CoinJoin vs PayJoin: Bitcoin Privacy Techniques Compared

CoinJoin vs PayJoin Overview

CoinJoin and PayJoin are the two dominant approaches to improving Bitcoin transaction privacy, but they work in fundamentally different ways. CoinJoin combines multiple users' inputs into a single transaction with equal-denomination outputs, creating ambiguity about which input funded which output. PayJoin is a two-party collaborative transaction where both sender and receiver contribute inputs, breaking the common-input-ownership heuristic that chain analysis firms rely on to cluster addresses.

The tradeoffs between these techniques span anonymity model, fee overhead, on-chain detectability, wallet support, and regulatory risk. The following table summarizes the key differences before diving into each dimension.

For a broader view of Bitcoin privacy tooling, see the Bitcoin privacy tools comparison.

How CoinJoin Works

A CoinJoin transaction combines inputs from multiple independent users into a single transaction. Each participant signs only their own inputs, retaining full custody throughout the process. The outputs are equal-denomination amounts, making it impossible for an observer to determine which input funded which output based on value alone. The privacy guarantee comes from the anonymity set: the number of indistinguishable outputs in a given round.

Three major implementations dominate the CoinJoin landscape, each with a different coordination model.

Wasabi Wallet (WabiSabi)

Wasabi 2.0 uses the WabiSabi protocol, which employs keyed-verification anonymous credentials to allow variable output amounts while eliminating toxic change. Rounds target 100+ inputs. Per-output anonymity scores average around 5 in a single round but accumulate across multiple rounds to 50+. In June 2024, zkSNACKs (Wasabi's parent company) shut down its default coordinator, citing legal uncertainty after the Samourai arrests. The wallet continues as open-source software with third-party coordinators: nine community-run coordinators were active as of 2026, including Kruw at 0% coordinator fee.

JoinMarket / JoinMarket-NG

JoinMarket uses a fully decentralized maker/taker model with no central coordinator. Market makers lock bitcoin in time-locked fidelity bonds and offer UTXOs for CoinJoin in exchange for small fees (typically around 0.001% of the mixed amount). Takers pay makers and coordinate the transaction. Each round includes 4 to 20 counterparties. The original joinmarket-clientserver repository was archived in April 2026, but JoinMarket-NG (a wire-compatible reimplementation) and the Jam web UI continue active development.

Whirlpool (Ashigaru)

Whirlpool was originally Samourai Wallet's ZeroLink CoinJoin implementation, using fixed pool denominations and exactly 5 participants per round. After the Samourai founders were arrested in April 2024 and the original coordinator was seized, a community fork called Ashigaru relaunched Whirlpool in June 2025 with a new coordinator. Current pools are 0.025 BTC and 0.25 BTC with entry fees of 0.00125 and 0.0125 BTC respectively. All connections route exclusively through Tor.

How PayJoin Works

PayJoin (BIP 78) is a collaborative transaction between a sender and receiver. Instead of the sender constructing the entire transaction alone, the receiver also contributes one or more inputs. The result is a transaction where inputs belong to two different parties, directly violating the common-input-ownership heuristic that chain analysis tools use to cluster addresses. Because the transaction has no equal-denomination outputs, no special markers, and no unusual structure, it is indistinguishable from a normal Bitcoin payment on the blockchain.

The BIP 78 (v1) flow works in four steps: the receiver presents a BIP 21 URI with a PayJoin endpoint, the sender creates and signs an Original PSBT, the receiver adds their inputs and returns a Proposal PSBT, and the sender verifies, re-signs, and broadcasts the final transaction. The key limitation of v1 is that both parties must be online simultaneously, and the receiver must host an HTTPS server with a hot wallet.

PayJoin v2: Serverless and Asynchronous

BIP 77 (PayJoin v2), authored by Dan Gould and Yuval Kogman, eliminates the server requirement entirely. It replaces synchronous communication with an asynchronous relay architecture: the receiver creates a session and shares a URI pointing to an ephemeral mailbox on a relay directory. The sender posts an HPKE end-to-end encrypted Original PSBT to the mailbox via an Oblivious HTTP (OHTTP) relay. The receiver retrieves it, adds their inputs, and posts an encrypted Proposal back. The relay is untrusted and store-and-forward only: it cannot see PSBT contents or correlate requests with IP addresses.

PayJoin v2 adoption has accelerated since late 2024. Bull Bitcoin Wallet became the first mobile wallet to ship BIP 77 send and receive in December 2024. Cake Wallet added PayJoin v2 in May 2025 (v4.28.0), becoming the first wallet with both Silent Payments and PayJoin v2. BTCPay Server also supports BIP 77. The Payjoin Dev Kit (PDK) provides a reference Rust implementation for wallet developers integrating either version. For a deeper technical analysis, see our research on PayJoin and Bitcoin privacy.

Anonymity Set and Privacy Model

CoinJoin and PayJoin provide privacy through entirely different mechanisms. CoinJoin creates a quantifiable anonymity set: after a Whirlpool round with 5 participants, each output has 5 possible origins. After multiple Wasabi rounds, a single output may accumulate an anonymity score of 50+. This is powerful but measurable, and chain analysis firms factor anonymity set degradation into their models.

PayJoin does not produce a traditional anonymity set. Instead, its privacy comes from steganography: the transaction looks normal on-chain. An observer cannot even determine whether a PayJoin occurred. This property has a network-wide externality: even a small fraction of PayJoin usage degrades the reliability of input-ownership clustering for all Bitcoin transactions, not just PayJoin participants.

Fee Overhead

CoinJoin transactions carry significant fee overhead. The transaction itself is 2x to 10x larger than a standard payment in virtual bytes, meaning higher mining fees. On top of that, some implementations charge coordinator fees: Whirlpool/Ashigaru charges a one-time 5% pool entry fee, while Wasabi's third-party coordinators range from 0% (Kruw) to small percentages. JoinMarket maker fees are market-driven but typically around 0.001%. During periods of high fee rates, a single CoinJoin round can cost tens of thousands of satoshis in mining fees alone.

PayJoin has near-zero fee overhead. Adding the receiver's input adds approximately 68 virtual bytes to the transaction. PayJoin can actually reduce total fees: receivers can consolidate small UTXOs during incoming payments (free UTXO consolidation piggy-backed on a payment), and transaction cut-through allows the receiver to simultaneously receive a payment and make their own payment to a third party in the same transaction, saving up to 16% on fees compared to separate transactions.

Detection Resistance and Blockchain Footprint

CoinJoin transactions are recognizable on-chain through their characteristic structure: many equal-denomination outputs, large transaction sizes, and known coordinator patterns. Chainalysis, Elliptic, and TRM Labs can detect and flag CoinJoin transactions. Chainalysis has claimed the ability to trace bitcoin through CoinJoin rounds, though the extent of this capability is debated. Research has shown that anonymity guarantees are sometimes smaller than expected when pre-mixing and post-mixing transactions are analyzed alongside change outputs.

PayJoin transactions cannot be reliably detected. They have no special output pattern, no equal-denomination requirement, and no coordinator fingerprint. On-chain, a PayJoin is indistinguishable from any other Bitcoin payment. This steganographic quality is PayJoin's strongest advantage: you cannot flag what you cannot identify.

Wallet Support

CoinJoin wallet support is concentrated in privacy-focused desktop applications. Wasabi Wallet (Windows, Mac, Linux) supports WabiSabi CoinJoin with third-party coordinators. JoinMarket-NG and the Jam web UI run on desktop and CLI. Ashigaru (the Samourai fork) distributes its Android APK exclusively through a Tor onion site and offers Ashigaru Terminal for desktop.

PayJoin wallet support is broader and growing. BTCPay Server supports both BIP 78 and BIP 77 for merchant payments. Sparrow Wallet supports PayJoin v1 sending (since v0.9.7 in November 2020). Bull Bitcoin Wallet supports full v2 send and receive on mobile. Cake Wallet added v2 support in May 2025. BlueWallet and Wasabi support v1 sending. The Payjoin Dev Kit lowers the integration barrier for wallet developers building new implementations.

Regulatory Landscape

The regulatory environment for CoinJoin has shifted dramatically. In April 2024, Samourai Wallet's co-founders were arrested on charges of conspiracy to commit money laundering and operating an unlicensed money transmitting business. The DOJ alleged the platform processed over $237 million in criminal proceeds. Both pleaded guilty to lesser charges in July 2025 and were sentenced in November 2025: Keonne Rodriguez to 5 years and William Lonergan Hill to 4 years. zkSNACKs shut down Wasabi's default coordinator the same year, citing the same legal uncertainty.

PayJoin occupies a fundamentally different regulatory position. Because PayJoin transactions are indistinguishable from normal payments, there is no "mixing service" to regulate. No coordinator exists to charge fees or facilitate multi-party transactions. PayJoin is simply a more efficient way to construct a standard Bitcoin payment. This makes it the most compliance-compatible privacy enhancement available on Bitcoin today.

The EU has signaled stricter rules ahead: from July 2027, EU Crypto-Asset Service Providers will be prohibited from providing services that increase transaction obfuscation. CoinJoin services will likely fall under this prohibition. PayJoin, which produces standard-looking transactions, is unlikely to be affected.

Which Technique Is Better for Your Privacy Goals

The right choice depends on what you are trying to achieve.

If you need to break the transaction history of specific UTXOs (for example, consolidating coins from multiple sources into a single privacy-enhanced output): CoinJoin is the appropriate tool. Multiple rounds of mixing with a high anonymity set create genuine ambiguity about the origin of funds. JoinMarket offers the most decentralized option; Wasabi with a reputable third-party coordinator provides the largest anonymity sets.

If you want privacy during everyday payments without drawing attention: PayJoin is superior. Transactions look normal, cost less, and do not trigger chain analysis flags. PayJoin v2 removes the server requirement that limited v1 adoption, making it practical for mobile wallets and merchant payments. For Bitcoin-native payments with built-in privacy, Spark provides an additional layer by moving transactions off-chain entirely.

If you want both: use PayJoin for regular spending and CoinJoin for periodic UTXO hygiene. The two techniques are complementary. PayJoin prevents new clustering during payments, while CoinJoin breaks existing clusters on coins you already hold. Together, they address both forward and backward privacy.

Frequently Asked Questions

What is the difference between CoinJoin and PayJoin?

CoinJoin is a multi-party mixing transaction where several users combine inputs into equal-denomination outputs, creating an anonymity set. PayJoin is a two-party collaborative transaction where sender and receiver both contribute inputs, breaking the assumption that all inputs belong to one entity. CoinJoin transactions are detectable on-chain due to their distinctive equal-output pattern. PayJoin transactions are indistinguishable from normal Bitcoin payments.

Is CoinJoin illegal?

CoinJoin itself is not illegal in most jurisdictions: it is a method of constructing a valid Bitcoin transaction. However, operating a CoinJoin coordination service may trigger money transmitter regulations. The Samourai Wallet founders were convicted in 2025 for operating an unlicensed money transmitting business, not for the CoinJoin protocol itself. The legal distinction between building privacy software and operating a financial service remains an active area of legal development.

Can chain analysis firms trace CoinJoin transactions?

Chainalysis has claimed the ability to trace bitcoin through CoinJoin rounds, though the full extent of this capability is debated. CoinJoin transactions are easily identified on-chain due to their equal-denomination output pattern. Research has shown that analyzing pre-mixing and post-mixing behavior (change outputs, timing, amounts) can reduce effective anonymity sets. Multiple rounds of mixing with proper coin control improve resistance to these techniques.

Does PayJoin provide better privacy than CoinJoin?

They provide different types of privacy. CoinJoin provides a quantifiable anonymity set within a mixing round: 5 to 100+ possible origins per output. PayJoin provides steganographic privacy: the transaction is invisible as a privacy technique on-chain. PayJoin is more resistant to detection and regulatory pressure, while CoinJoin is more effective at breaking the history of specific UTXOs. For most users making everyday payments, PayJoin offers better practical privacy because it does not draw attention.

What is PayJoin v2 and how does it differ from v1?

PayJoin v1 (BIP 78) requires synchronous communication: both parties must be online simultaneously, and the receiver must host an HTTPS server with a hot wallet. PayJoin v2 (BIP 77) replaces this with an asynchronous relay architecture using HPKE end-to-end encryption and Oblivious HTTP. The relay is untrusted and cannot see transaction contents or correlate IP addresses. This makes PayJoin practical for mobile wallets and removes the server hosting barrier that limited v1 adoption.

Which wallets support PayJoin?

As of mid-2026: BTCPay Server supports both v1 and v2 for merchant payments. Bull Bitcoin Wallet supports full v2 send and receive on mobile (shipped December 2024). Cake Wallet added v2 in May 2025. Sparrow Wallet supports v1 sending. BlueWallet and Wasabi support v1 sending. The Payjoin Dev Kit (PDK) provides a reference Rust implementation for developers building new integrations.

Can CoinJoin and PayJoin be used together?

Yes, and this is the recommended approach for comprehensive Bitcoin privacy. Use CoinJoin periodically to break the transaction history of UTXOs you already hold, and use PayJoin for ongoing payments to prevent new address clustering. CoinJoin addresses backward privacy (obscuring where coins came from), while PayJoin addresses forward privacy (preventing observers from linking your future transactions). For more on combining techniques, see our research on the Bitcoin privacy landscape.

This tool is for informational purposes only and does not constitute financial or legal advice. Privacy technique capabilities, wallet support, and regulatory status change frequently. The legal landscape around Bitcoin privacy tools varies by jurisdiction and is evolving rapidly. Always verify current information and consult legal counsel before relying on any privacy technique for compliance-sensitive use cases.