What is a zero-knowledge proof, and how can you prove something without revealing it?
Zero-knowledge proofs let one party convince another that a statement is true while revealing nothing else. Here is how that trick works and why blockchains care about it.
The short answer
A zero-knowledge proof is a cryptographic method that lets a prover convince a verifier that a statement is true without revealing anything beyond that fact. Blockchains use them to hide transaction details and to check large batches of transactions with one small proof.
Key takeaways
- A zero-knowledge proof shows that a statement is true without disclosing the secret behind it, such as a password or the details of a payment.
- Every zero-knowledge protocol needs three properties: completeness, soundness and zero-knowledge.
- The idea was formalised by Goldwasser, Micali and Rackoff in a 1985 paper, and Goldwasser and Micali later shared a Turing Award.
- In crypto, zero-knowledge proofs power private transactions and ZK-rollups, which prove a whole batch of transactions was executed correctly.
- The technology has real costs and trade-offs: expensive proof generation, setup ceremonies for some systems, and possible future quantum threats.
What is a zero-knowledge proof, in plain terms?
A zero-knowledge proof (ZKP) is a way for one party, the prover, to convince another party, the verifier, that a statement is true without handing over any information except the fact that it is true1. The U.S. National Institute of Standards and Technology (NIST) describes it in similar terms: proving a mathematical statement while revealing nothing extra that might have helped find the answer4.
The secret the prover holds is called the witness. It might be a password, a private key or the inputs to a calculation. The goal is to show you know the witness, or that it satisfies some rule, without ever showing the witness itself.
A classic teaching story, used on ethereum.org, involves a ring-shaped cave with a locked door in the middle1. Peggy claims she knows the phrase that opens the door. She walks in down one of two paths while Victor waits outside, then Victor shouts which path she must return by. If Peggy knows the phrase, she can always comply. A bluffer only succeeds when Victor happens to name the path she already took. Repeat the game many times and a bluffer is almost certain to be caught, yet Victor never hears the phrase.
Figure · One round of an interactive proof
- 01Prover holds witnessthe secret, never sent
- 02Verifier challengesa random question
- 03Prover respondsanswer only works if true
- 04Repeat many roundsluck stops being enough
- 05Verifier acceptslearns only: it is true
Each round has the same shape: witness, random challenge, response. Repeating it lowers the chance that a dishonest prover gets lucky every time1.
What makes a proof "zero-knowledge"?
Not every clever proof qualifies. A zero-knowledge protocol has to satisfy three properties at once1:
The three properties every zero-knowledge protocol needs Source: [1]
| Property | What it means | In the cave story |
|---|---|---|
| Completeness | An honest prover with a valid witness always convinces the verifier | Peggy, who knows the phrase, always returns on the requested path |
| Soundness | A prover without a valid witness cannot convince the verifier, except with negligible probability | A bluffer fails roughly half the rounds and is soon exposed |
| Zero-knowledge | The verifier learns nothing beyond whether the statement is true | Victor never hears the magic phrase |
Goldwasser and Micali made the last property precise in an elegant way. Roughly, the verifier gains no knowledge if it could have produced a realistic-looking version of the conversation on its own, without the prover3. If you could fake the exchange yourself, the real one taught you nothing new.
Where did zero-knowledge proofs come from?
The concept comes from academic computer science, not from crypto. Shafi Goldwasser, Silvio Micali and Charles Rackoff introduced it in a 1985 paper titled "The knowledge complexity of interactive proof systems"1, published in the SIAM Journal on Computing in 19892. Their starting point: an ordinary proof usually reveals far more than the single fact it proves2.
Figure · Milestones in zero-knowledge proofs
- 1985Goldwasser, Micali and Rackoff paper
- 1989Journal version in SIAM J. Computing
- 2012Turing Award to Goldwasser and Micali
- 2019NIST begins work with ZKProof
- May 2022Zcash adopts Halo 2 (no trusted setup)
Goldwasser and Micali received the 2012 ACM A.M. Turing Award for laying the complexity-theoretic foundations of modern cryptography3. Standards work came much later: NIST collaborated with the ZKProof community initiative between 2019 and 2024 on shared reference material4.
What is the difference between zk-SNARKs and zk-STARKs?
Two families of non-interactive proofs dominate blockchain use. A zk-SNARK is a Zero-Knowledge Succinct Non-Interactive Argument of Knowledge. A zk-STARK is a Zero-Knowledge Scalable Transparent Argument of Knowledge1. Both produce a proof that is much quicker to check than redoing the original computation, but they make different trade-offs.
zk-SNARKs and zk-STARKs compared Source: [1]
| Feature | zk-SNARK | zk-STARK |
|---|---|---|
| Setup | Usually needs a trusted setup ceremony | No trusted setup; uses public randomness |
| Proof size | Small | Larger |
| Underlying maths | Often elliptic-curve cryptography | Collision-resistant hash functions |
| Quantum computers | Could be vulnerable | Considered resistant |
The trusted setup is the awkward part of many SNARKs. Public parameters are generated from secret random numbers, and anyone who kept those numbers could create false proofs that still look valid5. Zcash, which describes itself as the first widespread application of zk-SNARKs, ran two multi-party ceremonies so that no single participant held the whole secret5. Its May 2022 upgrade added Halo 2, a newer SNARK design that does not need a trusted setup5.
How do blockchains use zero-knowledge proofs?
Public blockchains are transparent by design: anyone can read every transaction. Zero-knowledge proofs let a network check that the rules were followed without everyone seeing the details. Three uses stand out.
- Private payments. Zcash's shielded transactions stay encrypted on the chain, hiding the sender, the receiver and the amount, while the network still verifies that they are valid5.
- Scaling with ZK-rollups. A ZK-rollup executes batches of transactions off the main chain, then posts a validity proof showing the new state really is the result of those transactions6. Because the proof settles correctness, funds can leave the rollup once the proof is verified, without the challenge period optimistic rollups use6. Our explainer on layer 2 rollups covers both designs.
- Identity and access. A person could prove they hold a valid credential, such as citizenship, without revealing a passport number or tax ID1.
How a ZK-rollup uses a proof, step by step
What are the limits and risks of zero-knowledge proofs?
Zero-knowledge proofs are powerful mathematics, but they are not free and not magic. Generating proofs takes specialised, expensive hardware, a cost that can reach users1. Checking a proof on a blockchain also costs fees: ethereum.org estimates that ZK-rollups pay roughly 500,000 gas to verify a single zk-SNARK proof on Ethereum1. Systems with a trusted setup depend on the ceremony having been run honestly, and SNARKs built on elliptic curves could one day be broken by quantum computers1.
A proof also covers only the statement it was built for. Bugs in the surrounding smart contracts, or in how a wallet handles your keys, sit outside the maths.
Common beginner mistakes
Thinking "zero-knowledge" means anonymous
A proof can hide one detail while your address, timing or the platform you use still reveals a lot. Privacy depends on the whole system.
Assuming a ZK label means safe
Projects use "ZK" as a marketing term. The proof can be sound while the code around it has bugs or admin controls.
Ignoring the setup
For SNARK systems, ask how the parameters were generated. A compromised setup could allow false proofs that look valid.
Confusing proof with encryption
Encryption hides data so only the key holder can read it. A zero-knowledge proof convinces someone a statement about data is true. Systems often use both.
Risk warning
Technology is not a safety rating
Advanced cryptography does not protect you from smart contract bugs, scams or losses on crypto-assets, which are highly volatile. Privacy tools may also be restricted where you live. Read our risk disclosure before using any crypto service.
Frequently asked questions
Is a zero-knowledge proof the same as encryption?
No. Encryption scrambles data so only someone with the key can read it. A zero-knowledge proof convinces a verifier that a statement about some data is true without showing the data. Privacy systems such as Zcash's shielded transactions combine both5.
Can a zero-knowledge proof ever be wrong?
Soundness means a cheater can only pass with negligible probability, not zero probability1. In practice the bigger risks are bugs in the software, a flawed trusted setup or a proof that checks the wrong statement.
Who invented zero-knowledge proofs?
Why do ZK-rollups allow faster withdrawals than optimistic rollups?
A ZK-rollup's contract on Ethereum verifies a validity proof, so exits can be processed once the proof is accepted6. Optimistic rollups assume transactions are valid and leave time for anyone to challenge them before funds are released.
The bottom line
A zero-knowledge proof answers one narrow question, "is this statement true?", without leaking the secret behind it. That property, defined by academic cryptographers in the 1980s, now underpins private payments and ZK-rollups. It is strong mathematics with real costs and trade-offs, and it secures only what it was built to prove, so the software and people around the proof still matter.
Sources
- Zero-knowledge proofs — ethereum.org (Ethereum Foundation) Primary source
- The Knowledge Complexity of Interactive Proof Systems (SIAM Journal on Computing 18(1), 186–208) — Society for Industrial and Applied Mathematics, 1989 Primary source
- Shafi Goldwasser: ACM A.M. Turing Award (2012) — Association for Computing Machinery, 2012 Primary source
- Privacy-Enhancing Cryptography: Zero-Knowledge Proofs — NIST Computer Security Resource Center Primary source
- What are zk-SNARKs? — Zcash (official project documentation) Primary source
- Zero-knowledge rollups — ethereum.org developer documentation Primary source
How we checked this page: every figure above links to the numbered source it came from. Spotted an error? Tell the desk — see our editorial policy.
Read next
Tech · ExplainerWhat are layer 2 rollups, and how do optimistic and ZK rollups differ?Rollups move most of the work off Ethereum's main chain but still lean on it for security. Here is how the two main designs work and what each asks you to trust.
Tech · ExplainerWhat is a smart contract, and what can go wrong with one?A smart contract is a program that lives on a blockchain and runs exactly as written. That makes it powerful, and it is also why a single bug can be so costly.
Tech · ExplainerHow do crypto wallets and private keys work, and what happens if you lose them?A crypto wallet does not hold coins. It holds the secret that proves you control them. Understanding that one idea explains almost every way people keep, and lose, crypto.
Tech · ExplainerHow does a blockchain work, and why is it so hard to change?A blockchain is a shared record book that thousands of computers keep in sync without a boss. Here is how the pieces fit together, from a single transaction to a chain of blocks.
Policy · ExplainerHow do sanctions apply to crypto? OFAC, wallet addresses and the Tornado Cash caseSanctions law does not care whether money moves through a bank or a blockchain. Here is how the US Treasury applies it to crypto, and why the Tornado Cash case became a test of its limits.
Fintech · ExplainerWhat are KYC and AML, and why does every financial app want your ID?Uploading a passport photo to open an account can feel intrusive. It is the visible end of a global rulebook designed to stop criminals from moving money through the financial system.