silentpayments.net

The map

Everything here, connected.

One workshop, one goal, many artifacts. This page is the overview: every piece of the silent-payments work, what it is, and which other pieces it feeds. Every box below is a link. The star they all point at is the endgame.

Map of the silent payments work. At the top, the endgame: kill the address, trust no one. Three columns feed it: the identity column (payment names, the change log with nostr checkpoints, and the payment-name StartOS package), the receiving column (the lookout tweak server on Tor, the spcommit fingerprint chain, the independent StartOS checkpoint witness, and the real-payment walkthrough), and the standards column (the measurements, the converged protocol draft, the bitcoindev thread, and the roadmap). A bottom row holds the hardware experiments: the shop hardware, the SeedSigner-fork simulator with a silent payments wallet, and the reproducible-build verifier. Arrows: a name resolves to an address the lookout scans for; the lookout's served data is fingerprinted by spcommit, which the witness package recomputes independently so the two published chains must match; the lookout's index produced the measurements, which produced the protocol draft, which went to the mailing list. the endgame kill the address · trust no one IDENTITY · one name for life payment names silentpayments.net · sp1 + lightning the change log every record signed, heads on nostr StartOS: payment-name run the name half yourself RECEIVING · the lookout the lookout tweak server · open, Tor-only spcommit chain every answer fingerprinted, 6h to nostr StartOS: checkpoint witness recomputes the chain, none of our code the proof 50,000 real sats, found blind STANDARDS · one protocol the measurements 255,434 blocks, nobody else has them the protocol draft two stalled specs, converged the bitcoindev thread the numbers, on the record the roadmap the ladder, item by item resolves counted must match HARDWARE · the unserved frontier SeedSigner hardware the shop, verified builds the fork wallet silent payments on SeedSigner, in a tab verify.bitsaga.be byte-for-byte reproducible firmware

Identity

One name, both rails

The name service: a human name that resolves to a silent payment address and a Lightning offer at once (BIP 353 over DNSSEC, BIP 352, BOLT 12; a real Lightning payment has settled against a name from our own two-node rig). Around it: the append-only change log whose head is checkpointed to nostr, the directory, shareable cards, own-domain mode, the wallet matrix with findings nobody else publishes, and live numbers. Self-hostable via the payment-name StartOS package, promoted to Start9’s Community registry.

Receiving

The lookout, and its two witnesses

The lookout is the tweak server: full mainnet index since silent payments activated, open today over Tor, honesty contract published. Its every answer is fingerprinted into the spcommit chain, checkpointed every six hours to relays we do not control. The checkpoint-witness StartOS package is the second opinion: it recomputes the same chain from your own node using none of our code and publishes its own signed copy, so if the two ever disagree, anyone holds the proof. The walkthrough is the receipt that the whole pipeline works on real money. The story in prose: the server that can be caught lying.

Standards

Numbers first, then the spec

The 2024 standards debate stalled waiting for measurements; the measurements repository answers it across every block since activation. On top of it sits the converged protocol pre-draft, which merges the two dormant spec efforts with what actually shipped, and the bitcoindev thread that puts the numbers on the record. The roadmap tracks the working items; the endgame states the destination they serve.

Hardware

The frontier nobody serves yet

Finding from the wallet matrix: no hardware wallet anywhere can receive a silent payment. Our poke at that gap: a SeedSigner firmware fork with a silent payments wallet on board, runnable in a browser tab via the simulator (it shows a real silent payment address and connects to Sparrow). Around it, the trust chain for selling hardware at all: the shop and byte-for-byte reproducible firmware builds.

Adjacent, deliberately not the lead: a Tor-only Electrum server and a Frigate instance exist here as contrast infrastructure; Frigate is the scan-key shape the lookout page names as the privacy trade to avoid, which is worth running precisely to know it well.

Updated by hand. Written 2 September 2026, the day the lookout opened over Tor. Kept out of search engines on purpose; you found it because a page here sent you.