Skip to content
NoKYC Score
DirectoryExchangesSwapsBuyRatesIncidentsGuides List a project Sign in

Payment Gateways Since 2017 Reviewed 22 Oct 2026

BTCPay Server review

Self-hosted open-source Bitcoin payment processor with no fees and no third party

  • No account needed
  • Accepts Monero
  • Never holds your funds
  • Open source
  • Accepts Lightning
  • No email needed
ID never required KYC 0 Documentation reviewed
Visit btcpayserver.org Report an incident Watch

Privacy

8.9/ 10

Excellent

Safety

6.8/ 10

Fair

Based on terms and documentation. No test transactions published yet. See the arithmetic

BTCPay Server review in short

BTCPay Server is a payment gateway operating since 2017. Its terms put it at KYC level 0 of 4: ID never required. NoKYC Score grades it 8.9/10 for privacy (excellent) and 6.8/10 for safety (fair). In its favour: no account needed, no email needed and no phone number. One incident is on record, the latest from 7 Aug 2026.

Category
Payment Gateways
KYC level
0 of 4: ID never required
Grades
Privacy 8.9/10, Safety 6.8/10
Sign-up
No account needed
Custody
non-custodial
Fees
0% processing fees; hosting costs only
Jurisdiction
Decentralised / none
Incidents on record
1
Last reviewed
22 Oct 2026
Cite this review

NoKYC Score, "BTCPay Server review", reviewed 22 Oct 2026, https://nokycscore.com/service/btcpay-server

Also available as plain text.

What BTCPay Server is

BTCPay Server is a self-hosted, open-source cryptocurrency payment processor that lets merchants accept Bitcoin, including over Lightning, directly into wallets they control, with no processing fees and no intermediary. The site stresses that it is an open-source project and not a company, so there is no operator that could onboard or verify merchants. On 7 August 2026 the project published a security advisory urging all operators to update to version 2.4.2 because a flaw allowed an unauthenticated attacker to obtain LND Lightning node credentials; the flaw was exploited against several merchants before they patched.

What BTCPay Server offers, and what to watch

9 of 13 privacy and safety features, 0 warnings in its terms.

"Not stated" means its own pages do not say.

Identity

  • ID never required Yes The terms rule identity checks out, or the design makes them impossible.
  • No account needed Yes Usable without creating an account, or the account is only a random number.
  • No email needed Yes An email address is not required to sign up or use it.
  • No phone number Yes A phone number is never required.

Payment

  • Accepts Monero Yes Monero hides sender, receiver and amount, so the payment cannot be traced to you.
  • Accepts Lightning Yes Bitcoin Lightning payments: fast, cheap and more private than on-chain.

Access

  • Tor onion address Not stated
  • Works without JavaScript Not stated

Trust

  • Never holds your funds Yes The operator never controls user funds, so it cannot freeze them.
  • Open source Yes The code that matters is public and can be inspected.
  • Independent audit Not stated
  • Company named Not stated
  • 5+ years operating Yes Has operated continuously for five years or more.

Warnings

  • May ask for ID Not in terms
  • Screens deposits Not in terms
  • Holds your funds Not in terms
  • Email required Not in terms
  • Phone number required Not in terms
  • Closed source Not in terms
  • Nobody accountable Not in terms

Does BTCPay Server require KYC?

  1. 0
  2. 1
  3. 2
  4. 3
  5. 4

KYC level 0: ID never required. The terms rule out identity checks, or the design makes them impossible.

Self-hosted software with no operator; the site states it is "an open-source project, not a company".

Read the terms we assessed ↗

How the grades add up

Both grades start at 50 points and move by fixed, published amounts. Nothing is adjusted by hand. The total is divided by ten.

Privacy

8.9
  • Starting points 50
  • KYC level 0: ID never required +20
  • No registration +6
  • No email needed +3
  • No phone needed +1
  • Accepts Lightning +1
  • Open source +2
  • Non-custodial +3
  • Self-hostable +3
  • Total, clamped to 0–100 89

Safety

6.8
  • Starting points 50
  • Open source +8
  • Non-custodial +12
  • Self-hostable +3
  • 5+ years operating +10
  • Security advisory: flaw exposing LND credentials exploited before version 2.4.2 high · unknown · 77 days ago -15
  • Total, clamped to 0–100 68

Test ledger

Real transactions run by our editors. A badge without a ledger is an assertion; this is the proof.

No test transactions published yet

The grades above rest on BTCPay Server’s terms and documentation. Tests will appear here with the date, route, amount band and result as they are run.

Incidents on record

high

Hack or exploit

Security advisory: flaw exposing LND credentials exploited before version 2.4.2

The BTCPay Server project published an advisory on 7 August 2026 urging operators to update to version 2.4.2 immediately or take servers offline. According to the advisory, the flaw could let an unauthenticated remote attacker obtain LND credential files and move funds from the connected Lightning node; on-chain wallets were not affected. Several merchants publicly confirmed losses. The project has not published a total, and said a full post-mortem would follow.

Outcome unknown Source: blog.btcpayserver.org ↗

User reviews

Reviews never change a grade. Reviews with a transaction reference are marked.

No reviews yet.

Write a review

Create an account to write a review. It takes ten seconds and needs no email: you get a random key and a random name. Already have a key? Sign in.

Alternatives to BTCPay Server

All alternatives →

Bitcart

Self-hosted open-source payment processor supporting 50+ coins including Monero

Privacy 9.2
Safety 7.3
Never KYC 0 Docs reviewed

MoneroPay

Self-hosted backend service for receiving and tracking Monero payments

Privacy 9.2
Safety 7.3
Never KYC 0 Docs reviewed

SHKeeper

Self-hosted open-source crypto payment gateway with no transaction fees

Privacy 8.8
Safety 7.3
Never KYC 0 Docs reviewed

Bitrequest

Open-source app for creating crypto payment requests and watching them arrive

Privacy 9.0
Safety 7.0
Never KYC 0 Docs reviewed

BTCPay Server vs BitcartBTCPay Server vs MoneroPayBTCPay Server vs SHKeeperBTCPay Server vs Bitrequest

BTCPay Server: common questions

Does BTCPay Server require KYC?

BTCPay Server is rated KYC level 0 of 4 on this site: ID never required. Self-hosted software with no operator; the site states it is "an open-source project, not a company".

Is BTCPay Server safe to use?

BTCPay Server has a Safety grade of 6.8 out of 10 and a Privacy grade of 8.9 out of 10. There is 1 incident on record, listed with sources on this page. Evidence level: documentation reviewed.

Is BTCPay Server legit?

BTCPay Server is a working payment gateway that has operated since 2017. Being real is not the same as being safe: its Safety grade here is 6.8 out of 10, built from custody, liquidity, track record and incidents.

Is BTCPay Server a scam?

NoKYC Score does not label services as scams; it records documented incidents with their sources and outcomes. BTCPay Server has 1 incident on record, 1 not resolved, the latest: "Security advisory: flaw exposing LND credentials exploited before version 2.4.2". Each is listed on this page with its source.

Do I need an account or email to use BTCPay Server?

No account needed.

What fees does BTCPay Server charge?

0% processing fees; hosting costs only. Fees were recorded from BTCPay Server's own pages and can change; check before you send.

Does BTCPay Server have a Tor onion address?

No official onion address was found on BTCPay Server's own pages.

Which cryptocurrencies does BTCPay Server support?

BTCPay Server supports BTC, LTC, XMR.

Is BTCPay Server custodial?

No. BTCPay Server is non-custodial: the operator does not control user funds.

Can I use BTCPay Server over Tor?

BTCPay Server does not publish an official onion address.

Listing history

  • Listing added. Facts and KYC level set from the service's own terms and documentation.
  • Incident recorded: Security advisory: flaw exposing LND credentials exploited before version 2.4.2