<p>In general this is not possible.</p>
<p>In some cases, where the transaction creator doesn't care about privacy and, for example, the transaction has one input and two outputs, you can sometimes work out which of the two outputs is change</p>

CC BY-SA 4.0
2022-12-23T12:54:48.570Z
2022-12-23T12:54:48.570Z
RedGrittyBrick
<p>You can think of a transaction as a melting pot. All the inputs get melted down and recast into the outputs, so there is some of every input in each input. All inputs create all outputs together.</p>
<p>Exceptions would perhaps be if an input uses the <code>SIGHASH_SINGLE</code> flag that make inputs only commit to one output in the transaction instead of all outputs, or if an input declares <code>SIGHASH_NONE</code> that only commits to the inputs of a transaction but not the outputs. (See Raghav Sood's <a href="https://raghavsood.com/blog/2018/06/10/bitcoin-signature-types-sighash" rel="nofollow noreferrer">excellent explanation of the Signature Flags</a> for more information.) These may appear in the context of multi-user transactions.</p>
<p>There may be other hints that may allow a surveillant to guess the ownership of outputs, though. E.g. if a transaction only spends one type of UTXOs for its inputs and creates two different output types of which one matches the inputs, that may be an indicator that the matching output is a change output. The Bitcoin Wiki has an excellent page on <a href="https://en.bitcoin.it/wiki/Privacy" rel="nofollow noreferrer">Privacy</a>, further describing this and other privacy leaks.</p>
<p>If a transaction has multiple inputs and multiple outputs, but the values of some inputs (or subset sums of some inputs) directly correspond with amounts appearing in the outputs, it may be guessed that certain input sets funded the creation of specific outputs, but multiple users banded together to create a transaction. A colleague of mine, Felix Maurer wrote his master thesis “Anonymity in Bitcoin - Unlinkable transactions in cryptocurrencies” in 2016 on a topic closely related to that, but I could not quickly find the thesis online. IIRC it resulted in the paper <a href="https://ieeexplore.ieee.org/abstract/document/8029483" rel="nofollow noreferrer">Maurer et al (2017): Anonymous CoinJoin Transactions with Arbitrary Values</a> which you may find interesting.</p>

CC BY-SA 4.0
2022-12-23T15:06:10.023Z
2022-12-23T15:30:46.460Z
2022-12-23T15:30:46.460Z
Murch
<p>For any given transaction, I would like to know which input corresponds to which output. I am specifically referring to the case where there are multiple inputs/outputs.</p>
<p>Is this possible? If yes, are there exceptions that you could elaborate on?</p>

CC BY-SA 4.0
2022-12-23T14:49:26.917Z
Hi The Hulk, I am attempting an answer, but could you elaborate what sort of correspondence you expect between inputs and outputs?
Murch
CC BY-SA 4.0
2022-12-23T15:06:18.310Z
Hi Murch, let's assume a multi input/output transaction with 7 inputs and 3 outputs. The values of which input addresses where used to send an output value to address 1, which to address 2 and which to address 3? In case you're familiar with graph theory/network science, you can think of it in terms of a graph where nodes represent addresses and arcs represent transferred value. Given this context, which input addresses are connected to which output addresses?
Andreas
CC BY-SA 4.0
2022-12-23T15:30:57.793Z
Thanks, I updated my answer
Murch
<transactions><traceability>
Is it possible to know which input corresponds to which output in a transaction?
Andreas
# Is it possible to know which input corresponds to which output in a transaction?

(Asked by: username_0 on 2022-12-23)

For any given transaction, I would like to know which input corresponds to which output. I am specifically referring to the case where there are multiple inputs/outputs.

Is this possible? If yes, are there exceptions that you could elaborate on?

**Tags:** transactions, traceability

> **Comments:**
> **username_1**: Hi The Hulk, I am attempting an answer, but could you elaborate what sort of correspondence you expect between inputs and outputs?  
> **username_0**: Hi username_1, let's assume a multi input/output transaction with 7 inputs and 3 outputs. The values of which input addresses where used to send an output value to address 1, which to address 2 and which to address 3? In case you're familiar with graph theory/network science, you can think of it in terms of a graph where nodes represent addresses and arcs represent transferred value. Given this context, which input addresses are connected to which output addresses?  
> **username_1**: Thanks, I updated my answer  

---

## 2 answers

### Answer by username_1 on 2022-12-23. Score: 4 | Accepted answer

You can think of a transaction as a melting pot. All the inputs get melted down and recast into the outputs, so there is some of every input in each input. All inputs create all outputs together.

Exceptions would perhaps be if an input uses the `SIGHASH_SINGLE` flag that make inputs only commit to one output in the transaction instead of all outputs, or if an input declares `SIGHASH_NONE` that only commits to the inputs of a transaction but not the outputs. (See Raghav Sood's [excellent explanation of the Signature Flags](https://raghavsood.com/blog/2018/06/10/bitcoin-signature-types-sighash) for more information.) These may appear in the context of multi-user transactions.

There may be other hints that may allow a surveillant to guess the ownership of outputs, though. E.g. if a transaction only spends one type of UTXOs for its inputs and creates two different output types of which one matches the inputs, that may be an indicator that the matching output is a change output. The Bitcoin Wiki has an excellent page on [Privacy](https://en.bitcoin.it/wiki/Privacy), further describing this and other privacy leaks.

If a transaction has multiple inputs and multiple outputs, but the values of some inputs (or subset sums of some inputs) directly correspond with amounts appearing in the outputs, it may be guessed that certain input sets funded the creation of specific outputs, but multiple users banded together to create a transaction. A colleague of mine, Felix Maurer wrote his master thesis “Anonymity in Bitcoin - Unlinkable transactions in cryptocurrencies” in 2016 on a topic closely related to that, but I could not quickly find the thesis online. IIRC it resulted in the paper [Maurer et al (2017): Anonymous CoinJoin Transactions with Arbitrary Values](https://ieeexplore.ieee.org/abstract/document/8029483) which you may find interesting.


---

### Answer by username_2 on 2022-12-23. Score: 2

In general this is not possible.

In some cases, where the transaction creator doesn't care about privacy and, for example, the transaction has one input and two outputs, you can sometimes work out which of the two outputs is change


---

