Zcash is two ledgers sharing one chain. The transparent part works like Bitcoin: public addresses, public amounts, a public UTXO graph. The shielded pools hold encrypted notes whose sender, receiver and amount are hidden, with a zk-SNARK proving each transaction is valid anyway. How private a Zcash payment is depends on which side the funds are on, and on what leaks when they cross between the two.
The pools
| Pool | Introduced | Proof system | Trusted setup | Addresses |
|---|---|---|---|---|
| Transparent | 2016 | None (Bitcoin-style scripts) | n/a | t1... (P2PKH), t3... (P2SH) |
| Sprout | 2016 | BCTV14, later Groth16 | Yes | zc... (legacy) |
| Sapling | 2018 | Groth16 | Yes (multi-party ceremony) | zs1... |
| Orchard | 2022 (NU5) | Halo 2 | No | Only inside unified addresses (u1...) |
Sprout is legacy. Since the Canopy upgrade in 2020, funds can only leave it. New wallets use Orchard, with Sapling still widely supported.
What a shielded transaction reveals
Shielded value lives in notes. When you receive, the chain records a note commitment, a hash that hides the recipient, the amount and some randomness, and appends it to a Merkle tree. When you spend, you publish a nullifier, a value derived from the note and your key. Nodes reject any nullifier they've seen before, which prevents double spends without revealing which commitment was spent.
The zk-SNARK proves, without revealing the inputs:
- each spent note is in the commitment tree,
- you hold the key that can spend it,
- its nullifier is derived correctly,
- value in equals value out plus the fee.
Encrypted to the recipient: the amount, the recipient's address and a 512-byte . Public: nullifiers, new commitments, the fee, the transaction's size and number of actions, and any value crossing into or out of the pool.