How Zcash Works: The Technology Behind Shielded Transactions

Our beginner's guide covers what Zcash is. This one goes a layer deeper — how it actually works under the hood.

A ledger of unspent outputs, like Bitcoin

Zcash uses the same basic accounting model as Bitcoin: a UTXO (unspent transaction output) ledger, rather than the account-balance model used by chains like Ethereum. Every transaction consumes existing outputs and creates new ones. Zcash's shielded pool extends this model with encrypted "notes" instead of plaintext outputs — same underlying idea, hidden contents.

Two parallel systems: transparent and shielded

A Zcash transaction can spend from and pay to transparent addresses (public, like Bitcoin), shielded addresses (private, via zk-SNARKs), or both in the same transaction. The network's consensus rules verify every transaction the same way regardless of type — shielded transactions just replace plaintext amounts and addresses with a zero-knowledge proof plus encrypted data only the recipient can read.

The proof system has changed three times

The cryptography behind Zcash's shielded pool isn't static — it's been upgraded twice since launch:

1. Sprout (2016 launch) used the original Zerocash-derived proving system. It worked, but proof generation could take over a minute and required significant memory — impractical on mobile devices.
2. Sapling (2018) switched to a more efficient proving system (Groth16) and a redesigned circuit, cutting proof time to seconds. This is what made mobile shielded wallets realistic.
3. Orchard (2022, with NU5) moved to Halo 2, a proving system that removes the need for a trusted setup ceremony entirely (more on that below), while working natively with Unified Addresses.

Both Sapling and Orchard pools have existed on the network at once — the "turnstile" between them and older pools is how value has migrated forward as the cryptography improved.

Trusted setup

Zcash's original 2016 launch required a one-time cryptographic ceremony (the "trusted setup") to generate parameters that shielded transactions depend on. If the intermediate secrets from that ceremony had leaked and not been destroyed, someone could have theoretically forged shielded ZEC undetectably. ECC ran this — and a follow-up "Powers of Tau" ceremony for Sapling — as multi-party computations specifically so no single participant ever held the complete secret. Orchard's Halo 2 proving system removes this requirement going forward, since it needs no trusted setup at all.

Consensus: securing the network

Zcash has historically used Proof of Work with the Equihash mining algorithm, a memory-hard function designed to resist specialized ASIC hardware for longer than simpler algorithms. Consensus rules — including block validity, the halving schedule, and network upgrades — are enforced independently by every full node on the network.

The software that runs it

Two independent node implementations have existed for Zcash: zcashd, the original C++ implementation, and Zebra, a from-scratch implementation in Rust built for better performance and memory safety. Most wallets don't run a full node themselves — they're light clients that sync balance data from a server while still cryptographically verifying their own funds.

Where to go deeper

For the full technical specification, ECC and the wider Zcash developer community maintain the Zcash Protocol Specification, the canonical technical reference the original Zerocash paper eventually grew into. Protocol changes are proposed and tracked publicly as Zcash Improvement Proposals (ZIPs).

For the non-technical version of most of this, see Shielded vs. Transparent Zcash Transactions Explained or browse the glossary.