What is a zero-knowledge proof? Privacy and scaling explained

A zero-knowledge proof lets one party prove to another that a statement is true without revealing any information beyond the truth of the statement itself. It is the cryptographic technique behind blockchain privacy, scalable rollups, and a growing number of identity verification systems.

The standard explanation of zero-knowledge proofs uses the cave analogy. Ali Baba knows the secret word to open a door inside a circular cave. He can prove he knows the word by entering from one side and exiting from the other, on demand, without ever saying the word out loud. After enough successful demonstrations, the verifier becomes statistically certain Ali Baba knows the secret.

This analogy is correct but incomplete. It captures the intuition but misses the machinery. In practice, zero-knowledge proofs are not about caves or doors. They are about polynomial commitments, elliptic curve pairings, and the mathematical properties that allow one party to encode a computation as a set of constraints and another party to verify that those constraints are satisfied without learning what values satisfied them.

This article explains what zero-knowledge proofs do, how the two dominant proof systems work, where they are deployed in production, and what they cannot do. If you have heard that zero-knowledge proofs solve all of blockchain’s privacy and scalability problems, the reality is more specific and more interesting.

The three properties

A zero-knowledge proof must satisfy three mathematical properties. Completeness means that if the statement is true and both the prover and verifier follow the protocol, the verifier will always accept the proof. Soundness means that if the statement is false, no cheating prover can convince the verifier to accept it, except with negligible probability. Zero-knowledge means the verifier learns nothing beyond whether the statement is true.

The third property is the counterintuitive one. How can you verify a computation without learning anything about it? The answer lies in the structure of the proof system. The prover encodes the computation as a polynomial equation, commits to that polynomial using a cryptographic commitment scheme, and then responds to random challenges from the verifier. The verifier checks the responses against the commitment without ever seeing the polynomial itself.

In non-interactive zero-knowledge proofs, which are the type used in blockchains, the random challenges are replaced by a hash function applied to the commitment. This is called the Fiat-Shamir heuristic, and it allows the prover to generate the entire proof without any back and forth communication. The resulting proof is a compact string of data that anyone can verify independently.

The mathematical foundation rests on the hardness of certain computational problems. For zk-SNARKs, security relies on the difficulty of computing discrete logarithms on elliptic curves. For zk-STARKs, security relies on the collision resistance of hash functions, which is considered a weaker and more conservative assumption. If either assumption turns out to be wrong, the corresponding proof system breaks. This is why the choice between zk-SNARKs and zk-STARKs involves tradeoffs beyond just proof size and verification speed.

zk-SNARKs: trusted setup, small proofs

zk-SNARK stands for Zero-Knowledge Succinct Non-interactive Argument of Knowledge. The word succinct is the key differentiator: a zk-SNARK proof is extremely small, typically a few hundred bytes, and can be verified in milliseconds regardless of how complex the underlying computation is.

The cost of this succinctness is the trusted setup. Most zk-SNARK constructions require an initial ceremony where a set of structured reference strings are generated. These strings are used by both provers and verifiers. If the random values used to generate them are not properly destroyed, anyone who retains them could create fake proofs that appear valid. This is sometimes called toxic waste.

Modern trusted setup ceremonies use multi-party computation protocols where hundreds or thousands of participants each contribute randomness. The security guarantee is that as long as at least one participant honestly destroys their random contribution, the setup is secure. Zcash pioneered this approach with its Powers of Tau ceremony, and subsequent projects have refined it.

Newer zk-SNARK constructions like PLONK and its variants use a universal and updatable trusted setup, meaning the same setup can be reused for different circuits and additional participants can strengthen the setup over time without starting from scratch. This mitigates the trusted setup concern but does not eliminate it entirely. The fundamental tradeoff remains: smaller, faster proofs in exchange for a one-time trust assumption.

zk-STARKs: no trusted setup, larger proofs

zk-STARK stands for Zero-Knowledge Scalable Transparent Argument of Knowledge. Transparent means no trusted setup is required. The reference strings are generated from publicly verifiable randomness, which eliminates the toxic waste problem entirely. Scalable refers to the fact that proving time grows quasi-linearly with the size of the computation, making STARKs suitable for very large computations.

The tradeoff is proof size. A zk-STARK proof is typically tens to hundreds of kilobytes, compared to a few hundred bytes for a zk-SNARK. On a blockchain where data storage is expensive, this difference matters. Verification time is also somewhat longer for STARKs, though still fast enough for practical use.

StarkWare, the company behind Starknet, has been the primary commercial advocate for zk-STARKs. Their argument is that the transparency property, combined with quantum resistance from relying only on hash functions rather than elliptic curves, makes STARKs the better long term choice even at the cost of larger proofs. Whether quantum computers will actually threaten elliptic curve cryptography within a relevant timeframe is debated, but the conservative security posture appeals to applications where long term robustness matters more than immediate efficiency.

ZK rollups: the scaling application

The most important practical application of zero-knowledge proofs in blockchain today is ZK rollups. A rollup executes transactions off chain, batches them together, generates a zero-knowledge proof that all transactions were valid, and posts just the proof and compressed transaction data to the main chain. The main chain verifies the proof, which is orders of magnitude cheaper than executing every transaction individually.

This architecture allows Ethereum layer 2 networks to process thousands of transactions for the cost of a single proof verification on layer 1. In practice, ZK rollups like those built on Ethereum infrastructure reduce gas costs by 90 percent or more compared to executing the same transactions directly on mainnet.

The major ZK rollup projects in production or late stage development as of mid 2026 include zkSync Era, Scroll, Polygon zkEVM, Linea, and Taiko. Each uses a different proving system and makes different tradeoffs between EVM compatibility, proving speed, and decentralization. zkSync uses a custom virtual machine and PLONK-based proofs. Scroll aims for byte-level EVM equivalence using a zk-SNARK prover. Polygon zkEVM uses a combination of STARK and SNARK proofs in a recursive architecture.

The competition between these projects is driving rapid innovation in proof generation. Proving times have dropped from hours to minutes to seconds over the past two years. Vitalik Buterin’s introduction of the GKR protocol for Ethereum represents another step toward making ZK proof verification a routine operation rather than a computational bottleneck.

Privacy applications beyond rollups

Zero-knowledge proofs were originally developed for privacy, not scalability. Zcash, launched in 2016, was the first major blockchain to use zk-SNARKs for private transactions. In a shielded Zcash transaction, the sender, receiver, and amount are all hidden from public view while the proof guarantees that no coins were created out of thin air and no double spending occurred.

The privacy application extends beyond financial transactions. Zero-knowledge proofs can verify identity attributes without revealing the underlying data. A user could prove they are over 18 without revealing their birth date, prove they are a citizen of a specific country without revealing their passport number, or prove they hold a certain credential without revealing which institution issued it.

Projects like Worldcoin and Polygon ID have implemented ZK-based identity verification systems. Worldcoin uses zero-knowledge proofs to verify that a person has been scanned by their iris scanning device without linking the scan to any specific identity. Ethereum ecosystem projects are increasingly integrating ZK-based identity as a primitive alongside financial transactions.

The privacy use case faces regulatory headwinds. Financial regulators in multiple jurisdictions have expressed concern that fully private transactions could facilitate money laundering, sanctions evasion, and terrorist financing. The tension between privacy as a fundamental right and transparency as a regulatory requirement is one of the defining policy debates in cryptocurrency, and zero-knowledge proofs sit directly at the center of it.

What zero-knowledge proofs do not cover

Zero-knowledge proofs guarantee computational integrity: that a specific computation was performed correctly. They do not guarantee that the inputs to the computation were correct, that the computation was worth performing, or that the system built around the proof is free of bugs.

A ZK rollup can prove that all transactions in a batch were valid according to the rollup’s rules. It cannot prove that the rules themselves are correct. A bug in the rollup’s smart contracts or proving circuit could produce valid proofs for invalid state transitions. Several ZK rollup projects have disclosed and patched critical bugs in their circuits during audits and testnet deployments.

Zero-knowledge proofs also do not eliminate the need for data availability. In a ZK rollup, the proof tells the main chain that the state transition was valid, but users still need access to the underlying transaction data to reconstruct the state and verify that their funds are intact. Without data availability, users must trust the rollup operator, which partially defeats the purpose of the proof.

The computational cost of generating proofs is substantial. While verification is cheap, proof generation requires significant hardware. Running a ZK prover at production scale typically requires servers with hundreds of gigabytes of RAM and specialized hardware accelerators. This cost creates a natural centralizing force in who can afford to run provers, even if the proofs themselves can be verified by anyone.

Practical checks for evaluating ZK projects

When evaluating a project that claims to use zero-knowledge proofs, several questions distinguish serious implementations from marketing.

First, ask whether the proof system has been independently audited. Circuit bugs can create soundness vulnerabilities where invalid proofs are accepted as valid. A project that has not been audited by multiple independent cryptography firms should be treated with caution.

Second, ask whether the proving system uses a trusted setup and, if so, how the ceremony was conducted. A trusted setup with only a small number of participants, or one conducted by a single company without external verification, represents a meaningful trust assumption.

Third, check whether the project publishes its proof verification contracts and whether those contracts have been verified on chain. If verification is happening off chain or through upgradeable proxy contracts controlled by a multisig, the zero-knowledge proofs may not be providing the security guarantees users expect.

Fourth, look at the data availability solution. If the project does not post transaction data on chain or to a credible data availability layer, users cannot independently verify the state and must trust the operator. This is a meaningful departure from the trustlessness that zero-knowledge proofs are supposed to enable.

Frequently asked questions

Disclaimer: This article is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency investments carry significant risk. Always conduct your own research before making any investment decisions. Information is accurate as of August 1, 2026.