TERM_DEF // TRANSACTION / PAYJOIN_BIP_77_78
PAYJOIN (BIP
77/78)
77/78)
Payjoin (BIP 77/78). A collaborative two-input transaction breaking the heuristic that all inputs share an owner.
This page sits in the Transaction section — How money moves: inputs, outputs, fees, signatures, sighash flags, and the formats that wrap them. Read on for what it is, why it exists, how it works under the hood, and what to watch out for.
This page sits in the Transaction section — How money moves: inputs, outputs, fees, signatures, sighash flags, and the formats that wrap them. Read on for what it is, why it exists, how it works under the hood, and what to watch out for.
WHAT_PAYJOIN_BIP_77_78_IS
Payjoin (BIP 77/78) — at a glance
TRANSACTION
Payjoin (BIP 77/78) is part of the PRIVACY sub-family of transaction-level concepts. Receiver contributes one of their own UTXOs as an input alongside the sender — breaks "all inputs belong to sender" heuristic. A collaborative two-input transaction breaking the heuristic that all inputs share an owner.
Why it exists
DESIGN
The UTXO model is what makes Bitcoin transactions auditable, parallel-verifiable, and resistant to replay attacks. Every input directly references a specific previous output by txid + index. There is no shared state to lock, no "account version" to clash on, no oracle to consult — each input is a self-contained spending proof, and nodes can verify thousands of them in parallel.
HOW_IT_WORKS
Mechanism
HOW IT WORKS
A transaction has one or more inputs (each pointing at a UTXO being spent) and one or more outputs (each creating a new UTXO). Inputs supply the unlocking data; outputs specify the new locks. The fee is the difference between input sum and output sum, paid to the miner who includes the tx in a block. Once mined and buried under enough confirmations, the spend is for all practical purposes irreversible — the UTXOs it consumed are gone, the ones it created are spendable.
1. Wallet selects UTXOs whose total value covers the spend amount + estimated fee (coin selection).
2. Wallet builds the transaction body: version, inputs (each with prev txid + vout + sequence), outputs (each with value + scriptPubKey), locktime.
3. Wallet computes the sighash for each input (which parts of the tx the signature commits to — controlled by the SIGHASH flag).
4. Wallet signs each input with the right private key. Witness/scriptSig is populated with the resulting signatures + pubkeys.
5. Tx is broadcast to peers. Mempool propagation: tens of seconds globally.
6. A miner includes it in a block. Confirmation count grows by 1 per block; after ~6 the tx is effectively final.
WORKED_EXAMPLE
Payjoin (BIP 77/78) — PRIVACY
EXAMPLE
Pattern : sender pays receiver; receiver adds one of their UTXOs to the input set
Result : amount sent ≠ amount received in output; common-input heuristic fails
BIPs : BIP-77 (receiver protocol), BIP-78 (legacy)
UX : 2-step (sender proposes tx, receiver counter-proposes including own input)
KEY_PROPERTIES
INPUT MIXING
Sender and receiver both contribute inputs. Defeats the "all inputs share an owner" heuristic.
ATOMIC
A transaction is either fully accepted into a block or fully rejected. There is no partial spend.
IMMUTABLE INPUTS
A UTXO can only ever be spent once. After that, it is permanently consumed.
NO BALANCES
Bitcoin tracks UTXOs, not balances. Your wallet computes a balance by summing the UTXOs it controls.
COMMON_PITFALLS
Things that catch people out
PITFALLS
- PayJoin requires receiver cooperation at payment time — purely-asynchronous payments cannot use it.
- address-reuse/">Address reuse degrades privacy — every reuse links more of your UTXOs together publicly. Modern wallets generate a fresh address per receive.
- Fee estimation matters: under-pay and your tx sits in the mempool for hours; over-pay and you tip the miner more than necessary. Use a fee estimator.
- "Change outputs" must go back to a fresh address you control. A missing change output sends the difference to the miner as fee — a known footgun.
RELATED_CONCEPTS
Other terms from Transaction — click any to read its page:
TERMINOLOGY_INDEX
TERMINOLOGY
Payjoin (BIP 77/78)
A collaborative two-input transaction breaking the heuristic that all inputs share an owner.
Transaction (Tx)
A signed payload spending one or more UTXOs and creating new ones; every state change in Bitcoin is a tx.
Raw Transaction
The hex-serialized bytes of a transaction, ready to broadcast or analyze.
Transaction ID (TXID)
wTXID (Witness TXID)
HASH256 of the full transaction including witness data; commits to signatures and used in the witness commitment.
Input
A reference to a previous output being spent, plus the data (scriptSig/witness) authorizing the spend.
Output
An (amount, scriptPubKey) pair created by a transaction; spendable later by a tx whose input references it.
UTXO (Unspent Transaction Output)
An output that hasn't been spent yet; your "balance" is the sum of UTXOs you can sign for.