Zero-knowledge proofs, explained without the cryptography

A zero-knowledge proof lets you prove a statement is true without revealing anything else about it. Not the password, not the balance, not the birthdate — just the fact that the statement holds. It's a way of proving the validity of a statement without disclosing the statement itself, and it's now running in production, from Ethereum layer 2s to age checks in Google Wallet. This guide explains what the proof actually claims, where you've likely already used one, and — the part most explainers skip — what it doesn't do for you.

Last updated: August 2026

What a zero-knowledge proof actually claims

Two roles, one claim. A prover wants to convince a verifier that something is true. The prover produces a proof. The verifier checks it and comes away convinced — without learning the underlying information.

The guarantee breaks into three properties, and they're worth reading as three separate promises:

Hold any "zero-knowledge" claim you meet against those three. If a system can't say what it proves, who checks it, and what the checker learns, the label is decoration.

The cave that explains it

The standard illustration is the Ali Baba cave. Peggy claims she knows the passphrase that opens a door at the back of a ring-shaped cave. Victor waits at the entrance while she walks down one of the two passages, then shouts which side he wants her to come back from.

If she really knows the passphrase, she can always comply — she opens the door and walks out either way. If she doesn't, she had a 50% chance of guessing the right passage, and she's caught the moment she can't cross. Run it twenty times and a bluffer's odds collapse to about one in a million (that's 0.5²⁰, arithmetic on the analogy rather than a property of any real system).

Victor ends up certain she knows the passphrase. He never hears it. That's the whole idea, and no equations were required to get there.

Why the verifier can't just be fooled

Because soundness is a property of the protocol, not a matter of trusting the prover. The cave shows the shape: each round cuts a cheater's chances, and enough rounds make cheating negligible.

Real systems get there without twenty rounds. Non-interactive proofs let the prover and verifier interact only once — which is what makes proofs usable on a blockchain, where the verifier is a smart contract that can't hold a conversation.

The payoff for blockchains is that checking a proof is far cheaper than redoing the work it stands for. That single fact is why ZK-rollups scale Ethereum, and it's the mechanism our rollup comparison assumes but doesn't unpack.

You've probably already used one

Zero-knowledge proofs stopped being a research topic some time ago. Two deployments are worth knowing, because they're so different from each other.

Proving your age without handing over your ID

In July 2025, Google open-sourced its zero-knowledge proof libraries for age assurance. The stated goal was that someone visiting a website could verifiably prove they're over 18 without sharing anything else at all. Not the birthdate, not the document number, not the name. Sparkasse was named as the first national credential partner for EU age assurance, and the code was published at github.com/google/longfellow-zk.

That's the clearest everyday version of the idea. The site needs one bit — over 18, yes or no — and until recently the only way to supply it was to hand over a document carrying far more.

Proving a whole batch of transactions

The crypto version proves something bigger: that thousands of transactions were executed correctly. A ZK-rollup processes transactions off-chain, generates a validity proof, and posts it to Ethereum, which verifies the proof instead of re-running the transactions.

This is live at scale. As of August 2026, 105 layer 2 projects are tracked publicly — 22 rollups, 6 validiums and optimiums, and 77 others — each running a named prover: Starknet runs Stwo with about $392.84M secured, ZKsync Era runs Boojum with about $227.33M, Linea holds about $432.84M, and Scroll runs OpenVM. Coin98 Super Wallet supports these networks directly, including Starknet and zkSync, so using one is a matter of switching networks rather than learning cryptography.

Worth noting for expectations: the largest L2s by value secured — Base at about $12.82B and Arbitrum One at about $11.33B — are optimistic rollups, not validity-proof systems. Zero-knowledge proofs lead on finality, not yet on total value.

SNARKs, STARKs, and the words you'll see

Two acronyms cover most of what you'll read, and the difference between them is a real trade-off rather than marketing.

SNARKs are succinct but depend on a setup ceremony. STARKs are transparent and immune to the quantum threat, at the cost of larger proofs and higher verification overheads. The construction underneath explains why: SNARKs use elliptic curves, which makes them more gas-efficient, while STARKs use hash functions, which is exactly what makes them resist quantum attack. They were introduced by Eli Ben-Sasson, a StarkWare co-founder.

The trusted setup is the part worth understanding. A SNARK needs public parameters generated once in a ceremony, and that process creates secret randomness that must be destroyed. If someone kept it, they could produce proofs that verify as valid for false statements.

Modern ceremonies spread the risk across many participants, and the assumption is deliberately weak: a single trustworthy participant is enough to make all of the resulting parameters secure. That's a low bar to clear — but it is an assumption, and it's why STARKs advertise transparency as a headline feature.

What a zero-knowledge proof doesn't do

It doesn't make you private by default, and this is where beginners most often go wrong.

A ZK-rollup is not a privacy chain. Most use validity proofs to prove correct execution, then publish transaction data openly. Scalability and privacy are two separate use cases for the technology, and the majority of production rollups pursue the first. Moving to a ZK-rollup makes your transaction cheaper and its finality faster. It doesn't hide it.

A privacy feature is not automatically a zero-knowledge proof. Coin98 Super Wallet's Private Send is a useful illustration: it routes through an intermediary asset so the sender and receiver addresses are never linked on-chain and never appear in the same transaction. That's unlinkability, not a cryptographic proof — the same goal reached by a different route. Private Swap works on the same principle. Knowing which mechanism a tool uses tells you what it protects and what it doesn't.

Proofs aren't free. Generating a proof is computationally heavy and can require expensive hardware, and verification still costs something on-chain. Succinctness is what makes the economics work — the proof is small and quick to check, so one expensive generation can be verified cheaply, repeatedly, by anyone.

"Zero knowledge" describes the protocol, not the whole product. The proof reveals nothing beyond validity. Everything around it — the app, the RPC endpoint, the metadata, the funding path — can still identify you. We'd suggest treating ZK as a strong guarantee about one narrow step rather than a privacy blanket over your activity.

Frequently asked questions

Is a zero-knowledge proof a type of encryption? No. Encryption hides data so it can be revealed later with a key. A zero-knowledge proof reveals nothing at all — it produces evidence that a statement is true, and the underlying data is never transmitted. You can encrypt something and later decrypt it; there is nothing to decrypt in a ZK proof.

Does using a ZK-rollup make my transactions private? Generally no. Most ZK-rollups use proofs for scaling and correctness, and publish transaction data publicly. Scalability and privacy are separate applications of the technology, and the large production rollups are built for the first.

What actually goes wrong if a trusted setup is compromised? Someone holding the secret randomness from the ceremony could generate proofs that verify as valid for false statements. It wouldn't expose past users' secrets, but it would break soundness — the promise that a false statement can't pass. This is why ceremonies are run across many participants, and why STARKs, which need no setup at all, treat transparency as their headline advantage.

Do I need to do anything differently as a user? Almost nothing. You add the network in a wallet that supports it and transact as usual. The practical difference you'll notice is withdrawal speed: our rollup comparison puts optimistic rollup withdrawals at around seven days because of the challenge period, against minutes to hours once a validity proof is posted.

Are zero-knowledge proofs unbreakable? The mathematics is well studied, but the implementations are software. Circuit bugs, faulty setup ceremonies, and flawed integrations are the realistic risks, not a break in the underlying theory. SNARKs are also considered vulnerable to future quantum computing, while STARKs are not.

The takeaway

A zero-knowledge proof makes three promises: valid statements pass, false ones don't, and the verifier learns nothing else. That's the whole concept, and you can evaluate almost any ZK claim against it without touching an equation. It's already proving ages in Google Wallet and securing hundreds of millions on Ethereum layer 2s — just don't mistake it for a privacy switch. If you want to try a ZK network, Coin98 Super Wallet supports Starknet and zkSync among the 100+ blockchains in its non-custodial mobile app, with your keys staying on your device.