A small classical proof, about 128 bytes on BN254, with separate paths for universal setup, aggregation, folding and a post quantum direction. Research software built on arkworks, not one artifact that does everything at once.
Smaller proofs cost less to verify onchain and move faster across a network. Drag the slider. UniGroth stays flat while the others grow.
Bars use a log scale so a 50 KB STARK proof and a 192 byte proof fit side by side. Hover a row for the exact size.
Enter a secret and a public statement. UniGroth binds both with SHA256 into a commitment that reveals nothing about the secret and breaks if any byte changes. This is the binding and tamper check the post quantum module performs today. It is not yet a full zero knowledge proof that the secret satisfies a circuit. It runs in your browser and nothing is sent anywhere.
Change one character above, or press tamper, and the check fails at once. The same secret and statement always bind to the same commitment. This shows binding and tamper detection, not a soundness proof.
Checking many proofs one by one is slow. SnarkPack aggregation combines a batch so the verifier does one check instead of many. The aggregate grows like log N, so it is kilobytes, not the tiny core proof. Drag to set the batch size.
Every limitation removed, and the tiny proof stays.
One updatable ceremony covers every circuit of a given size. No setup per circuit.
Groth16 is already sound. UniGroth adds non malleability, so a proof cannot be reshaped after an attacker sees other valid ones.
Fold N proofs into one. Verify a batch of 32 for the cost of one, about 32 times cheaper.
ProtoStar accumulation with a full relaxed R1CS decision predicate. Fold, then verify once.
A research scaffold. Today it binds witnesses with SHA256. FRI and sumcheck designs are the target and are not yet built, so it is not a quantum security guarantee.
Generate a Solidity verifier from any key. About 250k gas using the BN254 precompiles.
Plonkish gates like Poseidon and EC add, lookup tables, and a path back to R1CS.
Shrink a verifying key from order n to order one. Built for large zkEVM circuits.
Run the heavy steps in chunks with bounded memory, for circuits too large for RAM.
The same comparison the whitepaper draws, in full.
| Groth16 | PLONK | Marlin | Halo2 | STARKs | UniGroth | |
|---|---|---|---|---|---|---|
| Proof size | 192 B | 1 to 2 KB | 2 to 5 KB | 5 to 15 KB | 50 to 200 KB | 192 to 256 B |
| Verify cost | 3 pairings | 10 plus | 15 plus | varies | fast hash | 3 to 5 pairings |
| Trusted setup | per circuit | universal | universal | none | none | universal |
| Simulation extractable | no | no | no | no | n a | yes |
| Folding and IVC | no | no | no | no | varies | yes |
| Aggregation | no | no | no | no | varies | yes |
| Post quantum | no | no | no | no | yes | path |
| Public input proof | no | no | no | no | no | yes |
| Key compression | no | no | no | no | n a | yes |
| Custom gates | no | yes | no | yes | yes | yes |
| Onchain verifier | manual | manual | no | no | no | auto |
Five layers, from your application down to the tiny pairing based proof.
About 11,870 lines across 28 Rust modules. 156 tests, zero clippy warnings. Read the source.