Offline payments
A signed promise exchanged between two phones with no network at all, with counters and nonces so the same promise cannot be spent twice when the signal returns.
Traders in places with no reliable signal, markets that lose coverage at peak hours, anyone whose business stops when the network does.
Part of the platform itself: it is present wherever BitriPay runs.
The problem
When the network goes, digital payment stops and everybody falls back to cash. The obvious fix — let the phones agree and sync later — is also the obvious way to let somebody spend the same balance in four places.
How it works
- The payer’s phone produces a signed promise carrying the amount, a nonce and a counter.
- The merchant’s phone verifies the signature and records it, with no network involved.
- Both sides see the payment as pending confirmation — and the screen says so rather than claiming it is done.
- When either phone reaches a signal, promises are synchronised and settled, and gaps in the counter are visible.
What you can check
Facts about the running platform rather than adjectives. Each one is visible in the product, the API reference or the ledger.
- A promise is signed by the payer’s enrolled device key, so it cannot be fabricated by the merchant’s phone.
- Each promise carries a nonce and a per-device counter; a replayed promise is recognised and a missing counter value shows as a gap.
- The pending state is shown to both sides in plain words rather than being presented as a completed payment.
- Promises have an expiry, so an unsynchronised promise does not sit indefinitely as an open claim.
- Counter gaps are listed per device, so a device that has stopped synchronising is visible rather than assumed healthy.
What it costs
No additional charge. The payment is priced as an ordinary payment when it settles.
Questions
What stops somebody spending the same money twice offline?
Each promise carries a nonce and a per-device counter. Replays are recognised, and a gap in the counter is visible when the device synchronises. It is not possible to make offline spending risk-free — which is why the exposure is bounded by limits and expiry, and why both sides are told the payment is pending rather than complete.
Does the merchant have to trust the customer?
Less than with cash, and considerably less than with a screenshot. The promise is signed by the payer’s enrolled device and cannot be fabricated by the merchant’s phone — but it is a promise until it settles, and the screen says exactly that.
What if a phone never comes back online?
Promises expire, and counter gaps per device are listed, so a device that has stopped synchronising is visible rather than quietly assumed to be fine.
Read next
BitriQR payments
One printed code that works for a customer with the app, a customer with only a camera, and a customer whose bank has never heard of BitriPay — because the code is EMVCo underneath and signed on top.
USSD and SMS
The same ledger, the same balances and the same limits reached from a feature phone with no data — not a reduced product for poorer customers, the same product through a different door.
BitriPay Lite
A full web app that works with JavaScript switched off entirely, rendered on the server, so it loads on a slow connection and an old browser instead of showing a spinner.