Payment Codes (BIP 47)

Payment codes are reusable receiver identifiers defined in BIP-47. A user publishes one long-term payment code (a string starting with P); senders combine it with their own keys via ECDH to derive a unique on-chain address per payment. The receiver scans for these derived addresses; the sender knows the address from their own derivation.

The privacy goal: avoid address reuse without forcing users to share a fresh address every time they want to be paid.

The catch that limited BIP-47 adoption: before the first payment, each new sender must publish a one-time notification transaction on-chain (one per direction; if the receiver later wants to pay the sender back, they send their own). This notification is an actual Bitcoin transaction: a small payment to the receiver's notification address, carrying the sender's payment code in an 80-byte OP_RETURN output, blinded so that only the receiver can read it. Once that notification exists, subsequent payments between the same two parties happen at unique addresses with no further on-chain handshake. But the notification itself is a privacy leak. The notification address is derived from the receiver's public code, so anyone who knows the code can watch new senders' coins arrive there (which is why BIP-47 requires that the inputs "MUST NOT be easily associated" with the sender's own notification address), and the receiver can link every later payment from the same sender together.

Where this leaves BIP-47:

• Samourai Wallet built its PayNym feature on it and shipped it until April 2024, when US prosecutors unsealed an indictment against the founders, seized the servers and domain, and had the app pulled from Google Play in the US. The founders were sentenced in November 2025.
• The spec is frozen. BIP-47 is marked Deployed, but it says any further versions of payment codes will not go through the BIP process.
• The modern successor Silent Payments (BIP-352) achieves the same "one code, many addresses" goal without any notification transaction - publishing only the silent-payment address (sp1q...) and deriving a fresh Taproot output from keys the sender is already revealing to spend its inputs, so no handshake is needed. The cost moves to the receiver, who has to scan the chain.

BIP-47 is now best understood as a historical proof-of-concept: useful in demonstrating the design space, technically functional, and largely superseded by better successors. New users looking for reusable private receive addresses should look at Silent Payments. See Silent Payments for the modern equivalent.

Note: this entry partially overlaps with BIP-47 (Payment Codes). They cover the same concept from slightly different angles.