HTLCs: hash time-locked contracts

An HTLC pays someone who reveals a secret before a deadline and otherwise refunds the sender. It makes multi-hop Lightning payments trustless. See how.

Pay for a secret

An HTLC is a conditional payment: "this money goes to you if you reveal the secret whose hash is H before time T; otherwise it comes back to me."

It combines a hash lock (hash check) and a time lock (CLTV).

Making routing trustless

1. Bob creates a random secret (the preimage) and gives Alice its hash in an invoice.
2. Alice offers Carol an HTLC locked to that hash. Carol offers Dave one, Dave offers Bob one, each with a slightly shorter deadline.
3. Bob reveals the secret to claim Dave's HTLC. Dave now knows it and claims Carol's. Carol claims Alice's.

Because each hop can only claim from the previous hop with the secret they just learned, nobody can take money without passing the payment on.

The preimage is a receipt

Once Alice sees the preimage, she has proof Bob was paid: only Bob knew it.

HTLCs beyond Lightning

The same hash-plus-timeout pattern powers atomic swaps: two people trade coins on two different chains, or on-chain for Lightning, without trusting each other. Either both sides get paid, or both get refunded.

The script, simplified

IF
  <hash of secret> OP_SHA256 check, then the receiver's signature
ELSE
  <timeout> OP_CHECKLOCKTIMEVERIFY, then the sender's signature
ENDIF