NIGHT · 01 Setup — your silent keys
Two secrets: a scan secret (may live on an always-online watcher) and a spend secret (stays cold).
Together they publish one static sp1… address. Every payment to it lands on a fresh, unlinkable taproot output only you can find.
crypto.getRandomValues — nothing leaves this page.
Your silent-payment address
Share the sp1… address freely — it reveals nothing about your outputs.
NIGHT · 02 Send — derive unlinkable outputs
Describe the inputs you will spend from and the silent-payment address(es) you are paying. The desk runs the BIP-352 sender math and hands you the exact taproot outputs to include in your transaction. This desk only derives from taproot key-path inputs — anything else is refused loudly.
Inputs
| # | txid (64 hex) | vout | scriptPubKey (hex) | scriptSig (hex) | witness (hex) | input secret (64 hex) |
|---|
For taproot inputs the secret is the private key of the taproot output key (parity is handled for you). scriptSig / witness may be empty for key-path spends. Secrets are wiped from these fields after deriving.
Recipients one sp1…/tsp1… address per line
Derived outputs
| k | taproot output key (x-only) | Pearl address (prl1…) |
|---|
NIGHT · 03 Scan — find your payments
Paste a transaction's inputs and its taproot outputs. With your scan secret the desk replays the receiver scan: it finds every output meant for you — including labeled ones — and derives the private key that spends each.
Transaction inputs JSON array: [{txid, vout, prevoutSpk, scriptSig, txinwitness}]
Taproot outputs to check one x-only key (64 hex) per line
Found payments
| k | label | output key | Pearl address | spend secret (keep cold) |
|---|
Each spend secret is (bspend + tk + label) normalized to even Y — the key-path key for that output.
NIGHT · 04 Labels — quiet sub-addresses
A label m tweaks your spend key into a sub-address
Bm = Bspend + HashBIP0352/Label(bscan ‖ m)·G.
Label 0 is reserved for change. Hand each contact their own labeled address; your scanner tells them apart.
Labeled address
NIGHT · 05 Verify — trust, but check
Two independent checks. Decode any silent-payment address to inspect its guts, or run the pinned official BIP-352 vectors through this very page — if the math drifts by a single bit, the proof fails.
Decode a silent-payment address
Official BIP-352 vectors, in this page
Runs pinned send + receive vectors (including label and change cases) through the bundled crypto and compares byte-for-byte.