Blind Payments: How We Can’t Tell Who Paid

TL;DR: When you add credit to Obscurify, your payment turns into vouchers that your browser hides before we sign them. Later, when the vouchers go on your balance, we can check they’re genuine, but we can’t tell which payment they came from. This works for Monero, Bitcoin, Lightning and card payments. Your account is only a random 16-digit number, so there’s no email or name to connect either.

The problem with paying for privacy

Most “private” services still keep a simple record: this payment funded this account. Even when you pay with Monero, the service knows that the coins arriving at a particular address were meant for your account, because it gave that address to your account. Pay by card and the link is stronger still: the card network knows who you are, and the service knows which account the card topped up.

That record is what makes subpoenas, data breaches and curious employees dangerous. If the service is ever forced to hand over its data, or simply gets hacked, the payment record can tie your chats to your identity.

We didn’t want to promise we’d protect that record. We wanted to not have it.

The idea: a signature on something we never saw

In 1982, the cryptographer David Chaum described a way for a bank to sign a note without seeing what was on it. The classic illustration uses an envelope lined with carbon paper:

1. You write a random serial number on a slip of paper and seal it inside a carbon-lined envelope.
2. You hand the sealed envelope to the bank with your payment. The bank signs the outside of the envelope. The carbon copies the signature onto the slip inside.
3. You go home and open the envelope. You now hold a slip with a genuine bank signature, and the bank never saw the serial number.
4. Later you hand the slip to the bank to spend it. The bank can see its own signature is real, so it accepts the slip. But it has signed thousands of envelopes and has no way to know which one this slip was inside.

Modern blind signatures do the same thing with math instead of carbon paper. Obscurify uses RSA blind signatures, standardized in 2023 as RFC 9474.

How it works on Obscurify

1. You pay, without your account

On your account page you choose an amount and a payment method: Monero, Bitcoin, Lightning or card. For crypto you can leave the amount empty and send whatever you like, as many times as you like, within an hour.

This step deliberately doesn’t use your account. Your browser makes the payment request without your login cookie, so the order we record has no account attached. All we know is that someone paid some amount to this order.

2. Your browser makes hidden vouchers

Once the payment confirms, your browser turns the amount into vouchers: one for $10, one for $2, one for 20¢, and so on, in standard values from 1¢ to $5,000. Each voucher is a random number that only your browser knows.

Before sending them to us, your browser blinds each voucher by multiplying it by another secret random number. What reaches us looks like noise.

3. We sign what we can’t read

We check that the total value of the blinded vouchers is no more than you paid, sign them, and send the signatures back. We keep a copy of what we signed so a dropped connection can’t make you lose your money. Everything we keep is the blinded version, though, which looks nothing like the real voucher.

4. Your browser unblinds them

Your browser removes the blinding factor. What’s left is a normal, valid signature on the real voucher, which we have never seen. This is the carbon-paper step: the signature carried through, the contents stayed hidden.

5. The vouchers go on your balance later

Your browser keeps the vouchers and adds them to your balance one at a time, each at its own random moment over the next 5 to 60 minutes. When a voucher arrives, we:

• check its signature with our public key, which proves we signed it and that it’s worth what it says (each value has its own key, so a $1 voucher can’t pass as $100);
• record a fingerprint of it, so it can only be spent once;
• add its value to your balance.

We can’t connect it back to the payment, because the voucher we’re now looking at was never in front of us at signing time.

What we keep, and what we can’t know

We keep	We can’t know
A payment of $X arrived for order Y (no account on it)	Which account order Y paid for
The blinded vouchers we signed for order Y	What those vouchers look like unblinded
A fingerprint of every spent voucher (no account, no time)	Which order a spent voucher came from
Account Z’s balance went up by $V	Which payment that $V came from

None of the voucher tables in our database has a user column. That isn’t a promise not to look. The link was never recorded, so there’s nothing to look at.

Your account itself is a random 16-digit number. We store only a scrambled (keyed hash) copy of it, so even our own database can’t show anyone’s account number.

What blind payments don’t hide

We’d rather you know the limits than overestimate the protection:

• The payment itself. If you pay by card, your bank and Stripe see a payment to Obscurify. If you pay with Bitcoin, the blockchain is public. Blind vouchers break the link between the payment and your account, not between you and the payment. For the strongest privacy, pay with Monero.
• Your IP address. We don’t store IP addresses with orders, but your network can still see you connecting. Use Tor (we run an onion service) or a VPN for both paying and chatting.
• Timing and amount, if you make them easy. Imagine you pay an unusual amount like $13.37 and add it all to your balance one minute later. A $13.37 deposit arriving moments after a $13.37 payment is easy to match. That’s why vouchers go on your balance separately at random times by default. “Add Now” skips that. Round amounts like $20 and patience both help you blend in with everyone else.
• Very small crowds. The protection works best when many people are buying and spending vouchers. Every user who pays this way makes everyone else harder to pick out.

Common questions

What if I lose my vouchers before they’re added? They live in your browser until they go on your balance, usually within the hour. Don’t clear your browser data during that time. You can also copy the codes from the account page and paste them in on another device.

Can someone else use my vouchers? Yes. An unredeemed voucher works like cash: whoever has the code can spend it once. That also means you can give credit to a friend by sending them voucher codes.

What if I send the wrong amount of crypto? Whatever arrives is credited, whether that’s less, more, late or in several payments, at the exchange rate when each payment confirms.

Do I need to trust you on all this? Less than with most services. The blinding happens in your browser, in blind-voucher.js, which you can read. The scheme is the public RFC 9474 standard, and anyone can check our signatures with the public keys at /vouchers/keys. The one thing you do have to trust is that every visitor is served the same keys. A server that gave each person their own key could tell them apart. You can check this yourself by comparing the keys you’re served with someone else’s.

I signed up with a username and password. What changes? Sign in once with your password to get your account number, save it, and sign in with the number from then on. That deletes your password. Your balance and history stay the same. Old API tokens keep working for now, but switch to the key on your account page.

For developers

The whole flow is available through the API:

1. POST /vouchers/orders with a payment method and, for card or Lightning, an amount. This needs no API key or session.
2. GET /vouchers/orders/{id} until available_cents is above zero.
3. Blind vouchers against the keys from GET /vouchers/keys (RSABSSA-SHA384-PSS-Deterministic), then POST /vouchers/orders/{id}/sign. Retrying the same batch returns the same signatures without counting twice.
4. Unblind, then POST /vouchers/redeem with your API key, whenever you like.

Blind signatures were invented to make digital cash that works like paper cash, and for forty years almost nobody used them. We think paying for AI is a good place to start.