How does the Payjoin protocol stack up in terms of privacy?

Legally speaking, everyone has the right to privacy, whether online or offline, but honestly, the privacy of most people is pretty much shot. The financial sector is a real hotbed for surveillance and tracking, as everyone deals with money one way or another. Bitcoin, being a digital currency, has changed the game a bit compared to what centralized institutions are used to. When you make Bitcoin transactions, they’re pseudonymous, which means you can track them via addresses or public keys, but you won’t find out who the actual sender or receiver is unless you can link it to a centralized entity, like an exchange. Government agencies and others can use chain analysis to keep tabs on Bitcoin transactions. There are tools for this, like one that used to be available on oxt.me, but that site isn’t up at the moment. The Common Input Heuristic is a method often used to figure out who owns what in a transaction. It operates on the assumption that all inputs for a transaction come from a single person. However, this method hasn’t been very effective since Coinjoin came into play. As pointed out by ACHOW101, Coinjoin was created to break these heuristics. Coinjoin works by pooling multiple inputs from different users and then treating them as a single input before sending out multiple outputs to their respective destination addresses, which boosts privacy for Bitcoin users.

Your assumptions are not quite correct. If the receiver has a 7 BTC input and the sender is spending 5 BTC, then the receiver will create a single 12 BTC output. The receiver will not split their 7 BTC input into smaller coins first. Payjoins are more fee efficient than any other on chain transaction and create overlapping transaction histories as a privacy bonus. However, regular equal-output coinjoins can contain many more than just 2 participants, so if the goal is to maximize privacy, then other coinjoins with enough liquidity can be more cost efficienct. No

Let's see: If Bob will avoid address reuse, then outside observer will see: Example CoinJoin: https://blockchair.com/bitcoin/privacy-o-meter/69d9d66aae4812b6cf156f32267b773fb2118db696bb847ebd3454a198b59fbd As you can see, if some tool does not know about this forum topic, it may assume, that gmaxwell had 40k BTC, and sent it to someone else. However, you never know, if it was only a CoinJoin, or maybe also a PayJoin. It depends, how your transaction is created. For example, it is also possible to start from the recipient, create a PSBT, where some dust is spent to some output, with some given amount, and then it can be signed with SIGHASH_SINGLE | SIGHASH_ANYONECANPAY, so that anyone could be a sender, without invalidating signatures. In this way, you start from some "negative fee transaction", and the sender is simply attaching some inputs, to make them non-negative. Also, in case of the first example above: Alice could just send to Bob this transaction, signed with proper sighashes: And then, Bob could attach more inputs and outputs, to make the transaction from above, by signing everything with SIGHASH_ALL. And then, nobody would know, if Bob received 5 BTC, or maybe 6 BTC, or maybe Alice received 1 BTC from Bob. Outside observers will only see this: And the situation is even more complicated, when you have Schnorr signatures, and you don't know, if behind some Alice's address is actually only Alice, or maybe some 3-of-3 multisig, combined into a single signature.

It'd be good to imagine Payjoin as a private payment to another person, and Coinjoin as a private payment to yourself. In the former, you send money elsewhere, whereas in the latter, you send them to yourself. The problem with Payjoins, as far as I understand, is interactivity. When paying for goods and services, it is not practical to interact with the merchant to make your coins more private. That rises the cost of the merchant for a service they might not be willing to provide.

You can send elsewhere with other coinjoins, it's not required to send to yourself.