groups addresses into “this is one person.”

A PayJoin is a payment where the person you are paying quietly adds a coin of their own to it. You build the payment the way you always would. Before it is broadcast, the seller adds one of their own coins as a second input and increases the amount going to themselves by exactly that much. You pay what you agreed to pay. They receive what they agreed to receive. Nobody is out of pocket, and the coin they added has simply gone from one of their pockets to another.

What has changed is the transaction now has two inputs owned by two different people — and there is no marker on the chain saying so. To anyone applying the assumption, it reads as one person spending two of their own coins. It is wrong, and it has no way of knowing it is wrong.

Neither side can be cheated, because neither side signs the other’s coin. The seller signs only their input; you sign only yours, and your wallet re-checks the finished transaction before you do — the amount, the destination, the change coming back. If any of it changed, you do not sign. This is the same partial-signing machinery a multisig setup uses.

Nothing at all. A completely reasonable answer, and the one most readers should take. This is a small effect on top of habits that matter far more.

Seek out sellers who offer it. We would not. Reorganising who you buy from around a marginal per-payment gain is a lot of effort in exchange for very little, and it is the kind of advice that makes privacy sound exhausting.

Run a permanently-online server so people can PayJoin you. This was the standard advice for years, and it is the single reason almost nobody did it — the receiving side had to host something and be awake at the moment of payment. That requirement is gone (see below). Unless you are actually taking payments from the public, the receiving half was never the interesting one for you anyway.

Treat it as your privacy answer. This is the one we would warn you off. A PayJoin does not fix a reused address, does not touch what an exchange already knows about you, and on its own barely moves your own picture. A reader who does this and considers the job done has swapped a real habit for a setting.

Use Lightning instead for small, frequent payments. Often the better tool, with quite different privacy properties. It is not a replacement for on-chain payments; it is a replacement for making a lot of them.

If your wallet has the setting, turn it on. That is the whole job. Where it is offered, your wallet uses it; where it is not, your payment goes out as an ordinary payment and nothing is lost. There is no ongoing decision to make and nothing to maintain.

If you take Bitcoin payments yourself, enable it on your payment server. That is where most of the sellers who support it come from today.

And understand what you are actually buying, because it is unusual. The gain from any single PayJoin is small for you and permanent for everyone. Each one is a transaction where the analyst’s central assumption produced a wrong answer, and they cannot tell which transactions those were — so as more payments work this way, the error rate in all their grouping rises, including for people who have never done this. At a handful of a percent it is absorbed as noise. Well above that, the assumption stops being dependable at all.

That makes this the one tool on this site whose point is other people. We think it is worth a click for that reason, and we would rather say so plainly than oversell what it does for you.