Secret Sats
Pay in bitcoin. Tell no one.
Private payments in ordinary Bitcoin transactions. The amount, the sender and where the coins came from stay hidden, and every payment carries a proof any node can check.
Try it
Wallet
The same wallet as on tacit.finance: a passkey or linked wallet opens it on both.
or use a passphrase
Have a Tacit key?
already have a wallet?
Connect a wallet above to send sats, or tokens you hold.
Payments to your private addresses can’t be looked up by address. Paste the payment link or txid the sender gives you.
Connect a wallet above to find payments sent to your private addresses.
Connect a wallet above to start. Mix turns your sats into a coin with no history.
- 1Make an entryOne coin of the round’s size, paid to your own silent address, so every coin in the round looks the same.
- 2Let it settle6 blocks, about an hour. Rounds count only coins this settled, so yours can’t be singled out as new.
- 3Join a roundYou and at least 2 other wallets each put in one coin and get back one equal coin. The shuffle hides which is whose from the board and from each other.
- 4Find your mixed coinAfter a block, your wallet finds its output with its own scan key. Nothing about it is stored anywhere else.
- 5Get private cBTC with itSpend the mixed coin alone on a test cBTC lot, straight into the pool. The lot’s price is public; where the sats came from is not.
Connect a wallet above to start. Each step is one signet transaction.
Optional first: put your sats through a join, so the cBTC you buy has no history.
- 1Get signet satsFree test sats for fees and the cBTC price.
- 2Get private cBTCSwap sats for test cBTC straight into the pool, in one transaction.
- 3Pay privatelyPay a pool address. Amount and source stay hidden.
- 4ReceiveFind pool payments sent to you.
- 5ExitLeave the pool as ordinary cBTC in your wallet.
- 6Back to satsSwap private cBTC for sats in one transaction. Change stays in the pool.
Connect a wallet above to use private ETH: the same address as your sats, on Ethereum, Base and Robinhood Chain.
How it works
The pool holds cBTC, a bitcoin-backed token. Sats can mix first, with no coordinator, then swap into cBTC. cBTC is shielded into the pool, paid privately inside it, and leaves the same way.
Live on signet
- Alice buys 10,000 test cBTC straight into the poolblock 323700
- Alice pays Bob, posted by a relayerblock 323702
- Bob scans and finds 6,000on his device
- Bob swaps 4,000 back to sats, keeps the rest privateblock 323708
- Eight wallets mix sats in one joinblock 323693
The pool right now
What’s hidden, what you trust
Hidden
- Amounts inside the pool
- Who paid whom
- Which note was spent
- The payer’s wallet, when a relayer posts the payment
Visible
- That a pool transaction happened, and when
- What entered and what exited
- Amounts, when already public (a bought lot)
You trust
- Bitcoin
- The proof system
- The indexer you use, or your own
- cBTC’s backing, if you hold cBTC
Size on signet
- buy and shield997 vB
- private payment806 vB
- exit to sats1,077 vB
- + commit, when self-posted (relayers batch it)153 vB
Questions
What is this?
A working demo of private payments on Bitcoin. Send sats, pay a silent address, mix sats with other wallets into equal coins with no history, or move cBTC through a shielded pool that hides amounts and owners.
Is it a sidechain?
No. Every step is an ordinary Bitcoin transaction. Indexers replay Bitcoin and check each proof; there is no other chain, federation or operator.
Where are my sats? What is cBTC?
Sats and silent payments stay sats in your wallet. On signet, the pool holds cBTC, a Tacit token backed by locked BTC and a slashable escrow; sats turn into cBTC and back to sats by atomic swap, no custodian either way. On mainnet the pool carries TAC.
Who can see what?
Anyone sees that a pool transaction happened. Only payer and payee know the amount and who paid whom. Silent and shielded addresses give each payment a fresh output only the recipient can find.
Do I need to trust anyone?
Bitcoin, the proof system, and the indexer you use — run your own and it is just Bitcoin and the proofs. No one holds the pool: a note moves only with its owner’s proof.
Does proving cost anything?
No. Your device proves each shield, payment and exit in seconds, after a one-time download of the prover. You pay only the Bitcoin fee.
Mainnet or signet?
Both. Sends, silent payments and the shielded pool all run on mainnet, where the pool is flagged experimental and carries TAC only. Shielding, paying privately and exiting all work today, each paying its own Bitcoin fee; gasless relaying for payments and exits is rolling out next. Signet keeps the full demo — a test cBTC the faucet hands out for signet sats — for trying every step before you move real TAC.