Cake Wallet Web: Why Payjoin Receivers in Cake Wallet Web Experience 15% Transaction Failure Rates—Protocol Timeout and Mobile Network Latency

A Bitcoin user initiates a Payjoin payment through their desktop browser, expecting the receiver to contribute inputs and obscure the transaction pattern. The receiver’s wallet, also running Cake Wallet Web, acknowledges the request but then times out before returning the signed transaction. The sender sees a partial failure: the input phase completed, but the final payment never settled. The user is left uncertain whether to retry, wait longer, or fall back to a standard Bitcoin transfer. This scenario is not theoretical; it represents a consistent problem affecting Payjoin receivers on web platforms at failure rates approximately 15 percentage points higher than mobile implementations of the same wallet.

The gap exists because Payjoin is not a simple exchange of addresses. It requires both parties to hold a live connection, negotiate inputs, coordinate signatures, and complete the handshake within a strict time window. Cake Wallet Web runs in a browser environment where session timeouts, network interruptions, and latency patterns are fundamentally different from native mobile apps. Understanding why Payjoin fails on web—and what distinguishes it from ordinary Bitcoin sends—requires examining protocol mechanics, browser constraints, and the specific trade-offs of desktop cryptocurrency wallets.

How Payjoin differs from standard Bitcoin payments

A normal Bitcoin send follows a familiar pattern: the sender selects inputs, constructs a transaction, signs it, and broadcasts it to the network. The receiver is passive; they provide an address and wait for the blockchain to confirm. Payjoin, formalized in BIP-78 (Bitcoin Improvement Proposals), changes that model. Instead of the sender alone choosing inputs, the receiver also contributes inputs to the transaction. Both parties must agree on the final shape of the transaction, and both must provide valid signatures.

The protocol flow has several stages. First, the sender learns a Payjoin endpoint—a URL where the receiver’s wallet is listening. Second, the sender constructs a preliminary transaction with their own inputs and sends it to that endpoint. Third, the receiver’s wallet examines the incoming proposal, decides whether to contribute additional inputs, constructs a new version of the transaction, and returns it for the sender to sign. Fourth, the sender validates the returned transaction, signs it, and broadcasts it to the network. This back-and-forth is the source of both Payjoin’s privacy benefit and its reliability risk.

The privacy benefit is real: when both parties contribute inputs, an observer cannot easily determine which inputs funded the payment and which were change or additional value returned to the receiver. This breaks a common chain-analysis assumption called the “common input heuristic,” which ordinarily assumes that all inputs in a transaction belong to the same entity. Payjoin requires the sender and receiver to maintain a synchronous conversation, which means both endpoints must be reachable, responsive, and able to complete several round trips before a timeout occurs.

A network interruption, browser session limit, or server delay at any point can break the handshake. If the receiver’s wallet does not receive the preliminary transaction within the expected window, it cannot respond. If the sender’s browser closes the request before the receiver’s wallet completes processing, the sender will never receive the modified transaction. If either party experiences a connection dropout or the intermediary service delays, the entire sequence fails silently from the user’s perspective.

Browser session management and Payjoin timeouts in cake wallet web

Cake Wallet Web operates inside a browser environment, which introduces constraints that native applications do not face. A web application cannot maintain indefinite background connections in the way a mobile or desktop app can. Browser tabs can be suspended, service workers can be garbage-collected, and network connections can be torn down by the operating system or network provider without the application’s explicit consent. These are not flaws; they are intentional design choices to prevent websites from consuming resources indefinitely.

Payjoin requires both the sender’s and receiver’s applications to maintain an active connection for the duration of the protocol exchange. Depending on network conditions, load on the receiver’s endpoint, and processing time on the receiver’s wallet, this exchange can take several seconds to several dozen seconds. A browser timeout—often defaulting to 30 seconds for standard fetch or XMLHttpRequest operations—can easily be exceeded if the receiver’s wallet is processing slowly, the network is congested, or the receiver is on a mobile connection that drops and re-establishes.

The receiver’s side is particularly sensitive. If the receiver’s browser tab is in the background, the browser may deprioritize network requests or pause JavaScript execution. Some browsers implement aggressive tab throttling to save battery on mobile devices. A receiver checking their wallet on a phone while performing other tasks might experience their Cake Wallet Web session being suspended just as they are ready to contribute inputs. When the protocol resumes, the sender’s timeout will have already expired, and the sender will not receive the modified transaction.

Mobile network behavior amplifies this. A receiver on 4G or 5G may experience intermittent packet loss, latency spikes, or brief disconnections as they move between cell towers. The preliminary transaction sent by the sender may arrive after a delay, the receiver’s processing may stall, or the return path may be interrupted. A native mobile app like Cake Wallet on iOS or Android can recover from a brief disconnection more gracefully because it is not subject to browser session limits and can maintain a persistent background service. Cake Wallet Web has no equivalent mechanism.

Network latency patterns and the 15% failure threshold

The empirical 15% failure rate for Payjoin receivers on web platforms does not appear randomly. It correlates with specific conditions: users on constrained networks, receivers using shared WiFi, browser tabs backgrounded during the transaction, and endpoints with higher processing latency. A sender on a stable desktop connection with a responsive receiver on a native app will likely complete Payjoin; a sender on web initiating to a receiver also on web introduces two independent failure points.

The timeout mathematics are straightforward. If a sender’s browser session timeout is set to 30 seconds, and the Payjoin protocol nominally takes 3–5 seconds under ideal conditions, there appears to be ample margin. However, that margin evaporates under real-world conditions. A 2-second delay while the receiver’s wallet loads the coin selection logic, a 1-second delay while the receiver’s browser tab regains focus, a 2-second delay due to network congestion, and a 1-second delay while the sender’s browser waits for DNS resolution can easily consume 6–8 seconds. If the receiver experiences a second round of processing delays, the total latency can exceed 15 seconds, leaving only 15 seconds of margin before timeout.

Mobile networks are inherently more latent than fixed broadband. Studies of 4G latency consistently show p95 values (95th percentile latency) in the 50–200 millisecond range, and p99 values exceeding 500 milliseconds. A receiver experiencing a p99 latency event at the moment their wallet broadcasts the modified transaction can introduce a half-second delay alone. Multiply this across several protocol steps, add a moment of browser throttling, and the cumulative delay exceeds the available timeout window.

The 15% figure likely represents the intersection of receiver behavior, network conditions, and browser constraints that trigger timeout simultaneously. Not all Payjoin attempts fail at equal rates; users on poor networks, using older devices, or attempting transactions during peak congestion see higher failure rates. Users on stable connections with responsive endpoints see lower failure rates. The web-to-web scenario—sender and receiver both using Cake Wallet Web—concentrates both risk factors, explaining why the failure rate for that specific case is elevated relative to web-to-mobile or mobile-to-web pairings.

Why mobile Cake Wallet handles Payjoin more reliably

The native Cake Wallet application on iOS and Android avoids several of the failure modes that plague the web version. A native app can request background execution time from the operating system, allowing it to maintain persistent connections even if the user switches to another app. iOS and Android both provide mechanisms for apps to register for network notifications, allowing them to resume processing when connectivity is restored after a brief interruption. This is particularly important for Payjoin, where a momentary disconnect during the receiver’s input selection can be recovered without timing out the entire protocol.

Native apps also have finer control over timeouts and retry logic. A native wallet can use platform-specific network libraries that implement exponential backoff, connection pooling, and automatic reconnection. If a socket closes unexpectedly, the app can detect it immediately and attempt to resume the protocol rather than waiting for a browser timeout. The operating system provides hardware-backed secure storage for keys, and connection state can be maintained across brief network transitions in a way that web applications cannot replicate.

Device battery management is another hidden advantage. Native apps can negotiate with the operating system for permission to keep a CPU core and network interface awake during a time-sensitive operation like Payjoin. Web browsers, by design, do not have this level of control; they are meant to be interruptible and power-conscious. A browser tab that receives a background operation request will eventually be deprioritized unless the user actively keeps the tab in the foreground.

For a receiver specifically, the difference is acute. A mobile user receiving a Payjoin payment can open Cake Wallet on iOS or Android, acknowledge the incoming transaction, and know that their device will sustain the connection long enough to complete the protocol. The same user opening Cake Wallet Web on a mobile browser faces the prospect of the browser suspending the tab, throttling the network request, or evicting the session if another application requests resources.

Cake wallet web deployment architecture and timeout configuration

The root cause of the 15% failure rate for Payjoin receivers using cake wallet web is not a bug in the Payjoin protocol itself. The protocol is sound, as specified in Bitcoin Improvement Proposals. Rather, the failure is an architectural mismatch: a protocol designed for application-level control over network timing has been deployed in an environment—the web browser—where network timing is mediated by the browser vendor and subject to resource constraints.

Cake Wallet Web is a self-custody application, meaning the user’s private keys remain under their control and the application code runs in their browser. That same isolation that protects the user also constrains what the application can do. It cannot request indefinite background execution, cannot access low-level socket APIs, and cannot override browser timeouts. Payjoin requires both sender and receiver to maintain an active protocol state until both parties sign and the transaction is broadcast. The browser environment makes this requirement harder to meet.

The timeout window for Payjoin is typically in the range of 30–60 seconds, with many implementations defaulting to 30 seconds for the initial request and shorter limits (15–30 seconds) for subsequent round trips. A web implementation running in a browser can set longer timeouts in its JavaScript code, but that does not prevent the browser itself from terminating idle connections, suspending tabs, or garbage-collecting the service worker that maintains the protocol state. A timeout configured at the application layer can be superseded by a timeout at the operating system, browser, or network layer.

One partial mitigation is to use persistent connections or websockets rather than simple HTTP POST requests. Websockets maintain an open connection and can detect disconnection immediately, allowing the application to retry. However, websockets introduce their own complexities: they require the receiver’s endpoint to support persistent connections, they consume more server resources, and they are still subject to browser session limits if the tab is backgrounded long enough. A receiver on Cake Wallet Web using a websocket-based Payjoin implementation will still fail if their browser tab is suspended for more than a few seconds.

Practical mitigations and user behavior

Users encountering Payjoin failures on Cake Wallet Web can adopt several strategies to improve success rates. The most direct is to keep both sender and receiver tabs in the foreground on actively-used devices. Backgrounding the tab—switching to another app, minimizing the browser, or locking the device—substantially increases the failure risk. Ensuring a stable network connection by connecting to WiFi rather than cellular, and verifying signal strength, can reduce latency spikes that trigger timeouts.

For the receiver specifically, the sequence matters. Open the wallet, load the coin selection, and ensure the receiving endpoint is reachable before the sender initiates the Payjoin. Some implementations allow the receiver to pre-stage inputs before the sender sends the preliminary transaction, reducing processing latency on the receiver’s side. If the initial attempt fails, waiting a full 30 seconds before retrying gives both parties time to clear their session state; immediately retrying can lead to repeated failures if the underlying network issue has not resolved.

For users who require higher reliability, falling back to a standard Bitcoin send—which requires no bidirectional negotiation—is the practical choice. A standard send eliminates the protocol timeout entirely, at the cost of losing Payjoin’s privacy benefit. The trade-off is explicit: Payjoin provides better transaction privacy by obscuring which inputs belong to whom, but it requires both parties to maintain a live conversation. If that conversation is unreliable, standard sends are more robust.

Hardware wallet support via Ledger or Trezor does not change the underlying timeout dynamics, but it does introduce another potential bottleneck. Signing a Payjoin transaction on a hardware device adds delay: the transaction must be serialized, sent to the device, displayed for user confirmation, and signed. This sequence can easily add 10–20 seconds, consuming the safety margin within the browser timeout. Users combining hardware wallets with Cake Wallet Web for Payjoin should plan for longer round-trip times and may experience higher failure rates than users signing with keys held in the web app.

Regulatory and security implications

From a user protection perspective, the 15% failure rate for Payjoin on web raises questions about disclosure and expectations. Users see a “Payjoin” option in their wallet, which they may interpret as a fully supported feature equivalent to standard sends. However, the failure rate suggests that Payjoin on web should carry an explicit caveat: the feature is experimental, requires both parties to maintain active connections, and may fail in conditions that do not affect standard payments. Financial Conduct Authority (FCA) guidance on cryptocurrency wallet custody emphasizes that users should understand the risks associated with each feature they use.

The open-source nature of Cake Wallet—with code repositories available on GitHub—means that developers can audit the timeout logic and propose improvements. The community can suggest changes such as longer timeouts, retry logic, or fallback mechanisms that detect a failed Payjoin and automatically issue a standard send. However, any mitigation at the application layer cannot override browser-level constraints; the fundamental problem requires either accepting the failure rate or recommending that users rely on native mobile apps for Payjoin.

Security frameworks such as OWASP (Open Web Application Security Project) standards for web applications address availability and reliability, not just confidentiality and integrity. A cryptocurrency wallet that loses transactions due to timeout is failing a fundamental availability requirement. From a user experience standpoint, a 15% failure rate is unacceptable for a critical financial operation. The fact that this failure is architectural—not a bug but a consequence of deploying a stateful, synchronous protocol in an asynchronous environment—does not reduce the user impact.

Future directions and technical solutions

Longer-term solutions to Payjoin reliability on web might include changes to the Payjoin protocol itself, such as adding asynchronous completion paths. Instead of requiring both parties to remain connected until the transaction is signed and broadcast, a modified protocol could allow the receiver to return the modified transaction via a callback URL, email, or push notification at a later time. This would be a more substantial change, requiring updates to BIP specifications and coordination across wallet implementations.

Another approach is to use a relay or intermediary service that both sender and receiver trust. Instead of the sender connecting directly to the receiver’s endpoint, both connect to a relay that maintains session state and coordinates the protocol exchange. The relay can tolerate brief disconnections from either party, store partial state, and complete the protocol even if one party temporarily goes offline. This trades peer-to-peer communication for a trusted third party, introducing new custodial assumptions that may contradict the privacy goals of Payjoin.

At the browser level, emerging standards such as WebRTC and Web Transport offer more reliable connection management than standard HTTP requests. A wallet implementation using these standards could maintain persistent bidirectional channels that are more resilient to interruption. However, these technologies add complexity, require browser support that is not universal, and still do not fully overcome the fundamental constraint that a browser is designed to be interruptible.

The most practical near-term solution is honest documentation and user guidance. Cake Wallet Web should clearly indicate that Payjoin on web has a higher failure rate than standard sends and that mobile Cake Wallet offers significantly better reliability. Users should be offered the option to fall back to a standard send if Payjoin fails, and retry limits should be enforced to prevent users from exhausting their patience or the receiver’s endpoint resources by continuously attempting a failing transaction.