What Is Payjoin? The Most Underrated Privacy Tool in Bitcoin

Bitcoin doesn't work like a bank account. There is no "balance" sitting somewhere. Instead, your wallet holds UTXOs, or Unspent Transaction Outputs. Each UTXO is a chunk of bitcoin you received from a previous transaction. If you want a deeper understanding of how UTXOs work, check out our article: A Primer on UTXOs.

Prefer watching over reading? Check out our beginner's guide to Payjoin: This tool solves Bitcoin privacy.

For example, if you have a UTXO worth 2 BTC and another worth 1 BTC, and you need to pay someone 3 BTC, you will have to spend both UTXOs. Simple.

But most of the time, your UTXOs don't perfectly match the amount you need to pay. Say you have three UTXOs worth 2 BTC each (6 BTC in total) and you owe someone 5 BTC. You will have to spend all three, and you will get 1 BTC back as change.

That's exactly how a standard Bitcoin transaction works. The UTXOs you spend are called inputs. The payment and the change coming back to you are called outputs.

Most transactions follow the same predictable pattern: one or a few inputs on one side, two outputs on the other, one for the receiver, one returning to you as change.

These patterns are what malicious external observers use to track you.

The Common Input Ownership Heuristic

The most common assumption in blockchain surveillance is this: if a transaction has multiple inputs, they all belong to the same person: it's called Common Input Ownership Heuristic.

It's not mathematically guaranteed. But in the vast majority of transactions today, it holds true, and that's enough for malicious external observers to build ownership graphs across the entire blockchain and track Bitcoin ownership and deanonymize transactions.

The other consequence of this standard transaction model is UTXO fragmentation. Your wallet constantly creates change outputs. Over time, you accumulate dozens of small UTXOs. Eventually you need to consolidate them, which means paying higher fees and creating even more identifiable patterns.

This is where Payjoin flips the script.

How Payjoin Works

A Payjoin is a collaborative transaction. Both the sender and receiver contribute inputs.

Here's a hypothetical example: you want to send someone 1 BTC.

In a standard transaction, you have a UTXO of 1.5 BTC. You send 1 BTC to the receiver and get 0.5 BTC back as change. Clean, predictable, and completely transparent to anyone watching.

With Payjoin, you still use your 1.5 BTC UTXO, but the receiver also contributes a UTXO of 0.5 BTC. The transaction has two inputs and two outputs: you receive 0.5 BTC back, and the receiver gets 1.5 BTC. The net payment is still exactly 1 BTC. But the transaction now tells a completely different story to an outside observer.

To anyone looking at the blockchain, it looks like a perfectly normal payment. Multiple inputs, two outputs, a standard structure. But the assumption that all inputs belong to the sender is now wrong. The receiver contributed an input too, and there is no way for an external observer to tell which input belongs to whom.

Your UTXO history becomes entangled with the receiver's, ensuring that malicious external observers cannot definitively attribute ownership. The actual payment amount is hidden. The blockchain shows 1.5 BTC moving, not 1 BTC. The number on the public ledger is technically real, but economically false.

Why This Breaks Chain Analysis

For years, analysts assumed the smallest output was the payment and the largest was the change. With Payjoin, the payment might be bigger, smaller, or split across multiple outputs. Sometimes there's no change at all. The inputs and outputs balance naturally, which produces a single-output transaction that could be a payment, a self-transfer, or a consolidation: you simply can't tell.

Unlike CoinJoin, Payjoin doesn't produce a recognizable pattern on the blockchain. There's no giant equal-output transaction that screams "privacy tool." It blends into normal transactions. Or more precisely, it makes normal transactions impossible to categorize.

If even five to ten percent of Bitcoin users adopt Payjoin, the common input ownership heuristic becomes worthless. Analysts lose their most reliable model for inferring ownership, direction, and amounts. Not just for Payjoin users, for everyone.

The Fee Advantage Nobody Talks About

Most privacy techniques cost more. More inputs, more outputs, more fees. Payjoin is the opposite.

When you receive a Payjoin transaction, your old UTXOs get merged with the incoming payment into a single, larger UTXO. That's a free consolidation.

With Payjoin, you get privacy and lower fees at the same time.

Payjoin V2: No More "Both Online" Problem

The original Payjoin protocol had a major friction point: both sender and receiver had to be online at the same time to coordinate the transaction. For a mobile wallet, that's a dealbreaker.

Payjoin V2, formalized as BIP77, solves this with asynchronous coordination. The receiver doesn't need to be online when the sender initiates the transaction. Encrypted messages are relayed between the two parties via a Payjoin Directory and an Oblivious HTTP server. Neither can see the transaction contents.

This is what makes Payjoin practical for everyday use. No server to run, no timing constraints: just scan, send, and the protocol handles the rest. You can read more about how we implemented it in this article.

Payjoin on BULL Wallet

BULL Wallet was the first Bitcoin wallet in the world to implement Payjoin V2 (BIP77), and it's enabled by default for all on-chain transactions.

When a BULL Wallet sends Bitcoin on-chain to another BULL Wallet, the transaction uses Payjoin by default, as long as both wallets have enough UTXOs to cover the transaction. If the other party's wallet doesn't support Payjoin, the transaction falls back to standard automatically. The user never has to do anything different.

To receive a Payjoin in BULL Wallet, just go to the Receive tab and share your address or QR code. That's it. If the sender supports Payjoin, it happens. If they don't, it still works with a regular transaction.

Try it yourself

Download BULL Wallet on Android or iOS: https://wallet.bullbitcoin.com, or grab the APK directly from GitHub: https://github.com/SatoshiPortal/bullbitcoin-mobile/releases.
⁠
⁠Send some sats to a friend using BULL Wallet (ask them to download BULL as well). Then check the transaction on https://mempool.space. Notice how the actual amount you sent is obscured: that's Payjoin in action.

Curious about the broader Payjoin ecosystem? Visit payjoin.org to explore the protocol, the roadmap, and the community behind it.
⁠
⁠Payjoin is exactly what Bull Bitcoin stands for: privacy and efficiency working together, not against each other. From our fee multiplie calculator to our integrated atomic swap and Payjoin implementation, every feature we build is designed to reduce your digital footprint without costing you more.