claude-dev-suite BIP47 Reusable Payment Codes (PayNyms)
A payment code is a single shareable string per identity. Senders derive fresh, unlinkable addresses for each payment from the payment code + their own keys via Diffie-Hellman. The recipient never sees a static address publicly.
Code format
P-Code = base58check(version || chain_code || pubkey || features || padding)
Total ~80 bytes encoded. Currently version 1.
Notification transaction
First time Sender pays Receiver, Sender broadcasts a notification tx to alert Receiver:
Sender:
outputs:
- tiny payment to a deterministic Notification Address derived
from Receiver's pubkey
- OP_RETURN with blinded payment-code revealing Sender's identity
(encrypted to Receiver)
Notification address = HASH160(P_R) → Base58 P2PKH.
Receiver scans for incoming UTXOs at their notification address. When one is seen, decrypts OP_RETURN to learn Sender's payment code, then derives shared addresses.
Per-payment address derivation
After notification:
shared_secret = SHA256(ECDH(s_S, P_R)) (or symmetric for receiver)
address_n = derive(P_R, "0/n" with shared_secret tweak)
n = 0, 1, 2, ... for sequential payments. Both Sender and Receiver
can derive the same address_n independently.
Receiver scans these addresses (just like an HD wallet's external chain).
Privacy properties
- Sender → Receiver public address never appears on chain after notification.
- Different senders → same Receiver use different derivation paths → addresses are unlinkable.
- Notification tx leaks that sender knows receiver's payment code (from the OP_RETURN). Some implementations use stealth-style notifications instead.
Compared to Silent Payments (BIP352)
| Aspect | BIP47 | Silent Payments |
|---|---|---|
| Notification | yes (one tx per pair) | none |
| Per-tx scan cost | low (only your derivation chain) | high (every output of every tx) |
| Public-key reveal | Sender's pubkey to Receiver via ECDH | none — Schnorr-based blinding |
| Standard | BIP47 (since 2014) | BIP352 (newer, 2024) |
Silent Payments has stronger privacy but heavier scan cost.
Implementations
- Samourai Wallet — original BIP47 reference (Samourai shut down in 2024).
- Sparrow Wallet —
wallet → payment codestab. - Stack Wallet — supports BIP47.
- Whirlpool, Wabisabi — sometimes integrate as input obfuscation step.
Common pitfalls
- Notification tx privacy leak: anyone can correlate "tx pays notification address X" with the receiver's known payment code. Mitigation: use multiple receivers / Tor relay.
- Reusing a P-code across services → service operators can cluster.
- Reorgs that orphan the notification tx → derived addresses may still be valid, but receiver must rescan if reorg deep enough.
- Multi-account collisions: P-code derivation index reused across senders → address collision possible (rare).
Status (2024-2026)
- BIP47 has lower adoption than originally hoped due to:
- Samourai's shutdown removed the dominant wallet.
- Silent Payments arrived with stronger privacy.
- Most wallets prefer simpler "fresh address per request".
- Sparrow and Stack maintain BIP47 support for compatibility.