GNU Taler: Free and Private Electronic Money

⏱️ Reading time: 15 min

Taler Operations AG, a new company based in Bochum (Germany), will apply in the coming weeks for a license from BaFin, the country’s financial regulator, to issue electronic money in euros under the GNU Taler protocol. If the permit is granted, the free electronic money that the GNU project has been developing for more than a decade could be used legally to pay at German merchants, and later across the entire eurozone.

📑 En este artículo

1. TL;DR
2. What is GNU Taler?
3. Why it matters that Germany is regulating this
4. How the protocol works under the hood
5. Practical examples and how to try it
6. Real use cases for the Taler protocol
7. Common mistakes and best practices
8. Comparison: Taler versus other payment systems
9. Going deeper: blind signatures and the business model behind the exchange
10. Frequently Asked Questions
    1. Is Taler the same as a cryptocurrency?
    2. Who can see my purchases if I pay with the Taler wallet?
    3. Does the Taler payment system allow tax evasion?
    4. Do I need to wait for BaFin’s license to use the Taler wallet?
    5. What happens to the project if Taler Operations AG doesn’t get the license?
    6. Can I use the Taler wallet without knowing how to program?
11. References

TL;DR

• GNU Taler uses signed bearer tokens for payments that are anonymous for the buyer but traceable for the seller.
• Taler Operations AG, a new company in Bochum, will apply to BaFin for an electronic money issuer license.
• The protocol runs over HTTP with blind signatures, with no blockchain or mining involved.
• A demo wallet on the official site lets you test real payments without opening a bank account.
• Taler’s exchange, wallet, and merchant backend are free software under GPL and AGPL licenses.

What is GNU Taler?

GNU Taler is a free electronic payment protocol, developed within the GNU project, that allows money to be transferred over the internet using cryptographically signed digital coins. It is not a cryptocurrency or a blockchain network: it works as a payment layer on top of the euro or another existing currency, operated by a regulated entity.

The name combines the GNU project’s acronym with “Taler,” the old silver coin that circulated in the Holy Roman Empire and gave rise to the word “dollar.” The historical reference is deliberate, because Taler seeks to recreate digitally the property that was lost most with cards and banking apps: paying without leaving an identity trail on every transaction.

The technical design is led by Christian Grothoff, a professor at the Bern University of Applied Sciences, together with Florian Dold and a team of contributors who publish the code under free licenses. Unlike Bitcoin, Taler doesn’t need a network of nodes competing to validate blocks: a server called the exchange, operated by a regulated institution, issues and redeems the coins.

Taler’s coins are not an accounting promise like a bank account balance. They are bearer tokens: digitally signed strings of bits that represent a fixed value (for example, 1, 2, 5, or 10 euro cents) that anyone who holds them can spend, just like a physical bill. That’s the key to buyer privacy: the exchange signs the coin without being able to see which particular buyer received it, thanks to a cryptographic scheme called a blind signature.

The code for the exchange, the wallet, and the merchant backend is published under free licenses (mainly GPLv3 and AGPLv3, depending on the component), which lets any developer inspect, modify, and deploy their own test instance without asking permission from Taler Systems or Taler Operations AG.

Why it matters that Germany is regulating this

In the European Union, any institution that issues tokens equivalent to euro money needs to be a bank or obtain a specific electronic money institution (EMI) license. The original plan from the NGI Taler consortium was for the German bank GLS, also based in Bochum, to take on that regulated role. In January 2026, GLS decided not to continue, for reasons unrelated to the project according to its own statement, and the consortium spent several months defining an alternative path.

European electronic money regulation demands exactly that: any issuer of cash-equivalent tokens must have sufficient capital of its own, anti-money-laundering controls, and an external audit. It’s the same reason platforms like PayPal or Revolut operate under EMI licenses in various European Union countries, rather than as simple apps.

That alternative path is Taler Operations AG, a subsidiary of Taler Systems SA (based in Luxembourg) that will focus exclusively on operating the euro exchange. GLS remains part of the consortium, but in a supporting role. The advantage of having a dedicated company, according to those in charge, is that it doesn’t compete for priority against the rest of a traditional bank’s product catalog.

Until BaFin grants the license, there is no commercial launch date in Germany. The protocol itself, however, doesn’t depend on that approval: it remains free software, auditable and runnable by anyone, with or without the banking license. The license enables a regulated entity to issue real euros within the system, instead of the test coins already circulating in the demo environment.

💭 Key: Taler flips the logic of most cryptocurrencies: it hides the identity of whoever pays, but leaves the income of whoever gets paid fully visible, so filing taxes remains possible.

How the protocol works under the hood

A Taler payment involves four pieces. The wallet lives on the buyer’s device, as a browser extension or app, and stores the digital coins. The exchange is the server run by the regulated entity: it receives conventional bank transfers and, in exchange, signs digital coins for the wallet that requested them. The merchant (merchant backend) exposes an API for charging customers. And the auditor, an entity independent from the exchange, periodically checks that the euro reserves exactly cover the coins in circulation.

Withdrawal works like this: the buyer transfers, say, 20 euros from their bank account to the exchange with a specific reference. The exchange, upon confirming the deposit, digitally signs a batch of coins in fixed denominations and delivers them to the wallet. Thanks to the blind signature, the exchange cannot link those signed coins to the buyer’s identity, even though it does know who deposited the original money: the bank transfer identifies the sender by law, but the resulting coin remains disconnected from that identity.

Coins are issued in fixed denominations (1 cent, 2 cents, 1 euro, 2 euros, and so on in increasing powers) rather than arbitrary amounts. The reason is privacy: if the exchange issued a coin for the exact amount of each withdrawal, it could reconstruct who withdrew what just by looking at the amounts. By limiting denominations to a short list, thousands of people share the same two-euro coin, and the anonymity set stays large.

flowchart TD
A["Buyer's wallet"] --> B["Exchange (issues and redeems coins)"]
B --> C["Merchant backend"]
D["Independent auditor"] --> B
subgraph Regulated infrastructure
B
D
end

When paying, the wallet hands the merchant the exact coins or several combined to cover the amount. The merchant deposits them at the exchange, which verifies the signatures and transfers the euro equivalent to the merchant’s bank account. There’s no anonymity here: the exchange and the tax authorities can see perfectly well how much each merchant received, because that income must indeed be declared. The only thing the protocol hides is the coin’s origin, never its final destination.

To keep the buyer from having to spend an entire coin at once, the protocol includes a refresh protocol: if you pay 7 euros with a 10-euro coin, the wallet can ask the exchange to convert the remainder into new coins, without the exchange being able to correlate the old coins with the new ones. It’s the digital equivalent of asking for change without the cashier remembering which bill you paid with.

sequenceDiagram
participant W as Wallet
participant E as Exchange
participant M as Merchant
W->>E: withdraws coins from their bank account
E-->>W: delivers signed tokens
W->>M: pays with the tokens
M->>E: deposits the tokens to collect payment
Note over W,M: the merchant never sees the identity of whoever paid

Practical examples and how to try it

The protocol communicates via HTTP requests with JSON bodies, with no blockchain or proof-of-work involved. A simplified response from an exchange confirming the denominations available for withdrawal looks, in essence, like this:

{
  "reserve_pub": "9G3F...A1",
  "denoms": [
    { "value": "EUR:1", "fee_withdraw": "EUR:0.00" },
    { "value": "EUR:5", "fee_withdraw": "EUR:0.01" }
  ]
}

The denoms field lists the available denominations, each with its own signing key and fee. When the merchant presents the charge, the wallet receives a contract terms document with a structure similar to this:

{
  "amount": "EUR:12.50",
  "summary": "Monthly subscription - Tech Magazine",
  "merchant": { "name": "Demo Store" },
  "pay_deadline": { "t_s": 1780000000 }
}

The wallet signs acceptance of that contract with the coins it has available and sends the payment to the merchant. There are no block confirmations to wait for: the payment settles in the time it takes a normal HTTP request.

To try it without risking real money, the project maintains a demo environment at taler.net: from there you can install the wallet extension in your browser, open an account at the test bank, withdraw a fictitious coin, and complete a purchase at a demo store, all without a credit card or a real bank account. It’s the most direct way to see the full withdraw, pay, and deposit flow without depending on BaFin having already approved operation in real euros.

⚠️ Heads up: Taler coins are not a speculative asset. Their value is pegged 1:1 to the underlying currency (euros in this case); there’s nothing to mine or wait to go up in price.

Real use cases for the Taler protocol

Besides the German plan, the NGI Taler consortium maintains a pilot deployment in Switzerland that keeps running unchanged while the process with BaFin moves forward. The project’s stated goal is to cover scenarios where traditional cards turn out to be expensive or excessive: micropayments per news article, donations to nonprofits, machine-to-machine payments, and low-value e-commerce, where a card’s fee eats up a good chunk of the margin.

The use case the project brings up most often is pay-per-article journalism: instead of subscribing to an entire outlet, the reader pays cents for a single piece, something a traditional card gateway makes unworkable because of its fixed fee. The same applies to small donations, where Taler lets the donor keep their anonymity from the recipient without the organization losing accounting traceability of how much it received in total.

It’s also proposed as an alternative for public programs that currently use vouchers or subsidies: a government can issue electronic credit with the protocol for a specific purpose (transportation, food) without exposing in a centralized database who spent what, while still being able to audit the total amount handed out and collected by each participating merchant.

Common mistakes and best practices

• Confusing it with a cryptocurrency. Taler doesn’t trade on markets, isn’t mined, and has no limited supply: each digital coin represents a fixed amount of the official currency deposited at the exchange.
• Thinking anonymity is total. The buyer is anonymous to the exchange and the merchant, but the initial bank transfer used to withdraw coins still identifies whoever made the deposit, just as withdrawing cash from an ATM does.
• Losing the device without a backup. Since the coins are bearer tokens, whoever has access to the wallet can spend them, just like physical cash. The wallet allows exporting an encrypted backup; not doing so is like not having a copy of your house keys.
• Using an exchange without a known auditor. The protocol’s design requires an independent auditing entity to confirm that reserves cover the issued coins; an exchange without a public auditor doesn’t offer the same guarantee the specification describes.

Comparison: Taler versus other payment systems

Going deeper: blind signatures and the business model behind the exchange

The central cryptographic piece is the blind signature, a technique described by David Chaum in the 1980s for his own digital money design, ecash. The idea: the buyer generates a candidate coin, mathematically masks it before sending it to the exchange, the exchange signs it blindly without being able to see its actual content, and the buyer unmasks the signature upon receiving it. The result is a valid signature on a coin the exchange never saw in the clear, so it cannot correlate who withdrew which coin.

That cryptographic property is what sets the protocol apart from a conventional account system: a normal digital bank knows exactly which customer spent what, at which merchant, and when. The exchange only knows that someone withdrew X euros at a given moment and that, at another moment, someone (possibly a different person) deposited valid coins signed by that same system.

The protocol’s first version used RSA-based blind signatures, a classic scheme but with relatively heavy signatures. More recent versions of the specification moved to a more compact blind signature scheme, of the Clause-Schnorr type, designed to reduce the size of each coin and open the door to additional protections against quantum computers in the future. The change doesn’t affect the user experience: wallet, exchange, and merchant still speak the same HTTP protocol; only the underlying cryptographic primitive changes.

The regulatory side is the other half of the problem. Becoming an electronic money issuer in the European Union requires a legally mandated minimum capital of its own, plus a business plan and compliance and IT security staff convincing enough for the supervisor. Taler Operations AG is seeking to fund this through investors willing to contribute at least 50,000 euros, according to the project’s announcement; the company clarifies that the software itself remains free regardless of who ends up operating the banking license.

The consortium distributes part of its European funding through open calls so that outside teams can integrate the protocol into new use cases or strengthen code security audits; it’s the channel through which third parties outside Grothoff and Dold’s original team have been adding modules to the ecosystem over the past few years.

Your next step: install the Taler wallet extension in your browser and complete a test payment at the demo bank on taler.net to see the full withdraw-and-pay flow without using real money.

Frequently Asked Questions

Is Taler the same as a cryptocurrency?

No. The protocol doesn’t use blockchain or mining, and each coin’s value is pegged 1:1 to the official currency deposited at the exchange, with no price fluctuation.

Who can see my purchases if I pay with the Taler wallet?

The exchange cannot link the coin you received to the one you spent, thanks to the blind signature. The merchant does know what you bought, just like at any physical store.

Does the Taler payment system allow tax evasion?

No: the merchant’s income remains fully visible to the exchange and, by extension, to tax authorities. The design protects the buyer; it doesn’t hide the seller’s billing.

Do I need to wait for BaFin’s license to use the Taler wallet?

To test the protocol with demo coins, no: the test environment at taler.net already works. To pay with real euros in Germany, yes, Taler Operations AG needs to obtain authorization first.

What happens to the project if Taler Operations AG doesn’t get the license?

The protocol and its reference implementation would remain free software regardless; what would change is who, and when, can legally operate a euro exchange within the European Union.

Can I use the Taler wallet without knowing how to program?

Yes. Installation is a browser extension like any other; the HTTP protocol and blind signatures work behind the scenes, with no need for the end user to see a single line of code.

References

• Taler.net: official announcement from Taler Operations AG and the plan to apply for a BaFin license.
• Taler.net: the project’s official site, with access to the wallet demo environment and the test bank.
• GNU Project: the official GNU Taler page within the GNU project’s software catalog.
• Wikipedia: encyclopedic overview of the protocol and its history within the GNU project.
• Wikipedia: explanation of the blind signature scheme that underpins buyer privacy.
• GLS Bank: statement on its decision not to continue as an electronic money issuer for Taler.

📱 Enjoying this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.

Featured image: Foto de Traxer en Unsplash