Zero-knowledge proofs, explained simply
Proving you know something without revealing it. It sounds like magic; here's the plain version.
A zero-knowledge proof lets you convince someone that a statement is true, such as "I know the password" or "this batch of 5,000 transactions is valid", without revealing anything else. In crypto they're used for privacy (Zcash), for scaling (ZK rollups prove that thousands of transactions are correct with one small proof), and increasingly for identity, like proving you're over 18 without showing your birth date.
The Where's Waldo explanation
You've found Waldo on a crowded page. You want to prove it to a friend without showing where he is. So you take a sheet of cardboard far bigger than the book, cut a small hole, and position it so only Waldo shows through. Your friend sees Waldo, so they're convinced you found him, but the sheet hides the rest of the page, so they learn nothing about his location. That's the idea, from a 1990s paper titled "How to convince your children you are not cheating".
The three properties
- Completeness: if the statement is true, an honest prover can always convince the verifier.
- Soundness: if it's false, a cheating prover can't convince the verifier, except with negligible probability.
- Zero knowledge: the verifier learns nothing beyond the fact that the statement is true.
The idea was introduced by Shafi Goldwasser, Silvio Micali and Charles Rackoff in 1985. Early proofs were interactive conversations; blockchains need non-interactive proofs that anyone can check later from a single message.
zk-SNARKs vs. zk-STARKs
| Compare | zk-SNARK | zk-STARK |
|---|---|---|
| Stands for | Succinct Non-interactive ARgument of Knowledge | Scalable Transparent ARgument of Knowledge |
| Proof size | Tiny, often a few hundred bytes | Larger, tens to hundreds of kilobytes |
| Setup | Many need a one-time "trusted setup" ceremony | Transparent: no trusted setup |
| Built on | Elliptic-curve cryptography | Hash functions |
| Quantum computers | Vulnerable in theory | Believed resistant |
| Used by | Zcash, several ZK rollups | Starknet |
A trusted setup creates secret random values that must be destroyed afterward; if anyone kept them, they could forge proofs. Ceremonies spread this across many participants so the setup is safe as long as just one destroyed their share honestly. Newer SNARK systems use one universal setup that many applications can share.
Where they're used
- Private payments. Zcash's shielded transactions, since 2016, prove that a payment is valid (no coins created, sender authorized) without revealing sender, receiver or amount. See is crypto anonymous?
- Scaling. ZK rollups run thousands of transactions off chain and post one proof that Ethereum checks cheaply. Checking is far cheaper than redoing the work.
- Identity and credentials. Proving you're over 18, a citizen or on an allow-list without revealing who you are.
- Light clients and bridges. Proving that another chain's block is valid, so a bridge needn't trust a group of signers.
Example: a rollup's proof
A ZK rollup processes 5,000 transfers. Its prover, a powerful server, spends minutes creating a proof that says, in effect: "starting from state root A, applying these 5,000 valid, correctly signed transactions gives state root B". Ethereum's contract checks the proof in a fraction of the time it would take to replay all 5,000, then accepts B. No one needs to trust the prover.
Limitations and risks
- Bugs are invisible. If the circuit (the program being proved) has a flaw, a false proof can pass. In 2019 the Zcash company disclosed it had found and quietly fixed a flaw that could have allowed undetectable counterfeiting.
- Proving is expensive. Generating proofs takes heavy computation and specialized hardware, which tends to concentrate it.
- Trusted setups depend on at least one ceremony participant being honest.
- "ZK" in a name isn't a privacy guarantee. Most ZK rollups use proofs for validity, not privacy; their transactions are as public as Ethereum's.
Frequently asked questions
What is a zero-knowledge proof, in one sentence?
A way to prove a statement is true without revealing anything beyond the fact that it's true.
Are ZK rollups private?
Usually not. They use zero-knowledge proofs to show transactions are valid, but the transaction data is still published.
What is a trusted setup?
A one-time ceremony that generates parameters some SNARK systems need. If every participant's secret were kept and combined, fake proofs could be made, so ceremonies use many independent participants.
Which is better, SNARK or STARK?
Neither in general. SNARKs have tiny proofs; STARKs avoid trusted setups and rely only on hash functions. Projects choose based on cost and security needs.
Who invented zero-knowledge proofs?
Shafi Goldwasser, Silvio Micali and Charles Rackoff, in a paper first published in 1985.
Where to next
Sources
- The knowledge complexity of interactive proof systems (Goldwasser, Micali, Rackoff, 1985)
- How to convince your children you are not cheating (Naor, Naor and Reingold)
- Zero-knowledge proofs (ethereum.org)
- Scalable, transparent, and post-quantum secure computational integrity (Ben-Sasson et al., STARK paper)
- Zcash company discloses fixes to counterfeit vulnerability (The Block, February 2019)
Written for beginners and checked against the sources listed. Last reviewed November 4, 2026. This page is educational and is not financial, tax or legal advice. How we write and check pages.