What is a zero-knowledge proof? Explained simply, with a game you can play

A zero-knowledge proof is a way to convince someone that a statement is true without showing them anything except that it’s true. The checker ends up sure, and learns nothing they could repeat, such as your password, your birth date or which account is yours.

It’s already moving real money. On 15 October 2026, L2BEAT counted about $3.8 billion secured by the 12 ZK rollups it tracks on Ethereum, networks that use these proofs to show a whole batch of transactions was processed correctly.

I’m Mo Tawfik Khalifa. I designed a zero-knowledge ID for players at PLAYERUNKNOWN Productions, and I’ve led identity products where the right answer was no zero-knowledge at all. The long story of those builds is in How to prove who someone is without seeing who they are. This is the plain answer, with a proof you can run yourself.

What is a zero-knowledge proof?

There are always two sides. The prover knows a secret. The verifier wants to be sure the prover knows it, without hearing it.

The idea comes from a 1985 paper by Shafi Goldwasser, Silvio Micali and Charles Rackoff, The Knowledge Complexity of Interactive Proof-Systems. Their question was how much a checker learns from a proof beyond the fact that it’s true. Their answer: it can be nothing. Goldwasser and Micali won the Turing Award, computing’s top prize, partly for this work.

How does a zero-knowledge proof work? The magic door

The classic explanation is a cave from How to Explain Zero-Knowledge Protocols to Your Children, by Jean-Jacques Quisquater, Louis Guillou and Thomas Berson. The cave is a ring. One entrance splits into a left and a right passage, and they meet at a door at the far end that opens only for the magic words.

1. You wait outside. The prover walks into the left or the right passage. You can’t see which.
2. You shout which side they should come out of.
3. If they know the words, they always can: they walk back, or go through the door.
4. If they’re bluffing, they only make it when they happened to pick the side you call. That’s 1 chance in 2.
5. Repeat. A bluffer survives 10 rounds 1 time in 1,024, and 40 rounds about once in a million million.

You end up sure, and you never hear the words. Try it.

The tape at the end is the clever part. In the paper, a rival reporter films a bluffer, cuts out every failed scene, and ends up with a tape nobody can tell from the real one. So a recording proves nothing to anyone else. That’s what “zero knowledge” means in the maths: anything the checker saw, they could have faked without the secret.

What are the three properties of a zero-knowledge proof?

Every one must pass three tests, and the cave shows all three.

1. Completeness. If the statement is true and both sides follow the rules, the checker is convinced. Someone who knows the words always comes out the right side.
2. Soundness. If the statement is false, a cheater gets caught, except with a tiny chance you can make as small as you like. Each round halves a bluffer’s luck.
3. Zero-knowledge. The checker learns nothing except that the statement is true. The fake tape looks just like the real one.

Soundness only works if the checker’s questions are unpredictable. Shout “left” every time in the game above with Alex at the cave and see what happens. That’s why the reporter in the story flipped a coin.

What is the difference between interactive and non-interactive proofs?

The cave is interactive: you have to be there, asking questions live. Fine for one checker, useless for a blockchain that thousands of computers check later.

A non-interactive proof is one message anyone can check, any time. In 1986 Amos Fiat and Adi Shamir published the trick most systems still use: the prover works out the “coin flips” from a hash of everything said so far, so nobody has to flip them live. In 1988 Manuel Blum, Paul Feldman and Silvio Micali showed non-interactive zero-knowledge proofs work when both sides share a random string set up in advance. That shared setup comes back below as a cost.

What are zk-SNARKs and zk-STARKs?

They are the two main families of non-interactive proofs in use today.

• zk-SNARKs make tiny proofs that are quick to check. In Jens Groth’s widely used 2016 design, a proof is only three group elements, a few short numbers. Most need a trusted setup: a one-off ceremony that makes the shared random string. If the secret left over from it isn’t destroyed, someone could forge proofs.
• zk-STARKs, from Eli Ben-Sasson and colleagues in 2018, are “transparent”: no trusted setup, only public randomness. Ethereum’s developer docs say they are also safe against quantum computers, while the maths under most SNARKs is not. The price is bigger proofs that cost more to check on-chain.

The line is blurring. Zcash, a private payments network, moved to a proving system called Halo 2 in May 2022 to remove its trusted setup.

Where are zero-knowledge proofs used today?

1. Age and identity checks. Google open-sourced its zero-knowledge libraries in July 2025 so a person can prove they’re over 18 “without sharing anything else at all”. The EU’s age verification blueprint has included zero-knowledge proofs since October 2025, and Denmark, France, Greece, Italy and Spain are building national apps on it. How that compares with ID uploads and face scans is in How to prove you’re over 18 without showing your ID.
2. Blockchain rollups. A ZK rollup runs a batch of transactions off the main chain and posts a summary plus a proof that every one of them followed the rules. Ethereum checks the proof instead of redoing the work.
3. Private payments. A normal payment on a public blockchain, like most stablecoin transfers, shows both addresses and the amount to anyone. Zcash’s shielded payments are encrypted on the chain yet still checked as valid.
4. Players and accounts. At PLAYERUNKNOWN Productions, my design let a player prove “I’m a registered player and I hold this item” without the game learning which player or which wallet. The full build is here.

What can a zero-knowledge proof prove, and what can’t it?

It can prove almost any statement a computer could check if it had the secret. In 1991 Oded Goldreich, Silvio Micali and Avi Wigderson showed that every such statement has a zero-knowledge proof: “this number is over 18”, “I know the password to this account”, “these 5,000 payments add up”.

What it can’t do:

• Make bad data true. A proof that a signed card says “over 18” is only as good as whoever signed the card.
• Stop one person getting two IDs. That’s decided when IDs are handed out, not in the proof.
• Hide everything around it. Your internet address, your device and a site that asks for too much are still there, as the EFF points out.

What does a zero-knowledge proof cost?

Checking is cheap. Making the proof is not. Ethereum’s docs say the cost of computing validity proofs is substantial, can raise fees, and needs specialised hardware, and that a mishandled trusted setup could compromise a rollup’s security.

The cost I’d plan for as a product lead is people. The statement has to be written as a “circuit”, a program the proof system understands, and a mistake there means proofs of the wrong thing still check out. That needs specialists and an outside audit before launch.

When do you not need a zero-knowledge proof?

Skip it in any of these four cases.

1. The checker must know who you are. A hospital can’t hire an anonymous nurse. In the credential passport for clinicians I led, the licence is checked once at the source and the clinician picks which fields each employer sees, with no zero-knowledge part.
2. A signed answer is enough. If the site only needs “over 18: yes” from a trusted issuer, a verifiable credential with selective disclosure does the job with less engineering.
3. The checker already holds the data. Your bank doesn’t need a proof of your balance.
4. Nothing private is at stake. An ordinary signature proves a file wasn’t changed.

Reach for zero-knowledge when the checker must be sure of a fact and must not be able to link it to a person or reuse it.

Questions people ask

Who invented zero-knowledge proofs?

Shafi Goldwasser, Silvio Micali and Charles Rackoff, in a paper presented in 1985.

Is a zero-knowledge proof the same as encryption?

No. Encryption hides a message so only the key holder can read it. A zero-knowledge proof convinces someone a statement about hidden data is true, and they never read the data.

Can a zero-knowledge proof be faked?

Only with luck or broken maths. In the cave, a bluffer passes 40 fair rounds about once in a million million. Non-interactive systems set that chance far lower, and a SNARK can be forged if its trusted setup leaked.

Are zero-knowledge proofs quantum safe?

STARKs are believed to be. Most SNARKs rest on elliptic curve maths that a large quantum computer is widely believed able to break.

Do you build this?

Yes. I design identity and privacy products end to end, and decide where zero-knowledge earns its cost, as a fractional CPO or hands on. If you need this built, write to m@tawfik.tv.