CoinJoin buys privacy loudly: everyone can see a mix happened. PayJoin (also called P2EP, specified in BIP78) takes the opposite approach. It folds privacy into an ordinary-looking payment, so there is nothing on-chain to flag, and nothing to even notice.
The Trick: Two Parties, One Transaction
In a normal payment, only the sender contributes inputs. In a PayJoin, the receiver adds an input of their own, and gets it back inside the payment output. To the outside world the result is just a transaction with a couple of inputs and a couple of outputs, like millions of others.
But the bedrock assumption of chain analysis, that all inputs to a transaction belong to one entity, is now silently false. An analyst who applies it here concludes the sender and receiver are the same person, and every wallet-clustering conclusion built on that link inherits the error. Each PayJoin quietly poisons the well for surveillance across the whole graph, which is why even occasional use helps everyone.
How a PayJoin Actually Flows
- The receiver shares a payment request with a PayJoin endpoint (a URL folded into the payment URI).
- The sender's wallet builds a normal PSBT and sends it to that endpoint.
- The receiver's wallet adds one of its own inputs, adjusts the outputs, and returns the updated PSBT.
- The sender's wallet checks that it still pays exactly the right amount, signs, and broadcasts.
Neither side ever controls the other's coins, and if anything looks wrong the sender's wallet simply falls back to a regular payment. The PSBT plumbing is the same machinery covered in Using Bitcoin as Money.
A Bonus for Merchants
Receivers get a practical perk on top of the privacy: every PayJoin merges one of their existing UTXOs into the incoming payment, which means they consolidate coins while getting paid, with no separate consolidation transaction and no extra fee event. For a busy shop accumulating small UTXOs all week, that is real money saved (see UTXO Management for why). BTCPay Server, the self-hosted payment processor, can do this automatically for any customer whose wallet cooperates, and Sparrow supports sending to PayJoin endpoints out of the box.
Honest Limits
- Amounts stay visible. PayJoin hides ownership relationships, not values.
- It breaks one heuristic. That is valuable, but it is not the deep anonymity set a good CoinJoin builds. The two are complements, not rivals.
- Both sides must play. The receiver has to be online with a compatible wallet, which is still the exception rather than the rule. Adoption is the bottleneck.
- History stays history. Like every privacy tool, it protects the transactions you make with it, not the ones already on-chain.
When to reach for which: use PayJoin whenever a merchant or peer supports it, since it costs nothing and looks like nothing. Use CoinJoin when you need to break the link to your coins' past, not just obscure the present payment.
Keep going. Tight UTXO management makes every privacy tool work better, and your own node keeps your wallet from leaking what your transactions protect. Questions? Bring them to a meetup.