What is btcpos.cash ?

btcpos.cash is a point-of-sale system that allows merchants to easily accept Bitcoin lightning payments without running a node. This is possible by leveraging the Liquid network and the Boltz exchange.

How does it work?

Bitcoin POS is configured with your Liquid wallet's confidential descriptor (ELIP-151), See our CT Descriptor Tutorials for supported wallet. The CT descriptor allows to generate wallet addresses but not sign transactions and spend funds. It is what is called a watch-only wallet. With the wallet address an invoice is createad using Boltz exchange, this is the step that requires the payment of the fees.

Does sharing my POS link leak privacy?

Yes. Your configured POS link contains your CT descriptor. Anyone who gets that link (a “power user”) can use it in watch-only mode to derive your receiving addresses and list wallet transactions. This is undesirable because it leaks your business activity.

Some descriptors are even worse: a view descriptor (for example one containing a private blinding key / SLIP77 key) allows the holder to also unblind amounts and assets and therefore compute your balance.

If your wallet supports them, prefer non-view descriptors as described in ELIP-0150. A non-view descriptor still lets someone derive blinded addresses and detect related transactions, but it does not give the capability to unblind transactions. In other words, it can fetch wallet transactions but cannot calculate the balance.

Why are there fees?

The fee of 0.25% + 50 sats per invoice is charged entirely by the Boltz exchange service to perform the Lightning-to-Liquid swap. btcpos.cash does not add any markup on top of this.

In exchange for this small fee, you get significant advantages:

• No node required — You don't need to run or maintain a Lightning node, which typically requires technical expertise, 24/7 uptime, and channel management.
• No registration — There's no sign-up process, no accounts to create, and no KYC. Just configure your wallet descriptor and start accepting payments immediately.
• Self-custody — Funds go directly to your Liquid wallet. You maintain full control of your money at all times.

Rescue file

A reverse submarine swap, also known as a Lightning-to-Liquid swap, never trap user funds, meaning that if the merchant wallet is not claiming funds, the lightning payment don't get through. In other words, there is never a situation where the payer wallet show a payment get through and the merchant wallet don't receive it.
However, the POS is generating a mnemonic to spend the claim script and claim the funds. This mnemonic is generated randomly and stored locally in your browser.
It is available for download by triple-clicking on the wallet ID at the bottom of the page. The format is compatible with the Boltz exchange recovery tool.

Mitigating supply chain attacks

Since btcpos.cash runs entirely in your browser, you're trusting the server to deliver unmodified code each time you load the page. A compromised server could theoretically serve malicious code that leaks your descriptor or misdirects payments.

To mitigate this risk, you can install the app locally using your browser's "Install as app" feature (PWA). Once installed, the app runs from your device's cache and no longer fetches code from the server on each use.

How to install:

1. Configure your POS and generate the link (e.g., https://btcpos.cash/#eyJ...)
2. In the URL bar, replace # with ? (e.g., https://btcpos.cash/?eyJ...)
3. Navigate to the modified URL
4. In Chrome: click the install icon in the address bar, or use Menu → "Install Bitcoin POS"
5. The app is now installed with your configuration baked in

Why replace # with ?

The # fragment is normally used because it's never sent to the server, protecting your descriptor privacy. However, browsers strip the # fragment when installing as an app. Using ? preserves the configuration in the installed app's start URL. The privacy trade-off is minimal since you're already trusting the server at install time. After installation, the app works offline and your configuration remains private — it's only stored locally on your device.

Does this site track me?

We are committed to the highest standards of privacy. Unlike many other services, btcpos.cash does not use Google Tags, Google Analytics, or any other tracking tools from major advertising networks. We believe your business activities and financial privacy should not be part of a global advertising profile.

To monitor site performance without compromising your anonymity, we use Plausible Analytics. Plausible is a privacy-first, cookie-less tool that does not collect personal data or track you across different websites.

Furthermore, to ensure maximum security and privacy:

• Self-Hosted Script: The Plausible JavaScript is served from a domain owned and managed by the site owner.
• No Third-Party Requests: By hosting the script ourselves, we ensure that your browser never makes a request to a third-party analytics server, preventing external entities from logging your IP address or visit.
• Privacy First: We only see aggregated, anonymous data that helps us understand how the site is being used so we can continue to improve the service for everyone.