--- title: "The lookout · a server that watches for your payments and cannot watch you" description: "A tweak server scans the chain for silent payments meant for you, without ever learning which payments are yours. This page says exactly what it can and cannot do to you, and how to catch it lying." url: "https://silentpayments.net/lookout" language: "en" --- > A tweak server scans the chain for silent payments meant for you, without ever learning which payments are yours. This page says exactly what it can and cannot do to you, and how to catch it lying. _This page has three detail levels in HTML: Easy, Advanced and Cypherpunk._ _This twin carries the Advanced and Cypherpunk text, which is the complete version._ § 00 · The lookout # A server that watches the chain for you and cannot watch you. A silent payment address never appears on the chain. Great for privacy, but it means your wallet cannot look up its own money: someone has to check every transaction, and a phone cannot. So a server does the heavy half. We run one. This page is its honesty contract: what it can do to you, what it cannot, and how to catch it lying. § 01 · Why you would care ## Because this server decides whether your wallet sees your money #### It happened before In 2024 a major wallet’s scanning backend silently missed payments. Money arrived on the chain; wallets showed nothing. Users found out from block explorers. Every silent payments wallet on a phone depends on a server exactly like this one. #### Most alternatives spy The easy way to build this service is “give us your viewing key and we scan for you”. That works, and it hands a company a complete list of everyone who ever pays you. The design here refuses that trade. Knowing the difference is how you judge any wallet backend, not just ours. #### You should not have to believe us Every claim on this page is either checkable from public data or explicitly marked as our word. If you only remember one thing: this server publishes a tamper-evident diary of everything it serves, so lying leaves evidence. § 02 · What it does ## One number per transaction, the same for everyone For every transaction that could carry a silent payment, the server computes one 33-byte value: the tweak , defined in BIP 352 as the sum of the transaction’s eligible input public keys times a hash of its inputs. Tweaks are computed from public chain data. They say nothing about who a payment is for. Your wallet combines each tweak with your private scan key, on your device. Either a derived key matches an output in the block, or it does not. The keys never leave your device. 187.8M Tweaks in our index, one per eligible transaction. Counted on our own index, 2 Sep 2026. 255,434 Blocks covered: every one since silent payments activated. Height 709,656 to the tip, no gaps. 735 Average tweaks per block your wallet checks. Instead of thousands of transactions. 6h How often the server’s fingerprint chain is checkpointed publicly. To nostr relays we do not control. Nobody else has published these counts. We did, with per-block CSVs, at [bitsagarob/silentpayments-measurements](https://github.com/bitsagarob/silentpayments-measurements). § 03 · What it cannot know ## The privacy is structural, not promised #### It cannot see your payments Matching happens on your device. The server never receives a key, an address, or a match result. It cannot tell which of a block’s 735 tweaks you cared about, or whether you found anything at all. #### It cannot tell wallets apart Every wallet asks the same question: the tweaks for a range of blocks. The answer is identical for everyone. No accounts, no per-user state, nothing in the request that says what you own. #### It does see your connection Like any server: an IP address, and which block ranges you asked for. That is the honest residue. Reach it over Tor and it does not even see that. We keep no request logs, but the design does not ask you to believe that. § 04 · What it could still do wrong ## Two ways a lookout can cheat #### Omission Leave one tweak out of an answer, and every wallet relying on it is blind to the payment behind it. Your money is safe on the chain, but your wallet says nothing arrived. This is the 2024 failure, and it is silent by nature. #### Equivocation Serve the complete answer to most people and a doctored one to a target. Casual comparing of notes would not catch it, because everyone else’s answer checks out. Note what is missing from that list: a server in this position cannot steal coins and cannot see payments. The worst case is losing _notice_ of money, never the money. Recovery is a rescan against an honest source. § 05 · The catch-me mechanism ## Every answer leaves a fingerprint we cannot take back Three moving parts, each one small: 1. **Fingerprint every block.** Everything served for a block, tweaks and spent-output identifiers, is hashed together with the previous block’s fingerprint into a chain , specified in [SPCOMMIT.md](https://github.com/bitsagarob/silentpayments-measurements/blob/main/SPCOMMIT.md) with test vectors, so anyone can implement the check without reading our code. 2. **Publish the head, elsewhere.** Every six hours the chain’s head goes to nostr relays we do not control. A checkpoint on someone else’s relay cannot be quietly edited later. 3. **Anyone can recompute.** With any Bitcoin node, recompute a block’s true fingerprint and compare. Omission contradicts the published head. Two different answers to two different people cannot both match it. Cheating is still possible. Cheating _quietly_ is not. First checkpoint event 6d51153a…, published 2026-09-01, fetched back from the relays and verified. Chain covers 709,656 to the tip. Test vectors: five heights, recomputed independently from Core REST data. § 06 · The limit ## What the fingerprint chain does not fix #### Said plainly Commitments make omission and equivocation provable _after the fact_. They do not stop a targeted server from inserting a wrong hint to waste one victim’s bandwidth, and they do not warn your wallet in the moment. The client-side defence is different: on a match, download the full block and check it yourself. Good wallets do both. #### The real fix is bigger than us The answer to “why trust any one server” is servers you do not have to pick carefully: many operators publishing matching fingerprint heads, then the node network serving the data itself. That ladder, and where this server sits on rung one, is the [roadmap](https://silentpayments.net/roadmap). § 07 · Status ## Where this stands today Verified three independent ways, dated: - Index matches the BIP 352 reference implementation, block by block. - Index matches the only other public index we know of, everywhere comparable. - Real money: a 50,000-sat payment found blind on 1 Sep 2026, and a stock desktop wallet, holding its own keys, found its own payment through this server the next day. That story, with every number published, is the [walkthrough](https://silentpayments.net/walkthrough). The public endpoint is published on this page the day it opens. The fingerprint chain is already public and already binding: today’s commitments constrain what the server may ever claim it served.