What is a zero-knowledge proof? Privacy and scaling explained

A zero-knowledge proof lets one party prove to another that a statement is true without revealing any information beyond the truth of the statement itself. It is the cryptographic technique behind blockchain privacy, scalable rollups, and a growing number of identity verification systems.
Summary

• Zero-knowledge proofs allow a prover to convince a verifier that a computation was performed correctly without revealing the underlying data, enabling both privacy and scalability on blockchains.
• The two main families of zero-knowledge proofs used in blockchain are zk-SNARKs, which require an initial trusted setup ceremony, and zk-STARKs, which do not require trusted setup but produce larger proofs.
• Ethereum layer 2 rollups like zkSync, Scroll, and Polygon zkEVM use zero-knowledge proofs to compress thousands of transactions into a single proof verified on the main chain, reducing gas costs by 90 percent or more.
• Vitalik Buterin introduced the GKR protocol in late 2025 as a way to accelerate Ethereum zero-knowledge proof verification, aiming to make the technology practical for everyday use at scale.
• Zero-knowledge proofs are mathematically sound but not magic. They depend on specific cryptographic assumptions, require significant computational resources to generate, and have been deployed in production for less than three years at scale.

The standard explanation of zero-knowledge proofs uses the cave analogy. Ali Baba knows the secret word to open a door inside a circular cave. He can prove he knows the word by entering from one side and exiting from the other, on demand, without ever saying the word out loud. After enough successful demonstrations, the verifier becomes statistically certain Ali Baba knows the secret.

This analogy is correct but incomplete. It captures the intuition but misses the machinery. In practice, zero-knowledge proofs are not about caves or doors. They are about polynomial commitments, elliptic curve pairings, and the mathematical properties that allow one party to encode a computation as a set of constraints and another party to verify that those constraints are satisfied without learning what values satisfied them.

This article explains what zero-knowledge proofs do, how the two dominant proof systems work, where they are deployed in production, and what they cannot do. If you have heard that zero-knowledge proofs solve all of blockchain's privacy and scalability problems, the reality is more specific and more interesting.

The three properties

A zero-knowledge proof must satisfy three mathematical properties. Completeness means that if the statement is true and both the prover and verifier follow the protocol, the verifier will always accept the proof. Soundness means that if the statement is false, no cheating prover can convince the verifier to accept it, except with negligible probability. Zero-knowledge means the verifier learns nothing beyond whether the statement is true.

The third property is the counterintuitive one. How can you verify a computation without learning anything about it? The answer lies in the structure of the proof system. The prover encodes the computation as a polynomial equation, commits to that polynomial using a cryptographic commitment scheme, and then responds to random challenges from the verifier. The verifier checks the responses against the commitment without ever seeing the polynomial itself.

In non-interactive zero-knowledge proofs, which are the type used in blockchains, the random challenges are replaced by a hash function applied to the commitment. This is called the Fiat-Shamir heuristic, and it allows the prover to generate the entire proof without any back and forth communication. The resulting proof is a compact string of data that anyone can verify independently.

The mathematical foundation rests on the hardness of certain computational problems. For zk-SNARKs, security relies on the difficulty of computing discrete logarithms on elliptic curves. For zk-STARKs, security relies on the collision resistance of hash functions, which is considered a weaker and more conservative assumption. If either assumption turns out to be wrong, the corresponding proof system breaks. This is why the choice between zk-SNARKs and zk-STARKs involves tradeoffs beyond just proof size and verification speed.

🚀 @VitalikButerin introduces GKR protocol verifying 2M calculations per second reducing proof work from 100x to 10-15x as Ethereum launches 47-member Privacy Cluster.#Ethereum #Privacyhttps://t.co/Z5kIh35LQ8 --- Cryptonews.com (@cryptonews) October 20, 2025

zk-SNARKs: trusted setup, small proofs

zk-SNARK stands for Zero-Knowledge Succinct Non-interactive Argument of Knowledge. The word succinct is the key differentiator: a zk-SNARK proof is extremely small, typically a few hundred bytes, and can be verified in milliseconds regardless of how complex the underlying computation is.

The cost of this succinctness is the trusted setup. Most zk-SNARK constructions require an initial ceremony where a set of structured reference strings are generated. These strings are used by both provers and verifiers. If the random values used to generate them are not properly destroyed, anyone who retains them could create fake proofs that appear valid. This is sometimes called toxic waste.

Modern trusted setup ceremonies use multi-party computation protocols where hundreds or thousands of participants each contribute randomness. The security guarantee is that as long as at least one participant honestly destroys their random contribution, the setup is secure. Zcash pioneered this approach with its Powers of Tau ceremony, and subsequent projects have refined it.

Newer zk-SNARK constructions like PLONK and its variants use a universal and updatable trusted setup, meaning the same setup can be reused for different circuits and additional participants can strengthen the setup over time without starting from scratch. This mitigates the trusted setup concern but does not eliminate it entirely. The fundamental tradeoff remains: smaller, faster proofs in exchange for a one-time trust assumption.

zk-STARKs: no trusted setup, larger proofs

zk-STARK stands for Zero-Knowledge Scalable Transparent Argument of Knowledge. Transparent means no trusted setup is required. The reference strings are generated from publicly verifiable randomness, which eliminates the toxic waste problem entirely. Scalable refers to the fact that proving time grows quasi-linearly with the size of the computation, making STARKs suitable for very large computations.

The tradeoff is proof size. A zk-STARK proof is typically tens to hundreds of kilobytes, compared to a few hundred bytes for a zk-SNARK. On a blockchain where data storage is expensive, this difference matters. Verification time is also somewhat longer for STARKs, though still fast enough for practical use.

StarkWare, the company behind Starknet, has been the primary commercial advocate for zk-STARKs. Their argument is that the transparency property, combined with quantum resistance from relying only on hash functions rather than elliptic curves, makes STARKs the better long term choice even at the cost of larger proofs. Whether quantum computers will actually threaten elliptic curve cryptography within a relevant timeframe is debated, but the conservative security posture appeals to applications where long term robustness matters more than immediate efficiency.
You might also like: Zero-knowledge proof: a complete guide to the privacy-focused layer 1 blockchain

ZK rollups: the scaling application

The most important practical application of zero-knowledge proofs in blockchain today is ZK rollups. A rollup executes transactions off chain, batches them together, generates a zero-knowledge proof that all transactions were valid, and posts just the proof and compressed transaction data to the main chain. The main chain verifies the proof, which is orders of magnitude cheaper than executing every transaction individually.

This architecture allows Ethereum layer 2 networks to process thousands of transactions for the cost of a single proof verification on layer 1. In practice, ZK rollups like those built on Ethereum infrastructure reduce gas costs by 90 percent or more compared to executing the same transactions directly on mainnet.

The major ZK rollup projects in production or late stage development as of mid 2026 include zkSync Era, Scroll, Polygon zkEVM, Linea, and Taiko. Each uses a different proving system and makes different tradeoffs between EVM compatibility, proving speed, and decentralization. zkSync uses a custom virtual machine and PLONK-based proofs. Scroll aims for byte-level EVM equivalence using a zk-SNARK prover. Polygon zkEVM uses a combination of STARK and SNARK proofs in a recursive architecture.

The competition between these projects is driving rapid innovation in proof generation. Proving times have dropped from hours to minutes to seconds over the past two years. Vitalik Buterin's introduction of the GKR protocol for Ethereum represents another step toward making ZK proof verification a routine operation rather than a computational bottleneck.

🚀 Vitalik Buterin says Ethereum solved blockchain's trilemma with ZKEVMs and PeerDAS technology now running on mainnet after decade-long development.#Ethereum #Buterinhttps://t.co/cUzlhhO6Xr --- Cryptonews.com (@cryptonews) January 4, 2026

Privacy applications beyond rollups

Zero-knowledge proofs were originally developed for privacy, not scalability. Zcash, launched in 2016, was the first major blockchain to use zk-SNARKs for private transactions. In a shielded Zcash transaction, the sender, receiver, and amount are all hidden from public view while the proof guarantees that no coins were created out of thin air and no double spending occurred.

The privacy application extends beyond financial transactions. Zero-knowledge proofs can verify identity attributes without revealing the underlying data. A user could prove they are over 18 without revealing their birth date, prove they are a citizen of a specific country without revealing their passport number, or prove they hold a certain credential without revealing which institution issued it.

Projects like Worldcoin and Polygon ID have implemented ZK-based identity verification systems. Worldcoin uses zero-knowledge proofs to verify that a person has been scanned by their iris scanning device without linking the scan to any specific identity. Ethereum ecosystem projects are increasingly integrating ZK-based identity as a primitive alongside financial transactions.

The privacy use case faces regulatory headwinds. Financial regulators in multiple jurisdictions have expressed concern that fully private transactions could facilitate money laundering, sanctions evasion, and terrorist financing. The tension between privacy as a fundamental right and transparency as a regulatory requirement is one of the defining policy debates in cryptocurrency, and zero-knowledge proofs sit directly at the center of it.

What zero-knowledge proofs do not cover

Zero-knowledge proofs guarantee computational integrity: that a specific computation was performed correctly. They do not guarantee that the inputs to the computation were correct, that the computation was worth performing, or that the system built around the proof is free of bugs.

A ZK rollup can prove that all transactions in a batch were valid according to the rollup's rules. It cannot prove that the rules themselves are correct. A bug in the rollup's smart contracts or proving circuit could produce valid proofs for invalid state transitions. Several ZK rollup projects have disclosed and patched critical bugs in their circuits during audits and testnet deployments.

Zero-knowledge proofs also do not eliminate the need for data availability. In a ZK rollup, the proof tells the main chain that the state transition was valid, but users still need access to the underlying transaction data to reconstruct the state and verify that their funds are intact. Without data availability, users must trust the rollup operator, which partially defeats the purpose of the proof.

The computational cost of generating proofs is substantial. While verification is cheap, proof generation requires significant hardware. Running a ZK prover at production scale typically requires servers with hundreds of gigabytes of RAM and specialized hardware accelerators. This cost creates a natural centralizing force in who can afford to run provers, even if the proofs themselves can be verified by anyone.

Practical checks for evaluating ZK projects

When evaluating a project that claims to use zero-knowledge proofs, several questions distinguish serious implementations from marketing.

First, ask whether the proof system has been independently audited. Circuit bugs can create soundness vulnerabilities where invalid proofs are accepted as valid. A project that has not been audited by multiple independent cryptography firms should be treated with caution.

Second, ask whether the proving system uses a trusted setup and, if so, how the ceremony was conducted. A trusted setup with only a small number of participants, or one conducted by a single company without external verification, represents a meaningful trust assumption.

Third, check whether the project publishes its proof verification contracts and whether those contracts have been verified on chain. If verification is happening off chain or through upgradeable proxy contracts controlled by a multisig, the zero-knowledge proofs may not be providing the security guarantees users expect.

Fourth, look at the data availability solution. If the project does not post transaction data on chain or to a credible data availability layer, users cannot independently verify the state and must trust the operator. This is a meaningful departure from the trustlessness that zero-knowledge proofs are supposed to enable.

🚀 Ethereum developers have activated the Pectra upgrade on Hoodi, marking another milestone in preparation for its mainnet deployment.#Ethereum #ETHhttps://t.co/eALuuC2dgk --- Cryptonews.com (@cryptonews) March 27, 2025
Read more: What is zero-knowledge proof? A deep dive into the math behind zk-SNARKs

Frequently asked questions

What is a zero-knowledge proof in simple terms? {#faq-question-1722480001}

A zero-knowledge proof is a way to prove you know something without revealing what you know. In blockchain, it allows one computer to prove to another that a set of transactions is valid without showing the details of those transactions. This enables both privacy and scalability.

What is the difference between zk-SNARKs and zk-STARKs? {#faq-question-1722480002}

zk-SNARKs produce very small proofs, typically a few hundred bytes, and verify quickly, but require a one-time trusted setup ceremony. zk-STARKs produce larger proofs, typically tens of kilobytes, but do not require any trusted setup and are considered resistant to quantum computing attacks. Both achieve the same goal of verifiable computation with zero knowledge.

How do ZK rollups reduce Ethereum gas costs? {#faq-question-1722480003}

ZK rollups execute transactions off the Ethereum main chain, batch them together, and generate a zero-knowledge proof that all transactions are valid. Only the proof and compressed data are posted to Ethereum. Verifying a single proof is much cheaper than executing thousands of individual transactions, resulting in gas cost reductions of 90 percent or more.

Are zero-knowledge proofs quantum resistant? {#faq-question-1722480004}

It depends on the proof system. zk-STARKs rely on hash functions, which are believed to be resistant to quantum computers. zk-SNARKs rely on elliptic curve cryptography, which could theoretically be broken by a sufficiently powerful quantum computer. However, practical quantum computers capable of breaking elliptic curves do not yet exist and may not for decades.

Can zero-knowledge proofs make all blockchain transactions private? {#faq-question-1722480005}

Technically yes, but practically there are tradeoffs. Generating proofs for every transaction adds computational cost and complexity. Fully private transactions also face regulatory challenges in jurisdictions that require financial transparency. Projects like Zcash offer optional privacy, while most ZK rollups use the technology primarily for scalability rather than privacy.

What is a trusted setup and why does it matter? {#faq-question-1722480006}

A trusted setup is a one-time ceremony that generates cryptographic parameters needed by certain proof systems. If the random values used during the ceremony are not properly destroyed, someone could create fake proofs. Modern ceremonies use multi-party computation where hundreds of participants contribute randomness, and the setup is secure as long as at least one participant is honest.

Which blockchains use zero-knowledge proofs? {#faq-question-1722480007}

Zcash was the first major blockchain to use zero-knowledge proofs for private transactions. Ethereum uses ZK proofs through layer 2 rollups including zkSync, Scroll, Polygon zkEVM, Linea, and Starknet. Mina Protocol uses recursive ZK proofs to maintain a fixed-size blockchain. Several other chains incorporate ZK technology for specific features like identity verification or cross-chain messaging.

How long does it take to generate a zero-knowledge proof? {#faq-question-1722480008}

Proof generation time depends on the complexity of the computation and the hardware used. For ZK rollup batches containing thousands of transactions, proof generation currently takes seconds to minutes on specialized hardware. Two years ago, the same proofs took hours. The trend is toward faster proving through hardware acceleration and algorithmic improvements, with the goal of real-time proof generation.

Disclaimer: This article is for informational purposes only and does not constitute financial, investment, or legal advice. Cryptocurrency investments carry significant risk. Always conduct your own research before making any investment decisions. Information is accurate as of August 1, 2026.