Simple things should be simple, complex things should be possible.

• Alan Kay

nix, and the whole ecosystem surrounding it, is the only major attempt at a top-to-bottom solution to the problem of reproducible software. There is one other that has implemented this (guix), but its mindshare is dwarfed by Nix’s, which is in turn dwarfed by other package managers and Linux distros, which are in turn dwarfed by proprietary programs and operating systems like macOS and Windows.

Nix is, most fundamentally, a means of getting software from machine or environment A to machine or environment B in a deterministic way: that is, as long as you can use nix on both machines to perform the transfer and the target machine has the resources to run the program, you can guarantee that the software will be transferred completely and have all the dependencies it needs to run. No other major package manager does this.

Technically this is a big leap forward, but, given how few use nix, we can’t yet call it that. It’s no secret that nix is notoriously difficult to use. But it seems to me that many of these problems are problems of accidental complexity (problems engineers create through suboptimal design and can therefore fix) rather than essential complexity (problems inherent to the problem itself). Since Nix is very old (older than git!), there has been a lot of churn on tooling, which has resulted in a lot of tooling, a monolithic architecture, split communities, outdated documentation, and many many many third party solutions aiming to solve (and re-solve) the same accidents of complexity.

nix does not do one thing well nor is there one obvious way to do any given thing: simple things are complex and complex things are complex.

That said, at its base, nix is a beautiful idea, and an elegant solution to the software distribution problem. It enables so many positive downstream effects. It makes your package management and operating system declarative, and brings the deterministic, mathematical certainty of a functional language to your computer-using experience. That is power.

Thus, we have a revolutionary tool that basically no one uses because it is very difficult and the ecosystem is fragmented. Therefore I believe that the consequences of making a determinate system like nix easy to use will have a profound impact on how we interact with computers for the better.

As such, this problem is begging for a solution.

Kai - Prototyping a friendlier frontend for determinate computing

I’ve begun working on one such solution which I’m calling kai, short for the Ancient Greek καιρός or “the right time”. At first glance, it is just lipstick on nix, which alone would be great. But with the proper design we can architect it to be much more.

The goal is to:

1. Define a generic protocol which enumerates a set of capabilities any determinate system should have, such as:
   • Reproducible developer shells for teams and projects (probably the most common nix use case now)
   • Ad-hoc shells for testing out software on the fly
   • Build targets allowing you to create virtual machines, or deployments with the specified software and configurations preinstalled, or the ability to create custom ISOs to roll your own operating system configuration!
   • Rollback to previous generations if a new dependency breaks the system
   • Automated garbage collection for dangling dependencies no longer in use
   • etc.
2. Implement the protocol in a CLI tool and config file such that it is compatible with the two full-fledged determinate systems (nix and guix) and any others which later implement the generic protocol, eliminating as much accidental complexity as possible and making them friendly and fun to use. The mappings of the generic protocol to the concrete implementations we call blueprints (thanks Luke Boswell!)
3. Make the tool modular such that users can:
   • Take only those parts of the determinate system which they want (some may only be interested in reproducible shells while others want build systems – there should of course be a “default” option which has everything the average user wants).
   • Modify or create their own implementation of a given tool. For example, tvix spawned out of a desire to make a modular nix implementation since the primary implementation is monolithic, the problem being that if you don’t like the way a given piece works or believe it is inefficient, you cannot easily swap it out for a different implementation and must satisfy yourself with the monolith.
   • Add new modules and commands as desired (for example one may want a kai deploy which handles deploying to their VPS of choice).

This clearly goes beyond “make a better nix frontend”. The motivation is that this design will allow us to experiment and play with designs for a better system while being backward compatible with existing ones. And further, replace components of one of the existing systems (e.g. replacing one of the nix components with a tvix one, but still having the total package management solution be nix-compatible).

It is built in the roc programming language, a high-level functional language which allows us to create platforms (in a lower-level language, zig, in this case) which define behavior tailored to specific use-cases. For example, in our case we create a platform to specify an EDSL (Embedded Domain-Specific Language) to implement the determinate protocol.

So far, kai is just a proof of concept which implements a basic version of each of the three ideas above. The nascent determinate protocol so far has two commands in the CLI, shell and build:

• shell: Enters a shell containing the packages specified in kai.roc by calling the corresponding shell command. This is equivalent to a flake.nix for nix and a manifest.scm for guix. If none exists in the current directory, it scaffolds a kai.roc file with no packages. Example:

  app [config] { kai: platform "../platform/config.roc" }
  
  config = [
      Shell({
          name: "simple-kai-shell",
          # `packages` is a Roc header keyword in this compiler, so shell configs use `pkgs`.
          pkgs: ["git"],
      }),
  ]
  

• build: Builds the specified machine image according to kai.roc. Technically this should be a generic build for any target, but I’ve chosen a very common use case for the time being for simplicity. Example:

  app [config] { kai: platform "../platform/config.roc" }
  
  config = [
      MachineBuild({
          hostname: "kai-example",
          system: "x86_64-linux",
          install: ["git"],
          ssh_keys: [],
          state_version: "25.05",
          image: { format: "qcow2" },
      }),
  ]
  

There is also a third command, blueprint, which allows you to choose the backend which implements the determinate protocol. In our case we have two blueprints which can implement shell and build: nix and guix. So if you blueprint list to see your options, then do blueprint set nix, calling shell will perform nix develop under the hood and build will call the appropriate command to build the machine above.

There is also a .kai directory which manages a config file corresponding to the blueprint. For nix, .kai will contain a flake.nix and our build and shell commands will manipulate and use that under the hood. For guix, the file is manifest.scm.

Next in the plan is to add a bespoke deploy command modularly, such that deploy can mean different things for different people, and we can both (1) show the power of kai to easily deploy machines preconfigured with software, and (2) show how people can extend kai commands to suit their various use cases.

Onward!

…to read the Latin & Greek authors in their original is a sublime luxury … I enjoy Homer in his own language infinitely beyond Pope’s translation of him […] I thank on my knees him who directed my early education for having put into my possession this rich source of delight: and I would not exchange it for any thing which I could then have acquired & have not since acquired.

Thomas Jefferson, Thomas Jefferson to Joseph Priestley, Philadelphia, 27 Jan. 1800

But of the mere facts of history, as commonly accepted, what educated youth of any mental activity does not learn as much as is necessary, if he is simply turned loose into an historical library? What he needs on this, and on most other matters of common information, is not that he should be taught it in boyhood, but that abundance of books should be accessible to him.

The only languages, then, and the only literature, to which I would allow a place in the ordinary curriculum, are those of the Greeks and Romans; and to these I would preserve the position in it which they at present occupy. That position is justified, by the great value, in education, of knowing well some other cultivated language and literature than one’s own, and by the peculiar value of those particular languages and literatures.

John Stuart Mill, Inaugural Address, 1867.

I’m building a new open source digital library for Ancient Greek using AI.

With the rise of LLMs, we have an opportunity to create new tools for preservation, learning, and engaging with ancient texts that would have taken massive amounts of dedicated and skilled work to produce before.

The tools which pioneered the work of bringing Ancient Greek to the internet can be credited to projects like Perseus Digital Library, Scaife Viewer, and others. Building on top of their work in the age of AI can yield results previously unfeasible.

Thus, there is a unique opportunity to initiate a revival of interest in the works of Antiquity in their original language; to let us hear the authors speak again with their own voices.

To this end I created a set of individual skills, coordinated as a pipeline by a meta-skill text-orchestrator, for creating this database automatically. The goal is: given a single prompt like “Add Plutarch’s Lives”, it will search the web, find the original Greek edition, find public domain English translations, download them, process and clean them, segment them into verses (or create a custom versifiable translation if no extant translation aligns well), create interlinear translations, create Latin transliterations for pronunciation, and create treebank data for each word.

This is still only in the “proof-of-concept” stage, and there are many improvements to make, but it has successfully run through the full pipeline on a few smaller sample texts. Therefore text-orchestrator could be an extremely powerful tool for automating database generation from a single prompt. The data it collects is optimized for learning purposes, and the pipeline ends by generating a database artifact, texts.db, which can be directly imported into the lyceum.quest Ancient Greek reader, which is a companion project to this one. It acts as the interface for the data and is my attempt to bring together all the best aspects of Perseus, Scaife, and other readers online, and improve them where possible.

I also show how I ran Karpathy’s Autoresearch to fine-tune an alignment skill which generates English interlinears for every word of the Greek text. We should be able to use this method to fine-tune any skill in the pipeline, but that is reserved for future work.

Table of Contents

• Why
• Goal
• Limitations
• AI Generated Data
• Agent Optimizations and Workflow
• Desired Data
• Generate, Verify, Optimize Loop
• The Text Orchestrator Skill Pipeline
• Future Directions
• Bottlenecks
• Conclusion

Why

I believe this revival is imperative in a time where technology and culture allow and encourage a distancing from our roots which leaves us further untethered from a deep historical understanding of ourselves and our “story” in the world.

As a result nearly all of the institutions for which learning Greek was once a rite of passage in any serious education are gone, and the curious self-driven student is mostly left with fragmented resources for learning.

Further, the attention economy and modern technology constantly competes with any new learner’s focus.

This deadly trifecta of difficult and fragmented learning resources, with a centuries-long cultural cooling on and de-institutionalization of the classics, and deep distraction-technology integration into our personal lives are deep barriers to overcome, but the rise of LLMs can, I believe, help overcome all three.

I take John Stuart Mill’s view that history is fundamentally interesting in and of itself, and if these three barriers are overcome, students would come flocking back to learn.

Therefore, reviving interest in learning ancient languages mandates lowering those barriers to entry and making the learning process as engaging and as easy to dive into what the student is there to learn as possible.

With LLMs, we can do this.

As Dr. Gregory Crane, founder and head of the Perseus Digital Library, notes:

Now we have multiple Large Language Models (LLMs) that can not only translate but also provide reasonable word-by-word grammatical explanations of any source text. My first goal is to provide my students with enough knowledge so that they can begin to exploit this rich and increasingly complex scaffolding.

[…]

LLMs are slow and frontier models are expensive but, given the money, there is no reason we could not generate literal translations for all Classical Greek and Latin literature.

Dr. Gregory Crane, Towards corpus-based learning: exercises with Ancient Greek, 2026.

Goal

My primary goal is three-in-one: Create the largest corpus of publicly available online Greek texts with the richest set of accompanying data to allow us to build the most intuitive, engaging, and useful interfaces possible for both learners and experts.

If this is successful, we can expand to other ancient languages, starting with Latin.

I’ve already built the initial version of the interface at lyceum.quest. See the announcement post for the dashboard here.

The proof-of-concept has been validated in showcasing a taste of what’s possible now and is already one of the most feature-rich interfaces available. It aggregates much of the freely-available data online. It makes available side-by-side Greek-English translations with the Greek fully parsed, such that each word of Greek text becomes interactive. A user can click on a word to see a popup containing definitions from each major Greek database (Perseus, Logeion, and LSJ), see morphology and grammar data, and even see an AI-generated contextual meaning. It also has numerous display enrichment options like color highlighting for inflections and grammar, and an Anki-style spaced repetition deck for memorizing words from a reader’s chosen texts.

We can, however, do so much more.

For example, what I personally felt was missing most from my own learning were Hamilton-style word-by-word interlinear translations, which are rare to find online, as that would fill a primary gap for me when learning. So I had Claude generate them custom for the Iliad, which was pretty token-heavy and expensive. But the value of having disambiguated word meanings was immediately apparent. Further, it’s extremely important to note that for most Greek texts, interlinear translations have never been done. Even for the Iliad itself, I was unable to find a complete interlinear English translation (Hamilton himself, the champion of this method, only did this for a few books of the Iliad).

In short, it takes a tremendous amount of effort even from expert humans to create interlinear translations, which the world would greatly benefit from having. This is just one example of a real gap here that could benefit greatly from AI.

Limitations

A major goal is to do this for as many texts as possible, starting with the most desired texts like Homer, Plutarch, The Gospels, or Meditations. But I was generating these interlinear translations through manual prompting, with crude trial-and-error experimentation. I eventually learned to feed it “ground truth” data (using Hamilton’s Iliad interlinear as a sample) so that it could develop an alignment skill from which it would produce Hamilton-like interlinear translations for a given text. I was able to achieve moderate success with this but still found the method too manual, ad-hoc, and error-prone, and translations would not always disambiguate the word correctly for the given context.

Two things quickly became clear:

1. There was much more we could do than merely interlinear translations.
2. My current approach of prompting AI per-translation was expensive and unscalable.

For (1), I realized I wanted more than interlinears. In one reader view, I wanted:

• Full prose translations (as many public domain as I could find)
• Interlinear beneath each word
• Segmented verses, like the Bible (enabling side-by-side views)
• Transliterations (the Latin rendering for pronunciation help)
• Treebanks containing grammar, inflection, and other morphology data for each word (ideally color coded for easier sight-recognition)

This way, information could be progressively revealed to the reader as it suits them. They can try to learn each word one at a time, learn how it fits within the phrase or sentence, then learn how that sentence fits within the greater narrative. This level of granularity exists at the word level.

This way, the text can truly “come alive” as each word now represents a rich treasure trove of data that a reader can dig into at their preference and to their taste.

So a single Greek text can go from this:

To this:

These are just a sample of the things we can do with static, one-time LLM use. We could also add interactive AI chat elements like highlighting and asking about a passage, like ancientgreek.jean.land does, for example. Or a chat just to talk about a specific work or ask general questions.

Eventually, we could even use AI speech-to-text (STT) and text-to-speech (TTS) features to help students learn and grade their pronunciation, or read passages to them.

AI Generated Data

For now, we will focus on what can be done up-front with AI. The tradeoff we are making at present is that the high costs of doing this work are all in the initial phase. Adding in dynamic AI features can come later. A good static data set for translations/transliterations etc. only needs to be done once and is then available forever.

Some, like ancientgreek.jean.land, have taken the approach of using AI to quickly generate translations on the fly, which is a great novel feature. But this won’t scale and should be long-term unnecessary. We need not spend tokens on any of the work required here any more than is necessary to produce a correct result. Therefore, what’s really needed is a large token budget to:

1. Refine a process for generating the translations
2. Create translations using it

And then a budget for human Greek experts to:

1. Manually audit and correct the data produced by the process itself
2. Optimize ground-truth “holdout” data used by the agents to evaluate the quality of their work by (and automate improvements)

Agent Optimizations and Workflow

LLMs have recently passed a capability threshold in which many programmers find themselves no longer writing code, but exclusively prompting instead. This has led to massive debates on the true efficacy of LLMs: whether the code they produce is truly high-quality, functional, and maintainable, or “slop” masquerading under a flashy veneer. There is significant skepticism in the Classics community as well.

Despite valid misgivings, it appears that with the right workflows AI can produce surprisingly accurate results, which can then be refined by a human expert.

So if AI can translate accurately enough, this turns the problem from one of translation generation to one of validation, and the human cognitive load for validating work is orders of magnitude easier than the act of creating it.

This means we can, perhaps, for the first time in history, have a hope of creating a unified corpus rich interlinears, morphology data, versifications, and more to provide progressively enhanced experiences when engaging with ancient texts, all-in-one, as opposed to the fragmented efforts which exist today.

That said, the current state of the art appears to involve the heavy use of markdown files like SKILL.md and AGENTS.md along with intelligent context management (context being the primary scarce resource for agents). I’ve attempted to use best practices where possible to build a scalable pipeline for Lyceum which can take a simple query like “Add Plutarch’s Lives” and end with a rich set of data which includes the texts, translations, generated interlinear, etc. which are ready to import into the reader.

Desired Data

As I was working through this it soon became clear that we may be able to automate the following:

• Interlinear translation
• Latin transliteration
• New Testament-like verse segmentation of Greek/English for phrase-level learning
• Custom “versified” translation if no English translation aligns well (ex. Homer translations are rarely direct)
• Treebanks

Each of these would have been extremely time-intensive pre-AI, but following a Generate-Verify-Optimize loop (below), this could become a far more feasible task of auditing and verification rather than generation from scratch.

Generate, Verify, Optimize Loop

Using agent skills, if we apply an approach of Generate-Verify-Optimize feedback looping, we can refine texts through a combination of agent-based methods like Karpathy’s Autoresearch and human feedback loops. For any skill we have which generates data, like /skill:create-interlinear, we craft human-expert curated data we can verify against from which the agent can optimize itself.

We save this verification “holdout” data to be used only for evaluation against the LLM’s results at the end of the process, so as not to bias it.

After comparing the generated data against the holdout data, we can see the error rate. There is some ambiguity here, as Greek word-level translations can have multiple correct meanings, even given the same passage or context.

For example, the opening word of the Iliad, μηνιν, could mean “wrath” or “rage”, and if the holdout data only has “wrath”, it could count “rage” as incorrect. Of course, over time the holdout data can be refined to account for multiple correct answers, but the primary downside is negligible as it just means we’re forcing the AI to conform to a specific style.

After verification, based on how effective it was, we can optimize the skill, either by hand or using tools such as Autoresearch.

Human verification is mandatory, but using Autoresearch to improve the skill can be very helpful and save a lot of time skill debugging. Autoresearch can be extremely effective at optimizing to hit a benchmark, but if the holdout data isn’t sufficiently accurate, or diversified enough to be representative of our generic goal of being able to work with any Greek text, we could be optimizing for the wrong solution. Of course, multiple skills could be optimized. This is where human judgement should intervene and manually inspect both the skill to ensure the wording accurately captures our goals, and, more importantly, the holdout data to make sure we’re optimizing the right target.

The current recommended path is probably something like:

1. Human prompts AI to create generation skill to achieve a goal (i.e. “Generate interlinears for a given Greek text”).
2. Human reads and refines the generated skill.
3. Human creates holdout data or runs the skill once to see what sort of data it generates.
4. Human inspects holdout data and refines it to their exact requirements.
5. Begin AI Generate-Verify-Optimize loop with Autoresearch, which will: a. Generate the data by invoking the skill in a subagent. b. Verify the skill’s efficacy. c. Optimize the skill by tweaking in response to failures.
6. Stop after N predetermined rounds or until the correctness threshold is met (e.g. 95% translation match against holdout data).
7. Human re-reads generated skill to ensure no unexpected overfitting.
8. Re-run Autoresearch if desired threshold isn’t met.

Personally, I don’t see a problem with having the AI generate a skill initially: it’s often trivial for AI to lookup SKILL.md best practices and implement them better and faster than a human can. But since the temptation to “let the AI handle it” is strong due to the experience of waiting around for it to complete its tasks, the human-in-the-loop should take extra caution to ensure it’s behaving as expected, truly matching against the holdout as it claims to be, and passing against large and diverse sets of holdout data that accurately capture the breadth of the desired output.

The Text Orchestrator Skill Pipeline

The text-orchestrator pipeline is a “set of skills” skill. Its goal is to take a simple prompt like “Add Plutarch’s Lives” and end with an output/texts directory containing a set of .json files and a query-able database texts.db which contains all the data listed in our desired list above. This texts.db is the same one that lyceum.quest uses.

As subsequent texts are added via text-orchestrator, the skill is instructed to update, not overwrite, texts.db.

text-orchestrator spawns subagents to orchestrate a 10 stage process from a kickoff prompt:

★ = Full LLM judgement required at this step, expensive

Since the stages are sequential, the subagents are spawned for essential context savings. Scripts are also used to make the process deterministic, allowing the LLM to save precious context on making hard-to-script judgement calls, like whether to create a custom translation for versification or use an existing translation that is sufficiently versify-able. The use of scripts also allows us to add tests.

text-orchestrator is a versatile skill which can be used with the following commands:

• /text-orchestrator run [work] [--mode add|apply] [--profile <profile>] — Run the full pipeline for a text
• /text-orchestrator replay [work] --profile <profile> — Replay specific stages on an existing workspace
• /text-orchestrator resume [work] — Resume an in-progress pipeline from where it stopped
• /text-orchestrator step [work] — Execute only the next pending stage, then stop
• /text-orchestrator status [work] — Show pipeline progress and next stage
• /text-orchestrator abort [work] — Mark the pipeline as blocked and stop

The most important of these is perhaps the replay command, which can replay specific stages of the pipeline at will. A dedicated text-replay skill is also provided which can regenerate data from the already-extracted sources. These skills are important since as we iterate on improving the skills and pipeline, we can run replay to improve on the previous results without having to start from scratch.

I’ve tested the current iteration of the full text-orchestrator pipeline on two small text samples so far:

• The first 5 hexameters of the Iliad
• Aesop’s Fable The Crab and the Fox

The interlinear generation run provides cost tracking when run in API mode (faster and better provenance, but much more expensive than a subscription). In the future this will be added to every stage of the pipeline for complete pipeline cost tracking and provenance. Here are the results of the run for the Iliad:

{
  "run_id": "2026-03-24T15:12:41Z-homer-iliad-proem-1-1-5-1",
  "text": "homer-iliad-proem-1-1-5",
  "book": 1,
  "range": "book 1",
  "started_at": "2026-03-24T15:12:41Z",
  "completed_at": "2026-03-24T15:14:15Z",
  "elapsed_seconds": 94.0,
  "seconds_per_word": 3.13,
  "total_latency_ms": 94006,
  "creator_model": "claude-sonnet-4-20250514",
  "skeptic_model": "claude-sonnet-4-20250514",
  "referee_model": "claude-opus-4-20250514",
  "total_words": 30,
  "total_batches": 5,
  "total_input_tokens": 10187,
  "total_output_tokens": 4721,
  "total_cost_usd": 0.248784,
  "cost_per_word_usd": 0.008293,
  "total_challenges": 7,
  "challenge_rate": 0.2333,
  "failed_call_count": 0,
  "model_breakdown": {
    "claude-sonnet-4-20250514": {
      "calls": 10,
      "input_tokens": 6978,
      "output_tokens": 2906,
      "cost_usd": 0.064524
    },
    "claude-opus-4-20250514": {
      "calls": 5,
      "input_tokens": 3209,
      "output_tokens": 1815,
      "cost_usd": 0.18426
    }
  },
  "benchmark_score": null
}

The interlinear generation is an expensive process as it uses adversarial subagents (Creator, Skeptic, Referee) to debate the best English translation for each word. This is the most LLM-intensive and longest-running part of the pipeline.

Here are what the results look like after importing texts.db into the reader:

Here we have lyceum.quest’s reader enabled with “Transliteration” and “Interlinear” toggled on. This sectioning created by the segmentation skill enables us to learn the Iliad section-by-section by adding each section to a spaced-repetition, Anki-style deck built-in to the reader, enabling progressive, direct learning by using the most scientifically-proven memorization algorithm known.

Future Directions

There are several directions we can go from here:

• One of the most obvious things to do is benchmark various models for accuracy. What we need here are Greek experts to create holdout data for each skill, run Autoresearch against it, and measure results, and tweak. My proposal would be to run autoresearch against individual skills, then run autoresearch against the text-orchestration pipeline as a whole (though defining binary acceptance criteria for text-orchestration is a bit “fuzzier” than the other skills).

• As we refine the processes, we can begin to aggregate or generate new types of data. For example, a recent project used AI to successfully transcribe Latin manuscripts never-before uploaded with a 90% accuracy rate. As this improves we will be able to make previously unavailable data available.

• There’s no reason if we get the proper funding that we couldn’t have agents running overnight. Imagine, for example, a Hermes agent running text-orchestrator for a predetermined set of texts continuously, to be imported into the reader and evaluated at the leisure of experts. Upon reaching an acceptable confidence interval, we can leave it running for a larger subset of texts and human-verify in bulk.

• As Dr. Crane mentions in the article “Towards corpus-based learning: exercises with Ancient Greek”, we can eventually use AI on the other end of the spectrum: to create custom experiences per-student (or expert!). For example, a user may be able to highlight a piece of text and ask questions about the grammar, or meaning, etc. AI could tailor lessons to each student such that they can immediately engage with the text while focusing on their specific weak-points.

• Hand-crafted books can be much more information-dense and educationally useful than exist at present. Currently, the best-in-class is widely regarded as the Loeb Library. But these books only put a Greek translation alongside an English translation. For a beginner, this makes it very difficult to dive into the Greek because it’s very hard to know from reading the English where words, phrases, and sentences correspond in the Greek. Thus these books are limited in their utility to inexperienced readers. We currently have the ability to replicate Loeb naively without any AI assistance and indeed the reader at lyceum.quest does this already for multiple translations, allowing the user to even switch between translations side by side as they see fit, which the Loeb Library can’t do. In web form, this isn’t as much of a problem as a reader can choose their level of granularity. But in book form, choosing which information to include per-word becomes a judgement problem. Still, I personally would love to have Greek-English editions with color-coded word-inflections, grammar hints, and interlinear translations. Perhaps readers can even select which information they want their copy of the book to include when ordering it from the website themselves, like a build your perfect book experience tailored to their preferences as they would in the online reader. In short, we can come a long way in making the Greek originals “come alive” by curating a tradeoff between information density and usefulness in a novel print format.

• Lastly, it should be noted that these skills were generated on a NixOS machine, and thus they’re tied to a lot of nix-specific instructions. We will soon need to generalize these skills to other Linux systems.

Bottlenecks

Some bottlenecks to the project are:

1. Expertly hand-crafted ground truth and holdout data. These holdouts should exist across genres (epic, philosophy, history, etc.) and across dialects (Ionic, Attic, Koine, etc.).
2. API token funding. Generating these tokens, especially in multi-stage adversarial loops as exist in text-orchestrator, is token-intensive. The tradeoff we’re aiming to make here is high upfront cost for long-term payoff. Rather than suboptimal on-the-fly generation, it is better to find methods which generate a great translation once, with some degree of human-review acceptable.
3. Skill development and model optimization. Methods like spawning subagents for each stage, or even adversarial subagents within each stage (i.e. Stage 8), can help improve results. Karpathy’s Autoresearch for automating skill improvement against holdout data will be extremely useful here.
4. The models themselves. I’ve only tested this on Claude models (Sonnet/Opus). Benchmarking will likely reveal models optimally suited to different tasks. It should also be noted that the staggering rate of model improvement may render any processes developed to optimize translations irrelevant, and therefore time invested in optimizing the methods should be weighed against acceptable output quality and the knowledge that any methods we develop are likely to have ephemeral use and diminishing returns.

Conclusion

The rise of LLMs has opened a new door to build better educational tools and more comprehensive databases than have ever existed. The opportunities are particularly salient for niche fields ripe for revival. When building resources for ancient Greek in the age of the internet, we were historically constrained by a shrinking cultural interest in the classics and therefore a smaller pool of experts dedicating resources to creating these tools and databases. Now, however, LLMs have reached a point where custom translations, morphology, and other useful data can be generated with a high degree of accuracy, and it is likely that these tools will continue to improve.

With the careful application of frontier models, quality harnesses, and rigorous human expert review, it is now possible to create a unified, comprehensive database of ancient Greek texts and generate useful data from them optimized for learning and researching.

Hallucination is still a major concern, and more work needs to be done to see if we can reliably produce accurate translations at the word, sentence, and paragraph level.

But the results for the tools as they exist speak for themselves, and skew optimistic.

At this point, I’m bottlenecked by time, money, and Greek expertise. I’ve just been using standard Claude and Codex subscriptions to create and test the orchestrations, but with the right resources and team we can do so much more and at an unprecedented scale.

If you like ancient languages, AI, or are simply excited about preserving and expanding our knowledge of history through digital libraries, please consider Joining the Discord, helping audit translations, donating, or spreading the word!

What I’ve covered here only scratches the surface of what’s now possible to improve our digital access to Greek and other ancient languages.

Links

• Lyceum Github
• Lyceum Orchestrator Skill Pipeline
• Lyceum Orchestrator Outputs
• Discord Community
• Donate

I learned ancient Greek as I would have learned a living language.

Heinrich Schliemann, the man who rediscovered the lost city of Troy, quoted from The Story of Civilization Vol. II: The Life of Greece

Months ago, after having visited Rome and delving deeper and deeper into ancient history, I decided I couldn’t tolerate translations for the Ancient authors. I felt compelled to read them in their own words. And this meant that I had to learn to read Greek and Latin. I started on that journey with Ancient Greek. I am still a beginner, but I felt strongly that a tool which met my learning needs was missing. So I used Claude to build a website to bridge the gap: https://lyceum.quest

I began with a top recommendation online: Athenaze. It has given me a great foundation, particularly for grammar, but I quickly became frustrated by a few things:

1. I was learning Greek through a made-up story about an Athenian farmer. It was engaging, but it wasn’t “real” Ancient Greek and it wasn’t a story they wrote, which quickly became demotivating when things got difficult. This isn’t to fault the book, which is great, but I wanted something that put me in direct contact with the texts to make me feel like I was “unlocking” some ancient secret by learning the language.

2. So much of language learning is memorization, and we have a scientifically proven solution to the long-term memorization problem: spaced-repetition, which I wasn’t using, and which is very difficult to implement without the help of software. The strategy I was using of just haphazardly writing down words over and over was inefficient and exhausting.

3. Flipping through glossaries/dictionaries is difficult, and every language-learning book will force you to do this by the nature of that format. Each lesson introduced new words, but if I forgot a previous word somewhere I’d have to find which chapter it was in or flip to the dictionary. Since I didn’t know most words at the start of each chapter because my memorization technique was bad, I found myself spending a lot of time flipping pages. This was further complicated by the fact that each word is inflected, which meant the glossary definitions just had to pick one specific form of that word in the definition. This is confusing to a new student as the dictionary definition often just looks like a completely different word. Eventually, I ended up just typing the words I forgot into an LLM to have it tell me what it was, which was far faster. Double-checking with the glossary I found that the LLM was almost always correct.

4. The answer key to the book wasn’t built in, which seems common practice for Latin/Greek books, likely because they are geared for universities. But for a self-learner, I had the constant sense that I was veering off course with no way to self-correct except to validate my answers via an LLM and online dictionaries. This was also incredibly frustrating.

There are some books that tried to address concern 1, such as Complete Ancient Greek by Gavin Betts and Alan Henry, but they still have to simplify the original for learning purposes and usually do not seem to address 2-4.

I began to search more seriously for ways to just make direct contact with the authors I wanted to read, with some sort of translation to help me engage with the original. After a bit of searching, it seems that the most serious player in this game is the Loeb Library, which produces beautiful little books which have the Greek (or Latin) original on one page alongside a quality translation on the other. As far as I can tell, this is one of the only publishers which even publishes works with original Greek, translation or no translation. I enjoyed these and tried reading side by side, but this too was difficult and fraught with error. The word orders, and sometimes even sentence orders, of the translations are different. While this was a step in the right direction as an aid to learning and made the process much more rewarding, it still felt incomplete to me.

Eventually I discovered the interlinear and/or Hamiltonian method of teaching these languages and stumbled across his translation of the Iliad, which felt like a breath of fresh air. An interlinear translation is one where the translation of the word is placed directly below its appearance in the original. One problem with this is that word order in Greek can be completely different than in English, making it harder to comprehend. So Hamilton rearranges the words of the original in order to make them have a more natural flow in English.

Stumbling on this, it felt like the obvious solution. Here the text came alive to me in my language. I was engaging directly and immediately with my purpose for learning it. Suddenly learning transformed from something tedious to something fun — learning the language through the ancient texts is giving me the sensation of unlocking an ancient secret. Learning through made up stories designed to teach lessons, by contrast, felt like busywork that was obscuring my true goals. It was based on the idea that the vocabulary, not the grammar, was the primary blocker to learning a language. This method was pretty popular throughout the 19th century and was advocated by John Locke and others (as you can read in the intro to Hamilton’s Iliad above), and is still in use today by seminary students and many of the most popular apps for Latin learning (Legentibus, for example, uses interlinears). This was a solution to problems 1, 3, and 4 above all in one.

So after learning the basics of declensions and verbs from Athenaze, I switched to solving problem 2: memorization. I painstakingly added Hamilton’s cards by hand, word for word, into Anki. It was slow-going, but I found after a couple days I could actually read a sentence or two of the real Iliad!. And with each day, more.

Then, while listening to The Story of Civilization, Vol. II: The Life of Greece by Will Durant, I heard the insane story of Heinrich Schliemann. As an eight-year-old boy, his father read Homer to him, and little Schliemann became so enamored with it that he made a promise to his father that when he grew up he would rediscover the lost city. Around age thirty, a successful merchant, figuring he’d acquired enough wealth to fund his dream, he set out to find Troy. To the disbelief of many a scholar at the time, it appears that he actually did find it!. In a footnote, Durant includes Schliemann’s journal where he describes how he learned the language, which was the final nudge I needed to inspire me to build Lyceum:

“In order to acquire quickly the Greek vocabulary,” Schliemann writes, “I procured a modern Greek translation of Paul at Virginie, and read it through, comparing every word with its equivalent in the French original. When I had finished this task I knew at least one half the Greek words the book contained; and after repeating the operation I knew them all, or nearly so, without having lost a single minute by being obliged to use a dictionary….Of the Greek grammar I learned only the declensions and the verbs, and never lost my precious time in studying its rules; for as I saw that boys, after being troubled and tormented for eight years and more in school with the tedious rules of grammar, can nevertheless none of them write a letter in ancient Greek without making hundreds of atrocious blunders, I thought the method pursued by the schoolmasters must be altogether wrong….I learned ancient Greek as I would have learned a living language.”

Everything about this felt right to me: the learning by doing approach, not wasting time (academic methods seem to assume you want to make the study of the language a science, and expect you to learn it formally better than your native tongue. In short, they do not respect your time), the observation on ineffectual tedium, the focus on learning it as a living language. It doesn’t hurt that this is what Troy’s discoverer advocated and that he also happened to know Russian, French, English, Dutch, Spanish, Portuguese, Italian, Swedish, Polish, Latin, Arabic, and his native German by the end of his life.

I now had enough intuition about what I felt was lacking to build the tool I wanted.

Building the Website

I asked myself if I could build a website with a rich interface for reading and engaging with the original texts that is better than what currently exists. So I started building, with the following goals in mind:

1. The reading experience should start by at least achieving parity with current resources (Scaife, Loeb). This meant in practice that I needed English translations (multiple preferred, if available). This alone would let us achieve parity with the other viewers.

2. There are databases which exist to serve different purposes, but they have not been combined into a single intuitive interface. Combine freely-available, scholarly data in one place so that it can be maximally beneficial.

3. The site should tightly integrate spaced-repetition features into texts of the reader’s choice as a proven effective method for memorization.

4. Use AI to do useful upfront work that it would take humans a long time to do (e.g. interlinear text generation). Like in Bitcoin, my primary field, proof-of-work is far easier to validate than to generate. As long as we’re up front about the limitations, there’s no reason we can’t use AI to generate initial interlinear texts which are then refined. I will go into more detail about my thoughts on using LLMs to generate interlinear translations and how I did it here in a subsequent post, but suffice it to say, they can achieve better results than you may expect.

I was aiming for something like a cross between the Scaife Reader (which is difficult to use and more overtly academic) and Legentibus (which has proven very successful, but is more paywall-ed, more focused, and does Latin instead of Greek).

Using Claude to build the site I was able to achieve all of these goals for at least a couple texts each, validating the concept. The one exception is that I need some mechanism and/or scholarly review to validate and correct mistakes in the interlinear texts. Thankfully, these can easily be compared in-site with the scholarly sourced definitions from LSJ, Perseus, and Logeion short definitions at any time for the time being.

Tour of the Site

The homepage gives you an overview of the primary features.

Clicking “Browse All Texts” will take you to the /texts page, where you can search for texts by author or title, similar to Scaife Viewer:

The corpus spans 373 authors and 1,837 works across all sources. Many of these will only contain the original Greek text with no translation for the time being, although I would love to fix that over time. The five texts at the top (Aesop’s Fables, Gospel of John, Odyssey, Iliad, and Meditations) have been given special attention. These texts have interlinear translations and transliterations, and were what was primarily used for building and testing the site. If we click on one, we can see the reader view:

There’s a lot to unpack here. On the “Display Options” card, we have checkboxes which we can use to add morphology information (sourced from Perseus) to each word to help with our understanding of the grammar. For example, there is a “Color by Part of Speech”, “Color Inflection”, and “Show Inflection” option. For each word, there is a popup you can click on to see that word’s definition from various sources (Logeion, Perseus, and LSJ), and grammar. You can also see multiple translations side by side with the original Greek when they are available. Any of these options can be combined to your reading taste. As far as I’m aware, there is currently no Ancient Greek resource which combines dictionary definitions, grammar/morphology, and side by side translations for free.

For paid users, the page gets more interesting and useful. Two new checkboxes unlock in “Display Options”: “Show Interlinear” and “Show Transliteration” both generated by Claude. Transliterations are useful to show the Greek characters in Latin text, and thus help beginners to memorize the pronunciation of the Greek characters:

Interlinear texts, as discussed earlier, give you direct word-by-word translations in context, so that you are no longer left guessing which of the many Perseus/LSJ definitions apply in the context of the book you are reading.

Because these are LLM-generated and not scholarly-reviewed translations, you should compare them against their Logeion/Perseus/LSJ counterparts to be certain, but I have found they are usually accurate for these curated texts. You can compare them easily via the popup:

I am working on ways to better ensure/enhance the accuracy of these AI-generated interlinears, but in the meantime, this built-in cross-validation with the official scholarly sources should suffice.

These interlinear translations, combined with official translations and scholarly-source cross checking, make for a very powerful interface for reading.

There is one other feature that I’m particularly fond of: Anki-style spaced-repetition. Paid users can select a section from any text and add those words to a deck, where they can later practice memorizing them.

Then, clicking on the “Study” tab will take you to:

Now, you will be presented with cards like this:

Front:

Back:

You can even click “View in context” to have it highlight occurrences of that word in the text you added it from!

Finally, we have a dashboard with a few charts to track your learning progress:

Conclusion

Lyceum is a rich modern reader for reading Ancient Greek texts with a novel combination of features to let you access the Greek authors of Antiquity in their native tongue. It is meant as a helpful, intuitive, and engaging resource to other means of learning Greek. It is under active development and new features and fixes will be added regularly.

Ultimately I’m building this because I want it to exist. I am the first customer. I now use the spaced-repetition and interlinear features every day and am learning the words from the Iliad, Odyssey and Aesop’s Fables using it. Every day I can read a little more, and I am genuinely excited by my progress. I will continue to add features I (and others) think are useful, I’m sure there are plenty of mistakes to correct and improvements to be made that I’m missing.

If you want to have a voice in Lyceum’s development or provide feedback to the project please join the Discord or send an email to support@lyceum.quest with any suggestions you have or mistakes you find.

Future goals include:

• Fix any missing or incorrect dictionary definitions, with a user-driven feedback mechanism.
• Add many more interlinear translations and transliterations especially for popular texts.
• A feedback mechanism for evaluating/correcting LLM-generated interlinear translations/transliterations.
• Full English/other language translations for a wider variety of texts (many currently only have the Greek).
• Voice/Audio enabled reads (like Legentibus) for pronunciation.
• Make texts downloadable in nice readable formats. A fun thing might even be to allow PDF generation in whatever display format options you’ve selected for offline reading.
• Some day, the above could evolve into creating books/printouts with rich morphological information per word for certain texts (for example, a book could include interlinear translations, per-word grammar information). No publisher seems to do this as of now.

Gratitude for Previous Work

Ross Scaife for laying the groundwork which led to the Scaife Viewer, which was a huge inspiration. The Vesuvius Challenge, which stirred my imagination with an excitement about rediscovering the past, the Loeb Library for their excellent books, Anki for being the only widely-adopted spaced-repetition software, Athenaze for being the book I started learning Greek with, and Legentibus for setting the gold standard for modern Latin learning and being a great resource to take inspiration from.

Data Sources:

Texts

• Perseus Digital Library Greek texts and English translations from canonical-greekLit repository. 50+ authors, 631 works, from Homer through the Church Fathers.
• Diorisis Ancient Greek Corpus: 820 pre-lemmatized XML texts with word-level morphology, POS tagging, and sentence boundaries. Used to aid in generating contextual meanings.
• First1K Greek Project: Additional Greek texts from the Open Greek and Latin project at the University of Leipzig.
• Chambry Aesopica: Chambry’s critical edition of Aesop’s Fables with Perry numbering, multiple recensions, and scholarly apparatus.
• Townsend Aesop Translation: George Fyler Townsend’s 1867 English translation of Aesop’s Fables, used for parallel reading.

Morphology & Glosses

• Perseus Ancient Greek Dependency Treebank Syntactic annotations (dependency trees) and glosses for select texts including Aesop, Homer, and Attic prose. Used for word-level alignment with translations.

• Diogenes: Morphological analyses for 400K+ Greek word forms. Each entry maps an inflected form to its lemma, part of speech, and full grammatical analysis (case, number, gender, tense, voice, mood, person).

Definitions

• LSJ: 116,000+ dictionary entries from the definitive Ancient Greek lexicon (9th edition, 1940). Full scholarly definitions with citations, etymology, and usage notes. The “gold standard” comprehensive Greek definitions.

Claude AI

• Content: AI-generated contextual glosses that analyze word meaning within specific passages. Used to disambiguate words with multiple meanings (e.g., “λόγος” as “word” vs “argument” vs “reason” depending on context).

Our doubts are traitors and make us lose the good we oft might win by fearing to attempt

• Shakespeare, Measure for Measure

We need you to dream; then pursue those dreams with vigor. You are a human being. You are a machine with hopes and dreams; a calculator who looks at cold, mute, void, dead nature, and somehow sees God and meaning despite yourself. You are a teetering bulb of dread and dream. You cannot help but see the world in infinite terms. Despite your best efforts, you believe in right and wrong, black and white, good and evil. Nihilism is your greatest lie to yourself, and you feel the nausea it induces when it crawls into your heart and dies, because it is unnatural and anti-life. Are you truly so bored with the ease and comfort that the vast array of the past has struggled, and suffered, and died to provide you with, that you have to cut yourself to remember you can feel?

Shall I be carried to the skies,

On flowery beds of ease,

While others fought to win the prize,

And sailed through bloody seas?

Laura Ingalls Wilder, Little House in the Big Woods, p. 96

Use this life. Determine what is good, or at least, what is not evil, then act as a humble servant of the former, and in direct repudiation of the latter. Your heart will thank you for it, even if the world never does. It is a cooling salve for your depression and melancholy. Though at the cost of greater anxiety. But anxiety is excitement also, and adventurousness, and worth the struggle.

Far better it is to dare mighty things, to win glorious triumphs, even though checkered by failure, than to take rank with those poor spirits who neither enjoy much nor suffer much, because they live in the gray twilight that knows not victory nor defeat.

Theodore Roosevelt, Strenuous Life

You are hopelessly finite; but your actions can and do graze infinity. You can make a dent in the Universe. Some of us little people have. And they who have are frightfully similar to you.

How can any honest person look around at their world and not see that it is a museum of passion projects? A handful of souls through the brief span of history shake off their multitude of excuses, doubts, fears, false friends, oppressive family - shed the dying skin - to chase these impossible dreams, and oftener than we should expect, achieve them. Even in the infested rivers of Calcutta, what is all that trash polluting the river? It is the unmaintained dreams of the past piling on and on into a neglectful present. Plastics and juice boxes and old toys are miracles if you stop them from coalescing into growing piles of grime.

Work passionately to some purpose. Most of those who regret working hard worked hard as slaves to some lower passion like money or cheap status. Those who conduct their work in service of Eternity have a cleaner conscience. Did we hear honest words of regret from Socrates? From Cicero or Cato? From Adams, Hamilton, Jefferson, or Washington? Only in their moments of weakness and fear when their tasks ahead bore relentlessly down on them. But, determining to answer the Call of Duty, they steeled themselves and pressed forward, leaving behind a trail of proud memories which sustained genuine pride in the shade of life.

My depression is the most faithful mistress I have known — no wonder, then, that I return the love.

Soren Kierkegaard, Either/Or: A Fragment of Life

Work toward depression and nothingness, and you will achieve it.

Weekends we spend alone, absorbing Netflix, Youtube, ads. Burning away the candle on video games, where we pretend we are heroes, when real knighthood beckons to the brave. Doomscrolling our ten-second videos of AI-generated sequences of ever-more unintelligible noises and images, then we complain that we can’t afford a house. Watch porn, then complain there are no good women. Work harder and smarter on justifying our inaction, and find enemies to our supposed purposes everywhere. We will never find an enemy sufficient to outsource our self-loathing. In this way we will never be cured of it. We are not taking our problems seriously by failing to recognize ourselves as their root cause. And who can we expect to take us seriously if not ourselves?

You are not jealous of the past. You have more than them if you cared to look. You are jealous of your own better nature which you glimpse buried within yourself manifesting forthrightly in others. Their lived virtue is recognizable to you as your own dormant morality.

You are not jealous of the past, except their Hope for the future. Reclaim the Hope, and you’ll quickly see the thousand conveniences and asymmetric advantages afforded to you not given them.

That hope will be reclaimed with the youthful vigor of active optimism; never by a passive pessimism.

“Friends,” said he, “the taxes are indeed very heavy, and if those laid on by the government were the only ones we had to pay, we might more easily discharge them; but we have many others, and much more grievous to some of us. We are taxed twice as much by our idleness, three times as much by our pride, and four times as much by our folly; and from these taxes the commissioners cannot ease or deliver us by allowing an abatement. However, let us hearken to good advice, and something may be done for us; God helps them that help themselves.

Benjamin Franklin, The Way to Wealth

You have the internet friend! And you’re using it to watch cat videos and porn. What’s wrong with you? How many philosophers through the millenia have dreamed of this moment, where anyone and everyone had access to the voluminous fount of human knowledge! So many of them thought this day would unleash the golden age we’ve finally been waiting for. You can, for next to nothing, read the minds of the greatest thinkers, inventors, and scientists who’ve ever lived. But instead, we discovered that we are easily hackable, we will still use the evil software of companies we know are ill-designing against us, or at best do not care. We sell our souls in as near literal a sense as anyone could have possibly imagined, for a little convenience, a little fun, a little dopamine, and say that it is impractical to live without them, and give up. If we use this great tool for knowledge at all we’re most likely to use it for a petty win in a debate not worth having. For the most part, we’ve shortened our attention spans and become addicted further still to our baser instincts. This is not Utopia. This is a Brave New World, and we, for the most part, feel oppressed by a future we wrongly think we have little power to avoid.

The best way to predict the future is to invent it.

Alan Kay

Knowledge and wisdom are now cheap, and as such, unvalued. Even our educated don’t know much today, because knowledge and understanding are no longer the point. The knowledge of our college graduates is the kind of knowledge any true thinker hates. Commoditized and packaged so they can “get a job” and “have a career”, and rarely develop the mark of a truth-seeker:

So many people today - and even professional scientists - seem to me like somebody who has seen thousands of trees but has never seen a forest. A knowledge of the historic and philosophical background gives that kind of independence from prejudices of his generation from which most scientists are suffering. This independence created by philosophical insight is - in my opinion - the mark of distinction between a mere artisan or specialist and a real seeker after truth.

Albert Einstein, Correspondance to Robert Thorton in 1944

You can adopt the whole human heritage. Do not be bound by superficial alliances. Be bound by vision and destiny. The human race is your anchor. Any giant’s shoulders are shoulders to stand on if they are good and true. I admire Socrates and Pericles, though I am not Greek. Cicero and the Antonines, though I am not Roman. Confucius, Nietzsche, Kant, Petrarch, Da Vinci, what do I care for their allegiances? They painted their minds to us, and now they are mine.

Even within these flawed humans, or any flawed human, we can take the good and discard the bad. No human is really one human. We are instead a hash of blurry archetypes, oscillatingly present or absent from person to person, and within the same person at different times, places, and circumstances.

Every man I meet is in some way my superior, and in that, I can learn of him.

Emerson, Think, Vol. 4-5 (1938), p. 32

Is the state of society not to your liking? Good. Fix it!. What else do you have to do? Complain? Settle? You are not allowed to be angry and do nothing. Society will sink under the festering weight of this accumulated hypocrisy. I do not intend to imply this is easy; swimming against the tide never is. Far from it. Only that it is worth it. It is necessary.

Do you see problems? Well I see an army of problem-solvers; an array of latent potential waiting to unleash its energy, and hold back the tide of societal decay. Your mission in life is waiting for you. What excites you? If you have nothing that excites you, then what bothers you? What do you wish was, that isn’t now? There is your destiny. Only a liar can’t think of a worthy pursuit that will provide him a lifetime of work. Worthy pursuits and things worth doing are ever-present. You are far more limited than they are scarce. If you cultivate reasons enough for Being, imbibe enough meaning and purpose in your daily diet, a panoply of destinies scream and beg for you to take them on.

I’ve heard the cry from other people my age that “everything’s been done”, and all this noise about artificial intelligence isn’t helping young people dream about brighter futures. It seems to be feeding their already weak grasp on the meaning of life. They constantly ask themselves what they will have to do, not realizing the opportunity lying latent in every problem. Every where I look I see little issues, and have reached the point that I lament the fact that I don’t have the time or energy to work on all of them myself, as they would distract too much from an even greater or more exciting mission.

Do you feel that the problems are too big? Start small. Rome wasn’t built in a day. Do you feel unmatched by the impenetrable weight of what you’re fighting? Fight it anyway, and become a salient force to be reckoned with along the way, growing strong from each victory, and stronger still from each defeat. A scattered array of untrained militia defeated the might of the British Empire at its height, with muskets they used to hunt birds and deer. Can you honestly decry that your petty worries are anywhere near that insurmountable? You have been living through the Pax Americana, and you and I spent the whole of it complaining, and if we’re not extremely careful we will be reminded what real pain and suffering is.

I think that there is only one way to science - or to philosophy, for that matter: to meet a problem, to see its beauty and fall in love with it; to get married to it and to live with it happily, till death do ye part - unless you should meet another and even more fascinating problem or unless, indeed, you should obtain a solution. But even if you do obtain a solution, you may then discover, to your delight, the existence of a whole family of enchanting, though perhaps difficult, problem children, for whose welfare you may work, with a purpose, to the end of your days.

Karl Popper, Realism and the Aim of Science

So long as there are problems, this world needs your hidden and unique offerings. So long as there are problems, you can be the solution. Do not deprive us of your secret skills. Meet your destiny head-on. Cast your gaze upward toward the Lights of the Firmament, and dream.

Payjoin is a derivative of Coinjoin, which is an older, more interactive protocol, meaning the user must be heavily engaged with it to use it, which necessarily drives down usability and inhibits adoption. Somehow, despite this, Coinjoin has seen much higher adoption than payjoin so far, despite the more obvious benefits and ease of use with payjoin. A complex, unclear path forward for developers inhibits adoption by wallet software.

Payjoin has been around for a few years, and given:

1. The many benefits listed above
2. The ability for a passive, nonintrusive user interface
3. The simplicity for wallet providers to integrate it

Why is adoption so low?

Especially compared to the far more interactive, difficult to use, and expensive Coinjoin protocol?

In this article, we’ll look at current attacks on Bitcoin privacy, the history of payjoin from the perspective of privacy, how it works and how it can provide so many benefits with no changes to Bitcoin, and the current state of adoption. If payjoin can radically improve privacy, scaling, and fee issues with Bitcoin, the low effort required for wallets to integrate it would be well worth it.

Why Privacy Matters for Bitcoin

Before discussing the importance of payjoin, we must understand the importance of privacy. If you don’t need convincing on this front, feel free to skip down to the history and explanation of payjoin.

In Western democracies, the prime importance of privacy is difficult to communicate, as its benefits still seem invisible to people. It is harder to convincingly explain to someone why privacy matters (especially in the face of higher cost or greater inconvenience) if they’ve never felt the often terrible consequences of bad actors having too much information about them, perhaps because it requires people to think long-term about the consequences of these invasions.

Still, privacy seems to be something more and more people want in theory, but they typically do little to achieve it unless the barriers are extremely low and convenient. Therefore, technologies that wish to protect people’s privacy should be designed to do so with minimal requirements for interaction and inconvenience for the user.

Fungibility

Privacy is not the only problem payjoin can help solve, but it is the problem it was created to solve. The lack of privacy by default on Bitcoin has long been lamented, and one taken very seriously in the Bitcoin community. Bitcoin was designed to be directly peer-to-peer and censorship resistant. But the ability to track owners of future payments once coins have been linked to an identity allows for discrimination. This destroys fungibility – or the degree to which one of a currency’s individual units are indistinguishable from another of the same unit – which is one of the primary properties of a good money.

If buyers can be tracked, not only can coins that are currently owned by illicit actors be rejected, but coins that have ever been used for illicit purposes can be marked as such and be rejected by merchants, nevermind whether the current owners obtained them through perfectly legitimate means. Imagine not being able to buy milk at the grocery store because the dollars you have were once-upon-a-time used to buy drugs, would it be fair to you to be discriminated against by having them say “your money is no good here”? Should you be punished for someone else’s crime? And what would that do to how you treat those dollars? It would make them worthless as your spending power is diminished by owning them, and make some dollars (the “non-tainted” dollars) more valuable than other dollars, which of course shouldn’t make sense. One dollar should always equal one dollar, no matter what individual one dollar bill is used to represent it, or the ability of the dollar to do its job of transferring value is impeded.

The Criminal Myth

It is often said by Bitcoin and privacy detractors that privacy is for criminals. This is the familiar “if you aren’t doing anything wrong, you have nothing to hide” logic, which is easily refuted:

• Few people would be okay with an internet live stream of them taking a shower or using the bathroom being broadcast. Is that because it’s wrong? This is to point out that everyone has something to hide, and hiding things isn’t inherently wrong.
• More broadly, the government is charged with providing the legal basis for what’s wrong, but that definition is always subject to change. If people aren’t free to have privacy, then they really aren’t free at all, as their actions will be severely restricted by perceived social, if not governmental, restrictions. People are judged and attacked for doing perfectly legal things by others all the time. Privacy is the power to choose who you reveal yourself to.

Aside from this naive and self-evidently illogical argument, criminals, unlike most law-abiding citizens, are willing to accept high costs to obtain privacy, so measures to hurt privacy-by-default hurt regular people far more than they hurt criminals. This would be the case even if governments weren’t doing a poor job of actually using their new privacy-restricting measures to actually catch criminals en masse, but instead to “pick and choose” and selectively spy on the citizenry at their will. If a citizen says something those in power don’t like, and what those in power don’t like is always in flux, it can selectively decide to target and hurt them.

Finally, the desire for privacy isn’t merely the fear of government overreach. It is a practical safety or reputational concern. If someone can find out how much money you have and where you live, how hard is it to steal from you? Now consider the number of places you entered your address, payment details, pictures, on the internet. Do you trust every one of those sites to keep your information secure? You shouldn’t, because even the best fail, and criminals are paying large sums of money to hackers who exploit weaknesses for this valuable information.

Privacy and Democracy

A prerequisite to control in any totalitarian state is knowledge of the speech, access to information, and financial activity of its citizens. Without it, it can’t know what to attack, shut down, or manipulate to advance its narrative or further its control. If it doesn’t reliably have access to this information, it becomes difficult to target citizens on a whim. In totalitarian societies of the past, such as the Soviet Union and Nazi Germany, privacy was eroded by ensuring the indoctrination of family members who would report on unfavorable opinions in private conversations, destroying webs of trust in families. When this same erosion of privacy occurs with money, its effects can be even more powerful than with speech. Cutting off the source of funding can be a very effective means of disbanding political dissent.

Bitcoin Privacy is Under Attack

Never waste an opportunity afforded by a good crisis

– Attributed to Nicollo Machiavelli

It is in the name of combating criminals, in this case Hamas terrorists, that new regulation is opportunistically being proposed to make privacy-preserving methods in Bitcoin illegal.

On October 10, 2023, an article was published by the Wall Street Journal reporting that Hamas acquired $130 million dollars of funding by means of cryptocurrency. One week later, senator Elizabeth Warren wrote a letter to President Biden urging him to address questions regarding his administration’s response to the “use of cryptocurrency by terrorist organizations” by October 31, citing the WSJ article as evidence of the urgent need for such regulation. The letter obtained the signatures of 29 of the 100 senators, and 76 members of the House. Curiously, on October 19th, just two days after the letter was sent, the Financial Crimes Enforcement Network published a proposal for regulating cryptocurrency mixing due to the risk of money laundering. It lists, among the methods used to obscure transactions:

Using programmatic or algorithmic code to coordinate, manage, or manipulate the structure of a transaction: This method involves the use of software that coordinates two or more persons’ transactions together in order to obfuscate the individual unique transactions by providing multiple potential outputs from a coordinated input, decreasing the probability of determining both intended persons for each unique transaction.

This definition includes Coinjoin and Payjoin, although using algorithmic code is broad enough to include any transaction, and therefore justify at-will censorship.

But the WSJ article, which provided the sentiment for the letter and attempted to justify the regulation, horribly misinterpreted the data – the actual dollar amount that was connected with Hamas was $450,000. Cryptocurrency is nowhere near a major source of Hamas’ funding. Hamas itself explicitly stated that they did not want funding via Bitcoin due to its traceability.

The irony of the proposed regulation, then, is that its effects will be minimally impactful to the terrorist organization that is the justification for its existence, but maximally impactful to everyone else who wants to use Bitcoin and other cryptocurrencies.

There can be little doubt that the battle for the right to privacy in Bitcoin has arrived in the U.S., and it has predictably masked itself in the guise of national security against foreign adversaries. It’s more important now than ever to understand the need for and use of privacy-preserving techniques on Bitcoin to combat the ongoing attempts to chip away at it.

We must defend our own privacy if we expect to have any.

1. How Transactions Work

To understand the need for payjoin and how it works, it’s crucial to understand how transactions work. Each transaction in Bitcoin is a combination of inputs and outputs. Outputs define which public key or “address” the bitcoin is being sent to. Inputs define which “sources” or previous outputs are used in creating the new outputs for a transaction. It is helpful to think of this as an analogy to how we use different denominations of cash to pay for things. Imagine you need to pay $25 to a restaurant for dinner, plus a $5 tip for the waiter, for a total of $30 (these are your outputs, two different “chunks” of money going to two different people – the restaurant and the waiter).

How would you pay it? Let’s say you have the following bills available (these are your inputs):

• One $20
• Two $10’s
• Six $5’s

To construct this transaction, you could use one $20 bill and two $5 bills, one being for the waiter:

Note one important way in which our cash analogy breaks down: the $20 and the $5 merge into one “bill”. This would be more analagous to melting individual pieces of gold into one bigger piece in order to be able to pay the exact amount required, instead of handing over multiple pieces. Bitcoin allows us to split and merge inputs however we’d like to create the appropriate output.

You might also use two $10 bills and two $5 bills like so:

You could even use your six $5 bills:

Before they’re spent on something, the individual bitcoin “bills” you have are called unspent transaction outputs, or UTXOs. This name is confusing at first, but makes perfect sense if you think about it. They are the “results” (outputs) of transactions that haven’t yet been used up by other transactions. A transaction output that is unspent is a transaction output that you can spend. Therefore, in effect, UTXOs become like the bills of cash in your wallet. After they’re spent, they become inputs to another transaction’s outputs (the cash in someone else’s wallet), and are no longer spendable by you, but the record of the fact that you spent that bill to them remains on the blockchain.

Unlike cash, for a Bitcoin transaction to be valid, we need the approval of the sender. This is done with the sender’s digital signature, which serves as proof of their intent to spend the coin. A valid signature (that is, a signature corresponding to the address of the UTXO) needs to be present on each UTXO that the sender is trying to spend as an input to a new transaction. The presence of a signature “unlocks” the UTXO and signals that it was its owner’s intent to spend it in the proposed transaction.

Here is an example of a real transaction that had 1 confirmation while writing this:

(Link)

As we can see, the above transaction consumes one input and creates two outputs, one being the actual payment, and the other almost certainly being change sent back to the spender. A fee equal to the sum of the inputs minus outputs is also paid to the miner.

This “UTXO model” is very powerful. Since every transaction has inputs and outputs, and since the outputs of one transaction become the inputs of another transaction later, we end up with a long chain of transactions, and are able to track bitcoins’ transfer of ownership from transaction to transaction all the way back to a miner. Since Bitcoin has a limited supply, and derives its crucially non-inflationary properties from this fact, it’s important to be able to audit how much is in circulation or “unspent” at any given time, which the UTXO model allows for.

This is the crux of the privacy problem with Bitcoin. Every transaction has a history. All the bitcoin that came to you and anywhere you send it to can be easily tracked. The system was explicitly designed to support this, albeit not with the intention of tracking individuals. In this system, your only true bet is to never link your identity with your public key, which, in our age of mass surveillance, can be very hard.

The Historical Origins of Payjoin

Satoshi’s Modest Mistake

When Satoshi published the whitepaper in 2008, he recognized the privacy problems that came from the requirement of announcing every transaction to the public, and keeping it private.

He had two recommendations to avoid linking an identity with transactions:

1. Keep public keys anonymous
2. Don’t reuse public keys

This is good advice, but for 1) it is very difficult to keep our identities completely isolated from our payments without extreme caution when making payments online. And for 2) even without public key reuse, if transactions spending from multiple keys are spent together in subsequent payments, it is not too difficult for a tracker to put together which keys belong to which person. These suggestions, even when combined, make for a very difficult to enact and imperfect privacy solution.

After these suggestions, Satoshi then makes a modest mistake, exaggerating the weakness of his own system:

As an additional firewall, a new key pair should be used for each transaction to keep them from being linked to a common owner. Some linking is still unavoidable with multi-input transactions, which necessarily reveal that their inputs were owned by the same owner. The risk is that if the owner of a key is revealed, linking could reveal other transactions that belonged to the same owner.

Satoshi’s assumption, and indeed, all the examples shown so far, presume that all the inputs in a transaction belong to the same owner. In other words, it assumes all the “bills” come from your wallet, which is a fair assumption, but one that isn’t necessarily true. This assumption is called the common input ownership heuristic. It is almost always true for any given transaction, and it is the basis of chain surveillance.

Coinjoin

In early 2013, Gregory Maxwell played a fun game in the bitcointalk.org forum. He provided one of his UTXOs (worth 1 BTC) and an address of his, and asked people to create new transactions using that UTXO as an input. If they proposed a transaction where they sent less than 1 BTC back to him, that meant they were trying to take from him, if more, they were giving to him. If they used the transaction to send exactly 1 BTC back to him, however, they were simply using his address in the transaction to increase privacy by making it look as though it was one of the spender’s UTXOs, even though it wasn’t. When one of Maxwell’s inputs was consumed and sent back to one of his addresses, he posted another one so someone could continue the game. From the perspective of a chain analysis company, this would have the effect of making Maxwell seem rich! Since his address was public, and many UTXOs were being used to construct transactions involving him, anyone analyzing the transactions and making the assumption that all inputs in a transaction were owned by the same person would think Maxwell was transacting with far more bitcoin than he actually was, hence the post’s title: “I taint rich!”.

Of course, this game wasn’t really private, since Maxwell posted his address in a public forum, but it proved a very important and consequential concept. As Maxwell states:

A lot of people mistakenly assume that when a transaction spends from multiple addresses all those addresses are owned by the same party. This is commonly the case, but it doesn’t have to be so: people can cooperate to author a transaction in a secure and trustless manner.

In a later post that same year, Maxwell formalizes this idea into a concept he called Coinjoin:

When considering the history of Bitcoin ownership one could look at transactions which spend from multiple distinct scriptpubkeys as co-joining their ownership and make an assumption: How else could the transaction spend from multiple addresses unless a common party controlled those addresses?

[…]

This assumption is incorrect. Usage in a single transaction does not prove common control (though it’s currently pretty suggestive), and this is what makes CoinJoin possible:

The signatures, one per input, inside a transaction are completely independent of each other. This means that it’s possible for Bitcoin users to agree on a set of inputs to spend, and a set of outputs to pay to, and then to individually and separately sign a transaction and later merge their signatures. The transaction is not valid and won’t be accepted by the network until all signatures are provided, and no one will sign a transaction which is not to their liking.

This means that, in effect, an arbitrary number of people can coordinate to create transactions each contributing and signing their own inputs, without risk of theft by others at any point.

He then highlights another benefit of Coinjoin transactions, which is that transactions can be batched to save on fees by finding someone else who wants also wants to make a payment at the same time as you:

The idea can also be used more casually. When you want to make a payment, find someone else who also wants to make a payment and make a joint payment together. Doing so doesn’t increase privacy much, but it actually makes your transaction smaller and thus easier on the network (and lower in fees); the extra privacy is a perk.

And finally, Coinjoin is a protocol such that, if enough people use it, everyone wins, resulting in privacy gains for everyone:

Such a transaction is externally indistinguishable from a transaction created through conventional use. Because of this, if these transactions become widespread they improve the privacy even of people who do not use them, because no longer will input co-joining be strong evidence of common control.

To provide a concrete example, say we find three people who want to do a coinjoin. Beforehand, they agree to mix 0.1 bitcoin, gaining privacy by having three equal-sized outputs to make it unclear which address owns which coins. The change addresses will be clear to an analyst, but the 0.1 values will not.

The privacy gains aren’t necessarily very strong with only three participants, especially if the other participants de-anonymize in later transactions by tying them to their identity, but this can be mitigated with multiple rounds of coinjoin on those coins or by using larger anonymity sets.

To summarize, Coinjoin is a transaction created with inputs and outputs from multiple parties, such that it is difficult to tell who owns which coins after the transaction.

For a deeper dive into how to actually create a Coinjoin and what tools are available, see this guide.

Coinjoin is one of the most effective and widely adopted privacy solutions for Bitcoin today, but it has some major drawbacks:

1. Interactivity: Coinjoin requires a high degree of interaction from the participants; they need to agree to a uniform output size and must all supply their signatures within a reasonable time. High interactivity requirements create friction for users, and therefore hinder adoption by wider audiences.
2. Centralized coordinators: Wasabi and Whirlpool are currently the most popular methods of Coinjoining. They take fees for conducting the coordination, in addition to the miner fees paid just to participate in the transaction (since Coinjoin transactions have a lot of signature data, they are more expensive). JoinMarket is an example of a non-coordinated service, but this has the tradeoff of increased interactivity.
3. Multiple rounds required for enhanced privacy: To get better privacy, it is often recommended to Coinjoin multiple rounds due to the limitations of small anonymity set sizes, which costs time, increases interactivity, and costs more in fees.
4. Coinjoins look different from normal transactions: Coinjoin transactions have a distinctive, recognizable pattern: multiple inputs from multiple parties resulting in multiple uniformely sized outputs. This means that if your coins have been identified prior to you doing the Coinjoin, the snooper will know you’ve Coinjoined. They may not know where the money went or what you do with it after you Coinjoin, but they know how much you had and that you did a Coinjoin in the first place.

Clearly, this is not an end-all be-all solution for Bitcoin privacy due to these limitations, especially for more passive Bitcoiners who want a privacy-by-default approach.

After a few years, a better solution was on the horizon, one that could be done without any extra steps having to be taken by the transactees, was directly peer-to-peer with no centralized coordinators or marketplaces (therefore saving time and money), and looked no different from normal transactions: Payjoin.

Payjoin has been developed from a series of earlier innovations, let’s take a look at those.

BIP-21

An important user experience (UX) improvement in early Bitcoin was BIP-21. BIP stands for Bitcoin Improvement Proposal, and defines a set of standards that either require consensus changes to the Bitcoin protocol (e.g. hard forks or soft forks) or provide information and methods otherwise useful to interacting with Bitcoin.

BIP-21 is a standard that defines a scheme using URIs to simplify user interaction with Bitcoin, allowing them to pay by clicking links or scanning QR codes. A few query parameters, such as amount, label, and message are also defined so that client software can easily access and parse them for better UX. Here is an example BIP-21 URI with those parameters:

Importantly, the standard is extensible, as custom query parameters can be created and new standards can be built on top of it. For example, in the Lightning Network, the custom parameter lightning can be added in addition to the Bitcoin address so that the user can pay with either method:

This powerful and flexible BIP would prove useful in combination with concepts from Coinjoin.

Pay-to-Endpoint (P2EP)

The earliest mention of the Payjoin concept I could find was by Blockstream, published in August 2018, where the article references a workshop from which the concept emerged. It referred to the resulting idea as Pay-to-Endpoint (P2EP), because it combined the concepts of Coinjoin and BIP-21 to allow a sender and a receiver to collaboratively contribute inputs to a transaction via a BIP-21 compliant endpoint provided by the receiver. Here is an example given in the article of what an endpoint provided by the receiver may look like:

Of note in particular is the p2ep parameter, whose value is an endpoint (in this case a .onion address, but it could just as easily be an http:// address or any other compatible endpoint), which signals to receiving wallets that the sender would like to try a P2EP payment. If that fails, wallets should fall back to the sender paying the address normally, just using the sender’s inputs.

Because the contribution of inputs are collaborative in P2EP, and don’t result in the “coin-tainting” uniform outputs that Coinjoin creates, Payjoin transactions are much more difficult to identify.

The idea was a major step in the right direction, but the idea was still nascent and unformalized, and had some additional complexity to be removed.

Aside - Satoshi’s Pay-to-IP (P2IP)

A variation of this idea, called Pay-to-IP, was actually implemented by Satoshi in the very first version of Bitcoin. There were, however, major privacy concerns with this approach, and so it was abandoned in subsequent versions of Bitcoin.

Bustapay

Later that same month, Ryan Havar emailed a revised version of the idea to the Bitcoin developer mailing list, and formalized it into a BIP which he called Bustapay. This version simplified the initial P2EP protocol and removed some of the complexity in favor of simplicity, the idea being that simplicity would prove essential for adoption.

The Bustapay proposal still had a few major issues that needed refinement, and the protocol was not as refined as it could have been. But it was a further step in the right direction, and its focus on simplicity for the purposes of wallet integration was a key one, especially for the slow-moving and cautious Bitcoin developer ecosystem. Although Bustapay never took off, it was a final precursor to the Payjoin proposal we have today, which is ripe for wallet integration, and positive transformation of on-chain transactions.

The Payjoin Proposal

Finally, by mid-2019, the concepts for Bustapay and P2EP were further refined and added to by Nicolas Dorier, founder of BTCPayServer, and Kukks, with the publication of BIP-78, titled “A Simple Payjoin Proposal”.

With our background of the protocols leading up to payjoin, the meaning and purpose of the opening abstract of the proposal should now be clear:

This document proposes a protocol for two parties to negotiate a coinjoin transaction during a payment between them.

This proposal laid out, in much more rigorous detail than prior methods, how to conduct a coinjoin transaction between a sender and a receiver in a way that breaks the common-input ownership heuristic that is simple, flexible, and cheap.

How Payjoin Works

Let’s say Alice wants to pay Bob 1.1 BTC, and a chain surveillance company sees a transaction like this:

They might assume that Alice paid Bob the 0.5 BTC output and gave the rest to herself as change, like this:

And the vast majority of the time, they’d be right! After all, normally the change is the larger amount, and 0.5 is more “round” and thus likely to be used for payment, than 1.1.

They might also wonder why she used an unnecessary input (the 0.8 and 0.3 BTC inputs would’ve sufficed), but they can never know for sure that this wasn’t a normal transaction, and they can’t know for sure why an extra UTXO was used. She could have just been consolidating a UTXO for easier management later. It could be a payjoin, but even if you assumed it was, which UTXO’s are Alice’s and which are Bob’s? It’s impossible to know. Since most transactions aren’t payjoins, they’ll probably make the faulty assumption that it wasn’t.

Alice, however, is smart and wants to preserve her privacy, and she knows about payjoin, so she asks Bob to contribute one of his own inputs to the transaction. Bob agrees, so he creates a transaction that spends one (or more) of his UTXOs as an input, and proposes it to Alice. If the transaction looks good to Alice, she broadcasts the payjoin transaction to the network. In this case, the transaction actually looks like this:

If chain surveillance made the assumption that both inputs were owned by Alice (as they did in the first example, and currently do in practice), their assumptions about what both Alice and Bob own would be wrong!

It’s also interesting to note that Alice and Bob conducting this transaction helps everybody gain privacy. Because, unlike coinjoin, it looks like a normal transaction, if enough people use payjoin chain surveillance will be unable to trust whether any transaction is normal. By foiling chain surveillance’s attempts at spying on their transaction, Alice and Bob make every transaction a little bit suspect. If there are enough people doing it, it makes them all suspect. Online privacy is often a numbers game, and the more people participate, the better the privacy.

In this example, Alice and Bob collaborated to create a transaction that used both of their inputs to preserve privacy. Now, of course, this whole process can be automated (and is in practice).

In BIP-78, the process is more formally defined as follows:

1. A receiver shows the sender a BIP-21 URI with a query parameter pj= that refers to an endpoint/server people can send partially signed bitcoin transactions (PSBTs) to. The endpoint can be HTTPs, .onion, or any other authenticated encryption protocol. For example:

2. The sender creates a finalized, broadcastable PSBT using only their own inputs that is fully capable of making the required payment, to the receiver’s endpoint. This is called the “Original PSBT”.

3. The receiver modifies the PSBT to include his own inputs, signs his inputs, and gives this back to the sender. He does not modify any of the inputs or outputs of the sender. This is called the “Payjoin Proposal”.

4. The sender verifies the proposal, re-signs her inputs to finalize the transaction, and broadcasts it to the network.

If something goes wrong at any point in the process, such as, for example, the receiver doesn’t have any UTXOs with which to create the Payjoin Proposal, then the receiver simply broadcasts the Original PSBT and it goes though as a normal transaction. Although this uses all inputs from the same owner, again, if enough people are using payjoin, it becomes impossible to make the assumption that the two parties didn’t payjoin, and surveillance will simply have to assume they did and try to find other methods of tracking payments.

Payjoin’s Many Benefits

More Broken Surveillance Heuristics

The common-input ownership heuristic is not the only privacy-destroying assumption that payjoin breaks. BIP-78 identifies two other heuristics that can be used to identify owners:

• Change identification from the scriptPubkey:

  In Bitcoin, scriptPubKey is the “locking script” that specifies the conditions under which Bitcoin can be spent. It’s called scriptPubKey because the locking condition requires a valid signature matching the public key (the address) to unlock it. In other words, only the person who controls the private key to a particular UTXO’s associated public key can unlock it.

  There are multiple types of scriptPubKey’s in use, (P2PKH, P2WPKH, P2SH, P2TR). Typically, wallets use the same scriptPubkey for all transactions, and therefore, the change amount (the amount the sender sends back to themselves after consuming UTXOs as inputs) will likely have the same scriptPubkey, while outputs sent to the receiver are much more likely to have a different scriptPubkey. This means that UTXOs with the same scriptPubkey in a transaction can be identified as likely belonging to the spender, assuming the outputs sent to the receiver are different.

  BIP-78 specifies a method to allow the receiver to only use scriptPubkey‘s matching the spender’s, breaking the above heuristic’s ability to tell which outputs are the change outputs.

• Change identification and payment from round payment amounts:

  Normally, payments made to peers have round amounts since it’s far more natural to transact with round numbers. If Bob is charging Alice (and they aren’t basing the bitcoin price on a direct conversion to a “rounder” fiat price), he’s more likely to charge her an amount like 0.00010000 as opposed to a non-rounded amount like 0.00010231, for simplicity. For transactions in which only one output is round, it’s very likely the case (for now) that the non-round output is the change output.

  Payjoin also allows for this metric to be broken by describing a way for the receiver to add extra round outputs when constructing the proposal.

Asymmetric Gains by Uniting with a Bigger Crowd

As mentioned earlier, one of the main drawbacks with coinjoin from a privacy perspective is that: 1) coinjoins are easily distinguishable from other transactions and 2) few people do them relative to non-coinjoin transactions. This creates problems for the fungibility of Bitcoin, because it’s possible for people to mark coins as tainted, since some may have the ludicrous perception that the desire for privacy implies malicious intent. Of course, as most transactions, or even a threshold of transactions, preserve privacy, then they cease to stand out.

Payjoin appears like any other transaction, and therefore doesn’t draw attention. An external observer has no reason to even look at a payjoin more closely, because the payjoin shows no effort to obfuscate the payment and change amounts.

By appearing like any other transaction, even marginal gains in payjoin adoption mean that everyone’s privacy is harder to invade, because surveillance heuristics quickly become unreliable. Adam Gibson, a foundational contributor to JoinMarket and an expert in Bitcoin privacy, sums it up well:

If you’re even reasonably careful, these PayJoin transactions will be basically indistinguishable from ordinary payments. […] Now, here’s the cool thing: suppose a small-ish uptake of this was publically observed. Let’s say 5% of payments used this method. The point is that nobody will know which 5% of payments are PayJoin. That is a great achievement […], because it means that all payments, including ones that don’t use PayJoin, gain a privacy advantage!

UTXO Consolidation

Clearly, payjoin and it’s predecessors were aimed at solving privacy problems. But there is a nice ancillary benefit to using payjoin, specified right in BIP-78 itself: UTXO consolidation.

Satoshi’s suggestion to use a new address for every received payment results in user’s wallets having many UTXOs to manage. When these UTXOs are all used together as inputs to new transactions (and assuming it’s not a coinjoin or payjoin), these transactions cost more in fees. Fees are calculated based on the size of the transaction in bytes, since block space is the scarce resource, so more inputs equals more fees for a single large transaction.

It should be noted that using payjoin for UTXO consolidation does not necessarily save on fees, because the expense of each UTXO for chain space still needs to be paid at some point. Rather, it spreads the fees out over time and gives an opportunity to batch the UTXO with the payment. Batching makes UTXO consolidation cheaper than doing it as its own transaction. It also makes for easier management of UTXOs, and less data stored on disk. In addition, it is possible for wallets to implement a way for a receiver to specify that they would like to consolidate their UTXOs when mining fees are low in advance, making UTXO consolidation an automatic and smoother process.

Lightning and Payjoin: A Perfect Match

Opening Lightning Channels with Payjoin

The Lightning Network (LN) is a second-layer solution built on Bitcoin that takes transactions off-chain to allow for near-instant, final settlements with far lower fees, tremendously increasing transaction throughput, improving privacy, and allowing for new use cases for Bitcoin such as micropayments. It uses a network of payment channels between nodes to route payments from source to destination. These channels require node operators to lock up “liquidity” (bitcoin that can flow between one node and its channel partner) between their channel partners. How much bitcoin you can spend in a channel is limited by how much liquidity exists on your side of that channel.

Most of the complexity in managing a lightning node comes from opening these channels and managing the liquidity in them. Onboarding is one of the biggest pain points, since there are several steps involved. Let’s say Alice wants to open up a channel with Bob and she has setup a brand-new, unfunded lightning node. Alice has to do the following:

1. Send an onchain transaction funding her newly created lightning wallet with sufficient funds to at least open the channel and wait (at least 10 minutes) for it to be confirmed.

2. Use her lightning wallet software to negotiate a channel opening transaction with Bob and wait for it to be confirmed.

At a minimum, Alice has to pay two fees and wait ~10 minutes per transaction, which can be tedious.

Payjoin can simplify this process and help Alice save money by doing both the funding and the opening transaction at once.

In this scenario, Alice preconfigures her payjoin receiving endpoint with the details of how she’ll open channels: including the amount of bitcoin and which channel partners she’ll open to. Then, using a wallet with payjoin support, someone (presumably Alice) will send a payjoin proposal, negotiate the payjoin transaction with the receiving endpoint, and upon receiving the funds, the endpoint will make the necessary API calls to open a channel with Bob’s node.

In other words, the sender (probably Alice in this case) will send a payjoin proposal to Alice’s receiving payjoin endpoint to create a transaction that pays directly to the 2-of-2 multisignature output between Bob’s node and Alice’s node to construct a lightning channel between them. Which turns the process into a one-step transaction:

One interesting thing to note is that both LN and payjoin currently have a liveness requirement (though, in the case of payjoin at least, perhaps not for long), meaning that participants must be online when transactions take place. This is fairly limiting in comparison to on-chain Bitcoin, which only requires the sender to be online at the time of payment. However, this also allows for the two protocols to pair together quite nicely.

For example, Lightning is great for increasing privacy by taking payments off-chain, and for massively increasing Bitcoin’s ability to be used as a medium-of-exchange (i.e. something you would actually use to buy everyday things) in addition to a store of value. But the requirement to open channels on-chain means that the size of your channels and the people you open channels to leaves an onchain footprint. For reasons already discussed, payjoin can obfuscate and destroy many assumptions made by snoops.

It also makes things simpler because users now only have to make one payment instead of two to open their first channel, faster because they only have to wait for one transaction to be confirmed, and cheaper because they only have to pay one fee. In fact, more than one channel can be opened by these means. What if you could make a list of all the nodes you wanted to open channels to, make a single transaction to a BIP-21 payjoin receiving endpoint, and have them all open at once, automatically, waiting for one transaction to confirm and paying one fee. For all your channels. Well, you can!

There is already a project which implemented this idea, called Nolooking, which allows you to queue up a list of public keys and batch open multiple lightning channels at once! This way, Alice can not only open a channel up to Bob, but she can open up channels to Bob, Carol, and Dina, all the while making just one on-chain payment! Needless to say, the potential for this to simplify Lightning UX is huge. It’s exciting to imagine a future in which Lightning wallets just have payjoin on by default, and the de facto user experience is to just pick your channel partners, make a single Bitcoin transaction, and voila! You now have a lightning node with as many channels as you can afford, and paid one transaction for it. How amazing would that be?

It’s easy to imagine how this could simplify self-custodial lightning adoption. It would be interesting if lightning wallet software could just have a “quick setup” option, where all the user has to do is input how much Bitcoin they can lock up (i.e. how much liquidity they want), set to a default of opening a few, reasonably sized channels with decent tradeoffs for routing and fees. For advanced users, there could be an “I know what I’m doing” option.

Weaknesses

As with any protocol, there are tradeoffs to payjoin.

One of the main issues is the liveness (or online-ness) requirement. The receiver’s payjoin web server must be online at the time the transaction is sent in the current implementation, due to the need for both sender and receiver to negotiate (programmatically, of course) the resulting transaction. This might limit adoption to merchant servers or lightning nodes, as they are the only people with an incentive to always stay online. It would be much more convenient from a user’s perspective if a transaction could be sent at any time irrespective of whether the receiving server is online.

Another less likely but more dangerous weakness is that if a payjoin server (i.e. the receiver’s server) is on an unsecured server, the receiver’s outputs could be modified in flight(before they reach the sender) and stolen.

However, as we’ll discuss later, a solution to the above two problems has already been proposed.

Finally, one weakness of the protocol is simply the fact that it faces adoption barriers as wallets must do the work to integrate it. A particular challenge is that the ideal user interface would be one in which payjoin is just enabled by default. Sending wallets and receiving wallets just try to payjoin without a user necessarily needing to be burdened with setting up that privacy feature. The best privacy is default privacy, since requiring users to take action to defend it means they probably won’t. Therefore, for payjoin adoption to really take off for the average user, it needs to be a seamless experience that they don’t have to think about. Wallets should enable it by default. Remember, it’s built right into the protocol to fallback on regular transactions without requiring any additional action from the user in case the payjoin fails.

Serverless Payjoin

Dan Gould has submitted a draft BIP for a version 2 of payjoin which allows it to be done asynchronously and without using a server. This serverless payjoin would solve both the requirement for a receiver to be online at the time of payment, and the security issues related to this being done on unsecured servers, mentioned earlier. As the always-online nature of payjoin receivers is perhaps the biggest user experience barrier to adoption, the implementation of this BIP could be a huge benefit for payjoin adoption and passive Bitcoin privacy.

The Current State of Payjoin Adoption

As of late 2023, payjoin adoption is still relatively low, but has been steadily increasing since its inception in 2018.¹ Since payjoin is ready to use today and doesn’t require any Bitcoin consensus changes, the only real impediment is for wallets to write the software to adopt it, and the tools to help them do so are getting better every day. Payjoin Dev Kit (PDK) is a new payjoin implementation with modules that wallet software can use to integrate today. It even comes with a payjoin-cli tool that allows you to create payjoins from the command line. The library is written in Rust, but bindings allowing other languages to use it are currently being built.

Wallet Support

BTCPayServer and JoinMarket already support both sending and receiving, although not by default. BlueWallet, Sparrow, Wasabi, and BitMask support sending. A few other wallets support it via an extension, including Bitcoin Core. There are active PRs to integrate payjoin into Mutiny Wallet today. See here for the current state of payjoin adoption.

Payjoin and Bitcoin’s Future

As mentioned earlier, Adam Gibson has proposed that even just 5% of on-chain transactions being conducted with payjoin could have a huge impact on Bitcoin privacy. We just need a threshold number large enough that analysis companies can never safely assume they’re interpreting the transactions correctly. Once their methods of spying on us are broken, then ill-informed, arbitrary, and bad-faith restrictions on Bitcoin privacy imposed by those who neither understand its benefits nor have any interest in preserving our right to privacy will become irrelevant.

And as we’ve seen, due to the many possibilities opened up by payjoin’s flexibility, it is not merely a privacy solution, but an extensible cooperative transaction protocol that allows for solutions such as fee reduction and single transaction multi-channel opening for lightning nodes, among others. The benefits it would provide to Bitcoin could be enormous and achieved today without changing anything about Bitcoin itself.

So what are we waiting for?

Support

If you’d like to support or contribute to payjoin’s development, start by joining the discord, donating, or checking out payjoin.org.

Acknowledgements

I want to give a huge thank you to Dan Gould for reviewing and suggesting very helpful improvements to this article.

Check out the Voltage presentation on this topic here.

If you’re interested in learning more about the history of micropayments, check out Amber Case’s article and the Open Index Protocol’s episode

Before Bitcoin

Before the World Wide Web, the internet, or even the personal computer revolution, the concept of making tiny payments in exchange for digital content had already been conceptualized. The term “micropayment” can be traced back to Ted Nelson as early as 1960, when he began brainstorming his ideas for what a globally accessible, computer-based repository of human knowledge could look like, and coined many other terms and ideas that are used on the web today, like “hypertext” and “hypermedia”. While often failing to implement his own vision for the web (and being vocally regretful of how the web took shape), others took many of his ideas and built them into what we know it as today.

In 1992, Tim Berners-Lee, creator of HTTP and HTML, released his second version of HTTP and the first reference to the status codes now in common use. Among them was a code that Berners-Lee and others thought would one day be used to pay for digital content: 402 payment required. Sadly, this status code is officially “reserved for future use”, as the various attempts to make micropayments on the web, from its inception, failed to come to fruition. Over 30 years after the invention of the internet, we’re still waiting for one of its major original visions to be fulfilled.

Berners-Lee founded the World Wide Web Consortium (W3C) in 1994 to guide the development of the web, and micropayments were a major consideration from the start. In 1995, Phillip Hallam-Baker, who wrote a number of RFCs on internet security, drafted the Micro Payment Transfer Protocol (MPTP), which never seems to have been implemented. It offers a number of insights on the nature of micropayments that are as relevant today as they were at the founding of the internet:

There is a large interest in payment systems which support charging relatively small amounts for a unit of information. Here the speed and cost of processing payments are critical factors in assessing a schemes usability. Fast user response is essential if the user is to be encouraged to make a large number of purchases.

A critical limitation of MPTP, however, was that a third party, referred to as a broker, was explicitly required by the protocol.

At the time, there was no way to make a digital payment without a trusted mediator, so any attempt at a protocol for micropayments had to be developed with some sort of custodianship of the money in mind.

The W3C continued to push for micropayments for a while, in 1998 publishing an overview of micropayments and suggesting MPTP as a practical approach and noting:

Micropayments have to be suitable for the sale of non-tangible goods over the Internet […] With the rising importance of intangible (e.g. information) goods in global economies and their instantaneous delivery at negligible cost, “conventional” payment methods tend to be more expensive than the actual product.

This echoes Hallam-Baker’s second major concern of transaction costs imposed by technological or overhead costs of available payment mechanisms. His first concern, the need for a “fast user response”, is often overlooked in discussions about the viability of micropayments. But one astute observer, who would later go on to have a strong influence on the development of Bitcoin, was already thinking in depth about this problem. Nick Szabo, creator of the concept of smart contracts and Bitgold, wrote “Micropayments and Mental Transaction Costs” in 1999. Szabo states that the primary reason for the failure of micropayments to take hold was not due to technological or overhead costs. It was due to the mental transaction cost experienced by the user of having to decide whether a purchase was worth the price for every interaction on the internet.

[…] customer mental transaction costs are significant and ubiquitous, so much so that in real world circumstance cognitive costs usually well outweigh technological costs, and indeed technological resources are best applied towards the objective of reducing cognitive costs. […] Micropayment technology efforts which stress technological savings over cognitive savings will become irrelevant.

A web based on micropayments implies frequent purchases, which implies decision fatigue. It is likely the case that for most micropayments, the mental transaction cost incurred by having to make constant choices about purchases likely outweighs the value of what they’re paying for.

Large companies like Compaq and IBM, and startups like Pay2See, Millicent, iPin, and others, tried their hand at reducing these technological and mental transaction costs for micropayments in the early days, and it was still an assumption that the concept would be a lasting feature from the start.

Perhaps the most notable of these companies, which would go on to have a lasting impact on the Bitcoin community, was DigiCash, spearheaded by David Chaum. Chaum had already formalized many ideas for a blockchain-like data structure and secure digital cash in 1982 before going on to found DigiCash in 1989. DigiCash implemented Chaum’s proposals, allowing users to withdraw money (called “eCash”) from a bank and make untraceable digital micropayments with it. Unfortunately, only one bank ever implemented eCash, and in 1998 the company went bankrupt.

Other micropayment efforts were also dissolving around the same time, and the W3C itself closed their contributions to micropayment activity in 1998.

The dot-com crash was in full swing, and micropayments were one of the ideas that crashed the hardest. It was a good time to be a critic. In 2000, writer Clay Shirky wrote “The Case Against Micropayments” in which he boldly declared:

Micropayment systems have not failed because of poor implementation; they have failed because they are a bad idea. Furthermore, since their weakness is systemic, they will continue to fail in the future.

His primary argument for their fundamental flaw was not technological or infrastructural — but instead echoed Nick Szabo one year prior: decision fatigue. He goes on:

In particular, users want predictable and simple pricing. Micropayments, meanwhile, waste the users’ mental effort in order to conserve cheap resources, by creating many tiny, unpredictable transactions. Micropayments thus create in the mind of the user both anxiety and confusion, characteristics that users have not heretofore been known to actively seek out.

Shirky went on to predict three methods of payment that would become dominant on the web which did not suffer from the decision fatigue problem: aggregation (bundling low-value things into a single higher-value transaction), subscription, and subsidy (getting someone other than the user to pay for the content — today this has manifested itself as the ad model).

By the end of the dot-com crash, Shirky’s predictions were looking more salient. Credit cards, with their infrastructure costs prohibiting payments of less than $1, had become the de-facto method of payment, and passion for the micropayments project was losing steam. What was a self-evident and exciting prospect for the web’s future faded against the backdrop of its increasingly centralized, surveilled, and ad-driven successor — Web 2.0.

Bitcoin and the Centralized Web

We have to trust them with our privacy, trust them not to let identity thieves drain our accounts. Their massive overhead costs make micropayments impossible.

— Satoshi Nakamoto

The idea driving 402 was that it’s obvious that support for payments should be a first-class concept on the web and it’s obvious that there should be a lot of direct commerce taking place on the web […] In fact, what emerged is a single dominant business model which is advertising. That leads to a lot of centralisation, because you get the highest cost per clicks and with the largest platforms.

— John Collison, President of Stripe

Satoshi Nakamoto released the Bitcoin whitepaper near the end of 2008, aptly timed in the midst of the U.S. Housing Crisis. He released the original code for it shortly after. Bitcoin was a massive breakthrough, both in the history of computer science and the history of money, and spurred a new wave of interest in the possibilities of the internet. For the first time, there was a permissionless way to transfer value with an internet native currency, without all the inelegant, bloated infrastructure needed to use credit cards.

For awhile, the price of bitcoin was so small that some people did advocate its use for micropayment systems, despite Satoshi admitting that it wasn’t (yet) a great solution to that problem:

Bitcoin isn’t currently practical for very small micropayments. Not for things like pay per search or per page view without an aggregating mechanism, not things needing to pay less than 0.01.

But the limits imposed by fees didn’t stop people from dreaming about new possibilities enabled by it. Marc Andreessen, creator of the first popular web browser, gave the examples of content monetization and fighting spam:

One reason media businesses such as newspapers struggle to charge for content is because they need to charge either all (pay the entire subscription fee for all the content) or nothing (which then results in all those terrible banner ads everywhere on the web). All of a sudden, with Bitcoin, there is an economically viable way to charge arbitrarily small amounts of money per article, or per section, or per hour, or per video play, or per archive access, or per news alert.

This statement is not true today of course (at least, as far as Layer 1 is concerned), but the fees in 2014 were low enough that it was actually possible to build around the concept of micropayments. One interesting project built around this time was Bitmonet, which allowed users to choose their subscription level by paying 10 cents for just one article, 15 cents for an hour of unlimited access to the website, or 20 cents for a day pass. Unfortunately transaction fees are no longer low enough to be able to allow for arbitrarily small micropayments, and although the issue was clearly on Satoshi’s mind from the earliest days of Bitcoin, it wasn’t designed to specifically address the micropayment problem.

Subscriptions and Ads

Shirky’s predictions for content monetization were pretty accurate, particularly when it came to subscription and ad models.

In the ad model, content was subsidized by an advertiser, typically through a third-party. From 2014 to 2022, Google and Facebook essentially held a duopoly over the online ad market as the third-party mediator between advertisers and content creators. The two companies (and in reality, most of big tech) collected enormous amounts of personal information and simply asked their users to entrust them with the safety of their data, despite numerous breaches. This information is used to show targeted ads for products people are more likely to buy. Companies often refer to this model as “free — with ads”. But in reality, users do pay a price. The ad model forces users to trade two things in exchange for the content:

1. Their data, forcing them to give it to third parties, which, as Nick Szabo famously stated, are security holes.
2. Their attention. There is a reason for the phrase “pay attention”, and it’s well illustrated here. More time users spend on a site with ads, the more money advertisers, ad platforms, and the content creator makes. Thus a creator is economically incentivized to show as many ads as they possibly can without annoying the user so much that they leave the platform. The currency of the “free with ads” web is your attention. You are the product.

What’s clear in the ad model is that the consumer becomes a second-class citizen. Since a layer of abstraction exists between a creator’s revenue and the end user, making a great user experience is not the highest priority. And as more and more consumers use ad-blockers, content creators are forced to get more aggressive with ads, making using the web a more degraded experience for everyone.

Subscriptions also rose in popularity. Customers showed they were much more willing to pay for bulk access to licensed content like movies and music on a regular basis instead of paying to own individual songs. Although a more honest business model, they can also be very problematic when they are the sole option for payment. And in recent years, as these services become increasingly competitive, more and more people find themselves suffering from subscription fatigue. The inability to access just one (or a few) specific news articles, movies, or songs at any given time forces a suboptimal choice of trying to pay in bulk and optimize the most content for a given subscription.

Take streaming services, for example. Today there are so many streaming services, all battling for content licensing, that users end up paying multiple subscriptions to try to capture a greater subset of the movies and TV shows they want. But all they really want is to watch an incredibly small subset of what’s offered by any given service. When they pick a service for a movie or show they want, it often doesn’t stay long, and will be bounced around unpredictably from company to company as licensing expires and gets updated.

News articles are another example. Companies like The New York Times or The Economist entice readers by allowing them to read just a few seconds of an article before blocking the content with a subscription paywall. Even more so with newspapers than with movies, customers are far more likely to want to pay a small amount for a single article of their choice than for a package deal to articles they don’t want.

While subscriptions offer a more straightforward approach than ads, using them in practice often makes for what is an increasingly costly and stressful management game.

When Clay Shirky was writing about the issues of mental transaction costs, he was writing before the mental costs of subscriptions and ads began to weigh down on people as they do today. Bitcoin gave a solution to the problem of an internet-native currency, but slow processing and high fees quickly became a prohibitive problem for a system supporting micropayments. One more major innovation was needed before true implementations of micropayments technology could take off.

The Lightning Network

A decentralized system is proposed whereby transactions are sent over a network of micropayment channels (a.k.a. payment channels or transaction channels) whose transfer of value occurs off-blockchain. — Joseph Poon and Thaddeus Dryja, The Bitcoin Lightning Network

In February 2015, “The Bitcoin Lightning Network” was published, representing perhaps the biggest advancement in Bitcoin since its inception. Through the clever use of Bitcoin properties, a series of payment “channels” could be constructed such that transactions did not have to be announced to the blockchain but could still retain the lack of trust in a third party, using the Bitcoin blockchain itself for dispute resolution. Payments can either be made directly between two channel partners, or they can be routed across a series of partners, so long as there exists a path of connected partners between sender and recipient. Because of this, it was no longer necessary to pay fees to miners for every transaction, and payments could be settled near-instantly. Since the primary reason micropayments weren’t viable on Bitcoin in the first place was due to high fees and slow transaction processing, the Lightning Network (abbreviated LN or called “lightning” for short) opened up a whole new world of possibilities that are just beginning to be explored.

Methods

The smallest unit of bitcoin is a satoshi (often abbreviated to sat). One bitcoin is equal to 100,000,000 sat. At current conversion rates, 1 satoshi is equal to $0.00023, meaning that the smallest payments that can be made (assuming no routing fees) are currently at a granularity of about two ten-thousandths of a penny, a finer granularity than was ever seriously considered by the web’s early founders. Technically, even finer granularity payments of a thousandth of a satoshi (called millisatoshi, abbreviated msat) can be made within the confines of the Lightning Network, but any sub-satoshi amounts will be rounded down if the money is ever moved back to the blockchain. Therefore, all of the methods of payment discussed below can be used to make micropayments, but different mechanisms allow for a variety of novel payment schemes to be set up. I won’t go into the technical details of how the Lightning Network works here. My intention is to provide a high level overview of some ways micropayments can be made with it, and hopefully to spark people’s imaginations to the possibilities.

Invoice

The most basic way to make a payment on the Lightning Network is through the Bolt-11 invoice. This is an encoded string of information containing everything necessary for the payment to be made. The invoice is generated by the recipient and then sent to the payee. Typically, from a user’s perspective, the payment string is encoded as a QR code which the payee can scan.

Benefits:

• Least abstractions from a technological level
• Available by default in LN implementations
• Payments occur directly node to node

Drawbacks:

• A recipient having to first send an invoice can make for awkward UX
• Both nodes must be online for a payment to be made
• Invoices are non-reusable and must be freshly generated every time

Most of the ways to pay on LN today either simply use Bolt-11 invoices or some abstraction of them under the hood.

Keysend

An alternative to invoices are keysend payments, which allow for payments directly between two nodes without an invoice. Senders only need a node’s public key. One crucial downside to keysend is the lack of a proof of payment, making it unsuitable for merchants or other systems that rely on proof of purchase. For content monetization, however, keysend pairs nicely with the concept of value4value: a model which gives content away freely and asks the user to give back the value they felt they received in turn (and requires no proof of payment).

Benefits:

• No invoices required, payment can be sent instantly
• Available by default in LND, Eclair, and Core-Lightning (but must be manually turned on)
• Direct node to node payments

Drawbacks:

• No proof of payment limits scope of use

Possible micropayment use cases:

• Streaming sats (Boosting) while listening/watching/reading content
• Micro tipping
• Boostagrams

Examples:

• Podcast Index/Podcasting 2.0

LNURL

LNURL is a set of standards designed to expand the capabilities of LN by providing a specification for “out-of-band” or third party communication between nodes. LNURL standardizes a whole set of LN-based interactions for developers. For example, the LNURL-Pay spec defines how services can create static QR codes that can be paid multiple times. Under the hood, the service is generating a new invoice every time a payment attempt is made.

Benefits:

• Static pay/withdrawal links
• LN based authentication schemes
• Many more

Drawbacks:

• LNURL operates “out-of-band” meaning that there is a service between LN nodes creating invoices on a node’s behalf. This can mean that the service must be trusted to stay online in addition to the nodes involved in the payment.

Possible micropayment use cases:

• Private, printable, reusable QR code for donations on content
• Reusability allows for payments to be made even when embedded in images and videos
• Withdrawals for content creators who’ve accumulated sats on a given platform
• Donations to protestors: Anyone can hold up a sign a protest movement captured on video, and sympathizers can easily donate. To quote Marc Andreessen from “Why Bitcoin Matters” in 2014:

  Think about the implications for protest movements. Today protesters want to get on TV so people learn about their cause. Tomorrow they’ll want to get on TV because that’s how they’ll raise money, by literally holding up signs that let people anywhere in the world who sympathize with them send them money on the spot. Bitcoin is a financial technology dream come true for even the most hardened anticapitalist political organizer.

Examples:

• Cointrain
• Lightning addresses
• List of Awesome LNURL things

LSAT

Many speculate that [the 402 status code] was intended to be used by some sort of digital cash or micropayment scheme, which didn’t yet exist at the time of the initial HTTP specification drafting.

However, several decades later, we do have a widely used digital cash system: Bitcoin! On top of that, a new network oriented around micropayments has also arisen: the Lightning Network.

Olaoluwa Osuntokun, LSAT: Authentication and Payments for the Lightning-Native Web

Lightning Service Authentication Tokens (LSATs) are a protocol created for authentication and paid APIs that leverage the forgotten HTTP error code 402 discussed earlier in conjunction with the lightning network. LSATs can be thought of like reusable tickets that need to be paid for to gain access to a particular resource. But the powerful thing here is that rules can be applied to modify access to resources on a given site, and the tickets can be reused on subsequent visits to the site.

Benefits:

• Extremely flexible
• Reusable
• Allows for highly granular and fine-grained access to digital resources
• Finally makes use of 402 error code!

Drawbacks:

• Difficult version control
• No current methods for efficient management (Could be solved by browser extension such as Alby)
• Underutilized/underdeveloped despite being around for awhile

Possible micropayment use cases:

• Pay for single video/podcast/song/article and remember it on subsequent visits
• Metered subscriptions of your choice
• Custom expiration dates on content

Examples:

• Aperture
• Boltwall
• lsat-js
• Alby Mixtape
• Nakaphoto

WebLN

WebLN is a standard for abstracting away LN interactions by relying on a client (such as a browser extension) to communicate with a WebLN enabled site. The client must have the ability to interact with the user’s lightning node. For example, a site might use WebLN to request a payment from the user when a button is clicked. When clicked, the user’s client extension will popup, providing whatever payment details the WebLN enabled site sent to the client in a simple to use interface. WebLN greatly simplifies the payment flow for browser based interactions, where user’s no longer have to pull out their phones to make QR code based payments.

Benefits:

• Better UX
• Simple implementation
• No third party required
• Compatible with LNURL

Drawbacks:

• Browser client required
• Few clients in use
• If user doesn’t have a client installed, fallback options (such as LNURL or invoices) must be provided

Possible micropayment use cases:

• Anything an invoice, LNURL, or Keysend can do!

Projects Using Micropayments

Finally, here is a short list of projects using micropayments that I found interesting:

• micropay.ai: Micropayments to generate images using DALLE-2
• WebLN Experiments: A collection of various WebLN demos
• LN VPN: Pay as you go VPN service, pay as little as $0.1 for 1 hour
• LNCal: Allow people to pay you in bitcoin to schedule meetings
• BTCMap: Map of locations accepting bitcoin. Uses Boosting for favored payments
• Lightning Video: Like Youtube, but uses bitcoin micropayments instead of ads
• Sats4Likes: Get micropaid for micro tasks
• PeerTube Lightning Plugin: Pay PeerTube creators with LN
• Stacker News: Reddit-style discussions with micropayment tipping
• Bookmark.org: Pay to archive links
• THNDR Games: Earn bitcoin while playing games

See bolt.fun, the Lightning App Directory, or Lightning Landscape for a larger list of projects being built on Lightning.

Conclusion

Micropayments have arrived on the web, and this article just scratches the surface of what’s possible. While there are significant technological and mental barriers remaining, I hope the above examples show how far we’ve already come – and how much further we can go – for a cleaner, freer, and more expressive internet.