View tag

A small filter before a full check

The sender derives the tag using the shared derivation for the payment and the output index. The recipient can reproduce it while scanning. The implementation uses a domain-separated hash so the tag has a defined role distinct from other derived values.

When the tag differs, the wallet avoids work needed to determine output ownership. With only 256 possible byte values, some unrelated outputs necessarily share the expected tag. The normal ownership check resolves those matches.

References: Monero source: crypto/crypto.cpp · Monero output encoding

What remains private

A public observer sees the tag on the chain but does not have the recipient view-key calculation simply because the byte is visible. The same tag can occur in unrelated transactions.

View tags do not hide IP addresses, protect a compromised wallet or stop a person from disclosing a payment. They solve a scanning-efficiency problem within the transaction format.

References: Monero source: crypto/crypto.cpp · Monero output encoding

Example

While scanning a transaction, the wallet computes the expected tag and skips the full output check on a mismatch. Matching tags require the ownership check before the wallet can recognize a payment.

References: Monero source: crypto/crypto.cpp · Monero output encoding

Limits and cautions

The tag is one byte and can collide. It is not an address, payment ID or proof of ownership. It accelerates scanning without replacing the one-time output-key check or the recipient privacy provided by stealth addresses.

References: Monero source: crypto/crypto.cpp · Monero output encoding