Honest limits — payroll edition
- No auto-pay — ever. The schedule is a planner, not automation. Every payday is a separate manual signed dispatch you approve on the Review step. Pearl has no smart contracts; nothing can move PRL on a timer.
- One sender key per run. Every input of a pay run must be spendable by the single key you sign with. Multi-key payrolls are not supported — split them.
- Dust is refused, never rounded. Any payee under 333 grains stops the roster with a loud error. Change under 333 grains is absorbed into the miner fee and disclosed on the review screen — never silently dropped.
- Labels are off-chain bookkeeping. Payee names ride along in the unsigned bundle and the local history for your records — they never appear on-chain. Pearl transactions carry no memo field.
- Builder tip is optional. The Fund step offers an opt-in 1% builder tip, off by default. It is never charged unless you tick the box, it appears as its own labeled payee line in the running totals and on the pay slip before signing, and testnet runs never carry it.
- Blockbook is read-only until the single broadcast POST. UTXO scans and fee estimates are GET-only against the endpoint you configure. If it is unreachable, the page says so loudly — it never guesses.
- Secrets live in page memory only. Keys you paste are wiped automatically after signing, and are never written to storage or sent anywhere. History is this browser's localStorage — exportable to CSV, and yours to clear.
- Verify addresses out of band. Start on testnet.
Roster the payroll ledger — who gets paid, and how much
Paste one payee per line — <address>, <amount>, [label] — or import a CSV. Every address is bech32m-validated, every amount is dust-checked (333-grain floor, refused — never rounded), duplicates merge into one payee when merging is on. Labels are your bookkeeping only. Nothing moves on this step.
Payroll ledger VALIDATED
- Payees
- Total per period
- Duplicates merged
| # | Payee | Address | Per period |
|---|
Add / edit a payee
Schedule the pay calendar — planner, not automation
Pick a pay period and an anchor payday; the desk lays out the next 12 pay dates with the exact per-run total. Nothing here moves money. Each payday is still a manual signed dispatch — the schedule exists so you can plan funding, not to trigger payments.
Pay calendar PLANNED
- Period
- Per-run total
- Next payday
| Run | Pay date (UTC) | Day | Per-run total |
|---|
No auto-pay: each of these dates needs a fresh signed dispatch from steps 3–6. The calendar plans; you press the button.
Fund the strongbox — load this run's inputs
Point at the sender's prl1…/tprl1… address, pull its UTXOs over Blockbook (GET-only) or paste them air-gapped, then pick inputs by hand or let the auto-loader take the largest first. The desk checks coverage for this run's total + fee, and warns if the balance covers fewer than two upcoming runs.
Strongbox ledger
| # | TXID | vout | Value | Conf |
|---|
Running totals
Run review check the pay slip before it seals
The full breakdown before anything is signed. Fee comes from the exact vB formula — fee = keypathTxVBytes(nIn, nOut) × rate, grain-exact. If the numbers don't balance to the grain, the run is refused.
Pay slip UNSEALED
Payees
| # | Payee | Address | Amount |
|---|
Inputs
| # | TXID | vout | Value |
|---|
Fee math
Sign the paymaster's seal
Export the unsigned bundle to sign on an air-gapped machine, or sign here. The key must derive the sender address or signing is refused — and every Schnorr signature is re-verified locally before the hex is shown. The key is wiped from memory the moment signing succeeds.
Unsigned bundle
- Fingerprint
- Unsigned txid
Import a bundle
Paste a bundle exported elsewhere — it is fully re-verified (fingerprint, unsigned-txid digest, fee, vBytes) before anything loads.
Local signing
Sealed SIGNED · N/N VERIFIED
- Signatures
- TXID
Broadcast payday — release the run
Two explicit confirmations stand between the signed hex and the network. After broadcast, the page records the run to the local history ledger below.
Ready for payday
- TXID
- Run
- Payees
- Total out
- Fee
…or via your own pearld
Run this against your node's RPC (port 44107) — nothing here touches your node.
History the payroll archive — this browser's ledger
Every successfully broadcast pay run is recorded here — date, txid, per-payee amounts, fee. This lives in this browser's localStorage only: export it to CSV for your books, clear it any time. If you switch browsers, carry the CSV.
Past runs
| Pay date | Run | TXID | Payees | Fee |
|---|
Per-payee totals
| Payee | Address | Total paid | Runs |
|---|