What is a zero-knowledge proof, and what is it used for?

A zero-knowledge proof lets one party convince another that a statement is true without revealing anything beyond the fact that it is true. You could prove you are over 18 without showing your birth date, or prove a batch of transactions was processed correctly without anyone re-running them. In crypto, these proofs serve two main purposes: scaling blockchains through zk-rollups and keeping data private.

An analogy: proving two balls differ to a colorblind friend

The easiest way to see how a proof can reveal nothing is a game with two balls. You hold a red ball and a green ball. Your friend is colorblind, so they look identical, and your friend doubts they differ at all.

1. Your friend takes both balls and puts them behind their back.
2. They bring one out, hide it again, and either swap the balls or don't.
3. They show you a ball and ask: "Did I swap?"

You can see the colors, so you always answer correctly. If the balls really were identical, you could only guess, and you would be right half the time. After 20 rounds, the chance of a lucky streak is about one in a million (one in 1,048,576).

Your friend ends up convinced the balls differ. Yet they still have no idea which one is red. That is the whole idea: conviction without disclosure.

The concept dates to a 1985 paper by Shafi Goldwasser, Silvio Micali and Charles Rackoff. Blockchains gave it a large practical use, because they need many strangers to check claims cheaply.

The three properties every zero-knowledge proof must have

A proof system counts as zero-knowledge only if it meets three requirements:

1. Completeness. If the statement is true and the prover is honest, the verifier will accept.
2. Soundness. If the statement is false, a cheating prover cannot convince the verifier, except with negligible probability.
3. Zero knowledge. The verifier learns that the statement is true and nothing else.

A fourth property does much of the work in crypto, though it isn't part of the definition. Succinctness means the proof is small and fast to check, even when the computation behind it was enormous.

This leads to a common misconception. Many "zero-knowledge" rollups hide nothing. Ethereum.org notes that their published data is public, and that validity proofs enable scaling rather than confidentiality. They use the math for succinctness. Privacy is a separate feature that a system must choose to build.

How a real proof works, step by step

Real systems replace the balls with math, but the roles are the same.

1. Write the statement as a circuit. A program, such as "this batch of transactions was executed correctly," is converted into a large system of math constraints.
2. The prover computes with secret inputs. The secret data is called the witness. In a privacy app it might be a spending key.
3. The prover generates a proof. This is the expensive step.
4. The verifier checks the proof. This takes far less work, and it can run inside a smart contract.

Unlike the ball game, modern proofs are non-interactive. The prover publishes one proof, and anyone can check it later without a conversation. That fits a blockchain, where thousands of nodes need to verify the same claim.

SNARKs vs. STARKs

The two main families of proof are zk-SNARKs and zk-STARKs, and they trade proof size against setup assumptions.

	zk-SNARK	zk-STARK
Name	Succinct Non-interactive Argument of Knowledge	Scalable Transparent Argument of Knowledge
Trusted setup	Many need one. Newer designs such as Halo 2 don't	None. Uses public randomness
Proof size	Very small. Groth16 is 3 group elements	Larger, often tens of kilobytes or more
Example benchmark	384 bytes (Groth16)	About 68.6 KB in the same test
Security basis	Usually elliptic curves, so vulnerable to future quantum computers	Hash functions, considered more quantum-resistant
Cost to verify on Ethereum	About 500,000 gas	Higher, per the same page

Treat the benchmark row as an illustration. It comes from one academic test, and real sizes vary a lot.

In practice, the families are often combined. ZKsync's Boojum prover uses recursive STARK-style proofs, then wraps the result in a small SNARK so that it is cheap to verify on Ethereum. That final wrap relies on a trusted setup, the Aztec Ignition ceremony. Starknet, by contrast, verifies STARK proofs on Ethereum with no trusted setup.

So "SNARK or STARK" rarely tells you what you are trusting. To find out, ask what the final on-chain verifier checks.

What is a trusted setup, and why does it matter?

A trusted setup is a one-time ceremony that generates the public parameters many SNARKs need. It uses secret randomness, often called "toxic waste." Anyone who keeps that randomness can forge false proofs, and nobody could tell from the proofs alone.

Ceremonies reduce this risk by having many people each add randomness. The result stays secure if even one participant honestly discards theirs. Ethereum's KZG ceremony, which supports data blobs rather than a privacy system, collected 141,416 contributions during 2023.

Setups have gone wrong in practice:

• Zcash, 2018-2019. A flaw in the parameter setup for Zcash's original shielded pool could have allowed undetectable counterfeiting. A company cryptographer found it on March 1, 2018. It was fixed by the Sapling upgrade that October and disclosed in February 2019. The company says it found no evidence of exploitation, which is its own assessment and hard to prove absolutely.
• Foom Cash, February 2026. A team skipped a step in its setup, so two values that should have been random kept their defaults. The verifier then accepted forged proofs. About $2.26 million left the contracts. White hats recovered most of it, and the net loss was about $420,000.

Neither case broke the hard math assumptions behind the proofs. Both show that a proof system is only as sound as its parameters and deployment.

What are zero-knowledge proofs used for?

Scaling with zk-rollups

A zk-rollup executes transactions off-chain, then posts a compact summary and a validity proof to Ethereum. A verifier contract checks the proof and accepts the new state only if it is valid. Withdrawals don't need a challenge window, because the proof has already shown the state is correct.

Private payments

Zcash lets users send shielded transactions, where a proof shows the transfer is valid without revealing sender, recipient or amount. Its Orchard pool, activated on May 31, 2022, uses Halo 2 and removes the need for a setup ceremony.

Tornado Cash applied proofs to mix funds on Ethereum. In March 2025, the US Treasury removed it from its sanctions list. Privacy tools still carry legal risk that varies by country, so ask a lawyer if you have a real concern. You can read more under privacy.

Identity

Zero-knowledge proofs let you reveal one fact from a document and nothing else. Google open sourced its proof libraries in July 2025 so that people can show, for example, that they are over 18 without sharing other data. Ethereum.org also lists World ID, which proves membership in a group of verified humans without showing which member, and Bhutan's National Digital ID.

Voting

Systems such as MACI use proofs so that a coordinator can tally votes without revealing individual choices. That reduces bribery, because a voter can't prove how they voted. It is relevant to DAOs and on-chain voting, where ballots are otherwise public.

Costs and limits

Zero-knowledge proofs are powerful, but they aren't free and they don't solve everything.

• Proving is expensive. Generating proofs needs specialized, costly machines, which can concentrate control among a few operators. The Ethereum Foundation's target for proving a mainnet block in real time is up to 10 seconds on hardware costing up to $100,000 and drawing up to 10 kW. It is a target, and it shows the scale involved.
• Verifying still costs gas. At about 500,000 gas per SNARK, rollups batch many transactions to spread the cost.
• A proof only covers its circuit. It shows the computation matched the circuit, and a bug in the circuit produces a valid proof of the wrong thing. Circuits are hard to audit.
• Inputs aren't verified automatically. A proof about a false document only shows the math was done on that document, unless the circuit also checks who signed it.
• Metadata can leak. A proof can hide the contents of a transaction while timing, the amounts entering and leaving a private pool, and your IP address still give you away.
• Quantum computers are a future risk for elliptic-curve SNARKs, as the table notes.

Three questions to ask about any "ZK" project

1. What is actually hidden? It may be nothing. Check whether transaction data is public.
2. Is there a trusted setup, and who ran it? Look at both the inner proof and any final wrap.
3. Who runs the prover, and what happens if it stops? Check whether users can force an exit on Ethereum.

Key takeaways

1. A zero-knowledge proof shows a statement is true while revealing nothing else about it.
2. Every such proof needs completeness, soundness and zero knowledge. Succinctness is what makes them useful for scaling.
3. Many zk-rollups use the math for compression only and keep all their data public.
4. SNARKs have small proofs but often need a trusted setup. STARKs need none but have larger proofs, and many systems combine the two.
5. The Zcash and Foom Cash failures came from setup errors, not a broken math assumption. Circuit bugs are another real risk.
6. Proving is costly and specialized, so ask who runs it and what you are trusting.

Sources

• Zero-knowledge proofs (ethereum.org)
• Zero-knowledge rollups (ethereum.org)
• Groth16: On the Size of Pairing-based Non-interactive Arguments
• Scalable, transparent, and post-quantum secure computational integrity (STARK paper)
• Zcash counterfeiting vulnerability disclosure
• KZG ceremony summary (Ethereum Foundation)
• Boojum proof system (L2BEAT ZK Catalog)