How zcash shielded transactions use zero knowledge proofs

02 September 2026

Zcash offers something most cryptocurrencies do not: the ability to prove a transaction is valid while revealing none of its details. This is done through zero-knowledge proofs, a cryptographic method that lets one party prove a statement true without revealing why it is true. In Zcash, that statement is "I have the right to spend these coins," and the proof convinces the network without exposing the sender, receiver, or amount.

Zero-knowledge proofs are not the only way to hide transaction data. Monero uses ring signatures to obscure the sender, stealth addresses to hide the receiver, and confidential transactions to mask amounts. Zcash takes a different path: a single cryptographic proof that simultaneously validates everything required for a legitimate transaction. There is no need to mix with other users' outputs or generate decoy inputs. The proof itself ensures correctness.

Zcash has gone through three generations of its shielded protocol. Sprout launched in 2016 and was the first implementation. It used zk-SNARKs, a form of zero-knowledge proof that required a trusted setup. That setup generated a proving key and verification key from a multi-party computation. If any party destroyed their share of the toxic waste - the randomness used in setup - the system remained secure. If all colluded, fake coins could be created. This was a genuine concern, and Sprout's performance was poor: transactions were large and slow.

Sapling arrived in 2018. It improved efficiency dramatically. Shielded transactions became faster and cheaper, and the proving key was smaller. Sapling also introduced a new type of address, the shielded address, which uses a different cryptographic construction. The trusted setup was still required, but it was redesigned to reduce risk. Fewer participants were needed, and the process was simpler to verify. Still, the reliance on a trusted setup remained a criticism.

Orchard launched in 2022 with the NU5 upgrade. It replaced zk-SNARKs with Halo 2, a zero-knowledge proof system that eliminates the trusted setup entirely. No ceremony is needed. No toxic waste exists. Orchard uses a different proving system that relies on a universal, updatable setup. This is a fundamental shift. It removes a long-standing attack surface.

The anonymity set in Zcash depends on which pool coins are in. Shielded transactions use full-chain membership proofs. This means the proof references every shielded note ever created on the chain. The anonymity set is therefore all shielded users, not just a subset. If only a small fraction of users shield their coins, the set is small. If adoption grows, so does the privacy protection.

There is a persistent misconception that all Zcash transactions are shielded. They are not. By default, most wallets send transparent transactions. Transparent transactions work like Bitcoin: every detail is public. To use shielded addresses, the user must opt in. This has been a consistent weakness. Most Zcash users have never sent a shielded transaction. The privacy pool is therefore smaller than the total user base.

Unified addresses are the current standard. They combine transparent, Sapling, and Orchard addresses into a single string. A wallet can derive which type to use based on what the receiver supports. This simplifies usability, but it does not force privacy. The sender must still choose to use a shielded address.

Zcash's design is technically elegant. The zero-knowledge proof guarantees correctness without disclosure. But privacy is not the default. The user must decide to use it. And the size of the anonymity set depends on how many make that choice. The trusted setup is gone in Orchard, but the broader adoption problem remains.

Back to privacy coins