§ 00 · The lookout
A server that watches the chain for you
and cannot watch you.
A silent payment address never appears on the chain. Great for privacy, but it means your wallet cannot look up its own money: someone has to check every transaction, and a phone cannot. So a server does the heavy half. We run one.
This page is its honesty contract: what it can do to you, what it cannot, and how to catch it lying.
§ 01 · Why you would care
Because this server decides whether your wallet sees your money
It happened before
In 2024 a major wallet’s backend silently missed payments. Money arrived; wallets showed nothing. Every phone wallet depends on a server like this one.
Most alternatives spy
The easy way to build this service is “give us your viewing key”. It works, and it hands a company a list of everyone who ever pays you. This design refuses that trade.
You should not have to believe us
Every claim here is checkable from public data or marked as our word. The one thing to remember: this server keeps a tamper-evident public diary of everything it serves. Lying leaves evidence.
§ 02 · What it does
One number per transaction, the same for everyone
Per eligible transaction, one 33-byte value: the tweak, defined in BIP 352 as the sum of the transaction’s eligible input keys times a hash of its inputs. Computed from public data, it says nothing about who a payment is for. Your wallet combines it with your private scan key, on your device: match or no match. Keys never leave the device.
Simpler: the server does the reading, your wallet does the recognising. Everyone gets the same reading list.
Tweaks in our index, one per eligible transaction.
Counted on our own index, 2 Sep 2026.
Blocks covered: every one since silent payments activated.
Height 709,656 to the tip, no gaps.
Average tweaks per block your wallet checks.
Instead of thousands of transactions.
How often the server’s fingerprint chain is checkpointed publicly.
To nostr relays we do not control.
Nobody else has published these counts. We did, with per-block CSVs, at bitsagarob/silentpayments-measurements.
§ 03 · What it cannot know
The privacy is structural, not promised
It cannot see your payments
Matching happens on your device. No key, address, or match result is ever sent. The server cannot tell which tweak you cared about, or whether you found anything.
It cannot tell wallets apart
Every wallet asks the same question, a block range, and gets the same answer. No accounts, no per-user state, nothing in a request that says what you own.
It does see your connection
Like any server: an IP address and the block ranges you asked for. Reach it over Tor and it does not even see that. We keep no request logs, but the design does not ask you to believe that.
§ 04 · What it could still do wrong
Two ways a lookout can cheat
Omission
Drop one tweak and the wallet behind it never sees its money arrive. The coins are safe on the chain; the notice is gone. This is the 2024 failure, silent by nature.
Equivocation
Serve everyone the complete answer and one target a doctored one. Comparing notes catches nothing, because everyone else’s answer checks out.
Missing from that list on purpose: stealing coins or seeing payments. The worst case is lost notice, never lost money. Recovery is a rescan against an honest source.
§ 05 · The catch-me mechanism
Every answer leaves a fingerprint we cannot take back
Three moving parts, each one small:
- Fingerprint every block. Everything served for a block is hashed, chained to the previous fingerprint (specified in SPCOMMIT.md, with test vectors).
- Publish the head, elsewhere. Every six hours, to relays we do not control. Someone else’s relay cannot be quietly edited later.
- Anyone can recompute. Any node can rebuild a block’s true fingerprint. Omission contradicts the published head; two different answers cannot both match it.
Cheating is still possible. Cheating quietly is not.
Simpler: the server keeps a public diary of everything it says. If it ever tells two stories, the diary is the witness.
First checkpoint event 6d51153a…, published 2026-09-01, fetched back from the relays and verified. Chain covers 709,656 to the tip. Test vectors: five heights, recomputed independently from Core REST data.
§ 06 · The limit
What the fingerprint chain does not fix
Said plainly
Commitments prove omission and equivocation after the fact. They do not stop a targeted wrong hint, and they do not warn your wallet in the moment. The client-side defence is separate: on a match, download the full block and check it yourself. Good wallets do both.
§ 07 · Status
Where this stands today
Verified three independent ways, dated:
- Index matches the BIP 352 reference implementation, block by block.
- Index matches the only other public index we know of, everywhere comparable.
- Real money: a 50,000-sat payment found blind on 1 Sep 2026, and a stock desktop wallet, holding its own keys, found its own payment through this server the next day. That story, with every number published, is the walkthrough.
The server is open today, Tor-only. Ports 8010 (HTTP) and 8011 (gRPC):
jelbugvogknkkxuwyacgl5tfzoooaidz6kbj4cyuehog67yidhd3ylid.onion
Tor-only is deliberate for the preview phase: a stable self-authenticating address, and no one in between sees who connects. It is command-line territory for now, blindbit-cli through torsocks works today. The clearnet endpoint arrives with dedicated hardware and is published here the day it opens. The fingerprint chain is already public and already binding either way: today’s commitments constrain what the server may ever claim it served.