Silent Payments

Silent Payments solve an old Bitcoin problem: how to publish one permanent payment address without every payment to it landing in the same public pile. A donation page, an invoice footer, or a profile link has always meant address reuse, and address reuse hands chain analysts a complete history in one place. BIP-352 fixes that at the wallet layer, with no change to Bitcoin's rules.

The receiver publishes a silent payment address, a string beginning sp1q that encodes two public keys, one for scanning and one for spending. A sender combines the receiver's scan key with the private keys behind the sender's own transaction inputs to derive a shared secret, and uses that secret to tweak the receiver's spend key into a fresh Taproot output that no outside observer can link to the receiver and only the receiver can spend. On the chain it is an ordinary single-use Taproot address. The published sp1q code never appears anywhere, and two payments to the same code share nothing an observer can see.

Compared with the earlier attempts at the same idea, two things are new. BIP-47 payment codes needed a one-time on-chain notification transaction that announced the relationship, and older stealth address designs needed extra data in the transaction. Silent Payments need neither, because the shared secret is derived from keys the sender is already revealing to spend its inputs. That also means at least one of the sender's inputs has to be a single-key type the receiver can read a public key from, which is why the BIP lists exactly which input types qualify.

The cost sits with the receiver. There is no address to look up, so a receiving wallet has to check every transaction with eligible inputs and Taproot outputs against its scan key. A full node does this easily. A light wallet cannot do it without help, so light clients rely on indexing servers that precompute the data each transaction needs; a common spec for those servers was still under discussion in 2026. Other companion proposals cover different jobs: BIP-375 for sending through PSBTs (2025) and BIP-392 for descriptors (2026).

The idea was proposed on the bitcoin-dev mailing list in March 2022, refined into BIP-352 by josibake and Ruben Somsen, and merged into the BIPs repository in May 2024; Sebastian Falbesoner joined as a co-author in 2026. Wallet support arrived over the following two years, first in a mobile wallet in May 2024 and on a hardware signer later that year, then in more desktop and mobile wallets through 2025 and 2026, and libsecp256k1 shipped a silent payments module in August 2026. As of 2026 it is the most practical answer Bitcoin has to the reusable-address problem, and the only one that needs neither interaction between the parties nor extra data on the chain.

See Privacy on Bitcoin for where Silent Payments fit among the defenses.