Skip to main content
Important: We do not provide financial advice or custody funds. All transactions occur on third-party platforms.
CryptoBipto
Log in

SNARKs vs STARKs

Trusted setups, post-quantum security, proof size, verification cost. Groth16, PLONK, Halo2, and the StarkWare hash-based lineage from 2018 onward.

40 min · expert · part of ZK Cryptography & Proof Systems

Reading the Acronyms

zk-SNARK and zk-STARK are the two dominant families of practical zero-knowledge proof systems. Both are non-interactive, both prove statements in NP, and both are deployed in production blockchains today. The acronyms themselves carry useful information. **SNARK** stands for Succinct Non-Interactive Argument of Knowledge. • **Succinct** means the proof object is small (often a few hundred bytes to a few kilobytes) and verification is fast (often constant or logarithmic time in the size of the statement). • **Non-interactive** means a single message from prover to verifier — no back-and-forth. • **Argument** is a technical word meaning the soundness is computational (a cheating prover with unbounded compute could in principle forge a proof, but no computationally bounded adversary can in practice). • **Knowledge** means the prover not only proves the statement is true but proves it knows a witness. This is a stronger property than mere truth and is what makes SNARKs useful for applications like signature schemes and identity. **STARK** stands for Scalable Transparent ARgument of Knowledge. • **Scalable** means the proof generation cost grows quasi-linearly in computation size, and verification cost grows poly-logarithmically — STARKs are designed for very large statements. • **Transparent** means there is no trusted setup. The randomness used to set up the system is public and verifiable. (Compare to SNARKs, which historically required a trusted setup ceremony.) • Argument and knowledge mean the same as for SNARKs. The two families overlap in goals but differ sharply in cryptographic assumptions, proof sizes, and operational requirements. This lesson maps the differences along the dimensions that matter when you are choosing or evaluating a proof system in 2025-2026.

Also in this lesson

  • Trusted Setups and the KZG Ceremony
  • Major SNARK Flavors: Groth16, PLONK, Halo2
  • STARKs and the StarkWare Lineage
  • Choosing SNARK vs STARK in Practice
  • Recursive Proofs and Proof Aggregation

Key terms

zk-SNARK
Succinct Non-interactive ARgument of Knowledge — a ZK proof system that is short, fast to verify, and (typically) requires a trusted setup. Major variants include Groth16, PLONK, and Halo2.
zk-STARK
Scalable Transparent ARgument of Knowledge — a ZK proof system built only from hash functions, requiring no trusted setup and offering post-quantum security. Introduced by Eli Ben-Sasson and collaborators in 2018; commercialized by StarkWare.
Trusted setup
A one-time procedure required by many SNARK schemes that generates a structured reference string from secret randomness; if the randomness is recovered, the system can be forged, so ceremonies use multi-party computation across many participants.
KZG ceremony
The 2023 Ethereum trusted setup ceremony (Kate-Zaverucha-Goldberg) supporting proto-danksharding and many ZK applications; ran January-April 2023 and accumulated on the order of 140,000 contributions, the largest cryptographic ceremony to date.
Groth16
A classical pairing-based SNARK by Jens Groth (2016) with ~192-byte proofs and constant-time verification, but requiring a per-circuit trusted setup; used by Tornado Cash and many shielded-asset designs.
PLONK
A 2019 SNARK system (Gabizon, Williamson, Ciobotaru) introducing a universal and updateable trusted setup, decoupling the ceremony from any specific circuit; the basis for Linea, Scroll, zkSync Era Boojum, and many modern provers.
Halo2
A SNARK system with no trusted setup, using inner-product-argument polynomial commitments and Plonkish arithmetization; basis for Penumbra and the Zcash Orchard shielded pool.
FRI (Fast Reed-Solomon IOP)
The low-degree polynomial test at the heart of STARKs; lets the verifier check with high probability that a committed polynomial is close to a low-degree polynomial.
Recursive proof
A proof system where one circuit verifies another proof, enabling aggregation of many proofs into one and constant-size verification of arbitrarily large computations; used by Mina, StarkNet, zkSync, Linea, and most modern rollups.
Folding scheme
A modern alternative to full recursive verification that accumulates proofs into a single relaxed instance with cheaper intermediate steps; Nova (2022) and successors (SuperNova, Sangria) are the foundational examples and underpin many zkVMs.

Continue this lesson — 5 more sections in the CryptoBipto app.

Open lesson

Educational only — not financial advice.