Quietsats

One address. A different output every time.

Publish a Bitcoin address and every payment to it is linkable, forever, by anyone. Silent Payments fix that without asking the sender to contact you first. You publish one static address; each payment lands on a fresh output that only you can find.

This is a working implementation of BIP-352, running entirely in this tab. No server, no node, no wallet connection, and no key ever leaves your browser. Every number below is computed here, now, by the same elliptic-curve maths a wallet would use.

1 · Your silent payment address

Generated in your browser, and read-only on purpose. There is nowhere here to paste a key of your own, so a key holding funds cannot be entered by mistake.

2 · Pay it, twice

A sender needs nothing from you but the address above. They combine their own input key with your scan key to reach a shared secret, then derive an output that pays your spend key. Change the sender key, which is what happens on any real second payment, and the output changes completely.

The sender key is generated as well. Use the buttons to mint a new one.

3 · Find your payments

Now the other side. Given only what is public in a transaction, its input public key and its outputs, your scan key finds which output is yours. A stranger holding the same transaction learns nothing.

Why this is different from a reused address

The two outputs in step 2 share no data on chain. Nobody can tell they went to the same person, because the link between them is a shared secret only the sender and you can compute. You did not have to be online, hand out a fresh address, or run any infrastructure to receive them.

Implemented: address encoding (bech32m), input hashing, ECDH shared secret, output tweak derivation, and recipient scanning, all per BIP-352. Not implemented: labels, taproot script paths and transaction broadcast. This tool derives and detects keys; it does not move coins.

Addresses here carry the tsp prefix, which BIP-352 reserves for testnet and signet, so nothing this page prints can be mistaken for a mainnet address. The page also has no network access of any kind — it never contacts a node, a server or a wallet, and it builds no transaction — so it cannot move a coin on any network.