Our beginner's guide covers what Zcash is. This one goes a layer deeper — how it actually works under the hood.
A ledger of unspent outputs, like Bitcoin
Zcash uses the same basic accounting model as Bitcoin: a UTXO (unspent transaction output) ledger, rather than the account-balance model used by chains like Ethereum. Every transaction consumes existing outputs and creates new ones. Zcash's shielded pool extends this model with encrypted "notes" instead of plaintext outputs — same underlying idea, hidden contents.
Two parallel systems: transparent and shielded
A Zcash transaction can spend from and pay to transparent addresses (public, like Bitcoin), shielded addresses (private, via zk-SNARKs), or both in the same transaction. The network's consensus rules verify every transaction the same way regardless of type — shielded transactions just replace plaintext amounts and addresses with a zero-knowledge proof plus encrypted data only the recipient can read. You can see this split yourself: look up any transparent address or transaction in the ZecZcash Explorer and its balance and history are right there, while a shielded transaction reveals only that it happened.
The proof system has changed three times
The cryptography behind Zcash's shielded pool isn't static — it's been upgraded three times since launch:
- Sprout (2016 launch) used the original Zerocash-derived proving system. It worked, but proof generation could take over a minute and required significant memory — impractical on mobile devices.
- Sapling (2018) switched to a more efficient proving system (Groth16) and a redesigned circuit, cutting proof time to seconds. This is what made mobile shielded wallets realistic.
- Orchard (2022, with NU5) moved to Halo 2, a proving system that removes the need for a trusted setup ceremony entirely (more on that below), while working natively with Unified Addresses.
- Ironwood (2026, with NU6.3) reuses Orchard's own Halo 2 design rather than replacing it, adding formally verified proof circuits and quantum-resilient note construction (what that does and does not cover is explained in Is Zcash quantum resistant?). It was introduced after a soundness flaw was found and fixed in Orchard's proof circuit. NU6.3 (Ironwood) has been active on Zcash mainnet since block 3,428,143 on July 28, 2026: new shielded activity uses the Ironwood pool, while Orchard remains spendable but exit-only. Its governing ZIPs (258, 318 and 326) are still listed as Draft in the official zcash/zips index — a document status, not a sign the upgrade is inactive. See the Zcash Network Upgrade Tracker for the sources behind both.
Sapling, Orchard, and now Ironwood pools have all existed on the network at different times — the turnstile between them and older pools is how value moves forward, at each holder's or wallet's own choice, as the cryptography improves. This covers only the proof-system upgrades; for every Zcash network upgrade, including the non-cryptography ones and the full story behind Ironwood, see Zcash Network Upgrades: A Complete Timeline.
Trusted setup
Zcash's original 2016 launch required a one-time cryptographic ceremony (the "trusted setup") to generate parameters that shielded transactions depend on. If the intermediate secrets from that ceremony had leaked and not been destroyed, someone could have theoretically forged shielded ZEC undetectably. ECC ran this — and a follow-up "Powers of Tau" ceremony for Sapling — as multi-party computations specifically so no single participant ever held the complete secret. Orchard's Halo 2 proving system removes this requirement going forward, since it needs no trusted setup at all.
Consensus: securing the network
Zcash uses Proof of Work with the Equihash mining algorithm (see Zcash mining for the current network figures), a memory-hard function designed to resist specialized ASIC hardware for longer than simpler algorithms. Consensus rules — including block validity, the halving schedule, and network upgrades — are enforced independently by every full node on the network. You cannot stake ZEC on mainnet today; our staking guide explains what a proof-of-stake layer would change.
The software that runs it
Two independent node implementations have existed for Zcash: zcashd, the original C++
implementation, and Zebra, a from-scratch implementation in Rust built for better performance
and memory safety. zcashd reached its final halt at block 3,417,100 on July 18, 2026; its repository names Zebra and Zakura as the node implementations to move to. Most wallets don't run a full node themselves — they're
light clients that sync balance data from a server while still
cryptographically verifying their own funds. Our Zebra node guide shows what running a node involves.
Where to go deeper
For the full technical specification, ECC and the wider Zcash developer community maintain the Zcash Protocol Specification, the canonical technical reference the original Zerocash paper eventually grew into. Protocol changes are proposed and tracked publicly as Zcash Improvement Proposals (ZIPs).
For the non-technical version of most of this, see Shielded vs. Transparent Zcash Transactions Explained or browse the glossary. New to Zcash? The beginner path puts the guides in order. The live numbers behind these mechanics, with sources and CSV downloads, are on our open data page.