What is a zk-SNARK

“zk-SNARK” packs five separate properties into seven letters. Taken apart:

Zero-Knowledge

The proof reveals nothing about the secret beyond the one bit “yes, the prover knows it.” Not a hint, not a partial leak — nothing a verifier couldn’t have already computed on their own without the proof. This is the oldest of the ideas here, going back to Goldwasser, Micali, and Rackoff’s 1985 definition — see History.

Succinct

The proof stays small and fast to check, no matter how large the statement being proven is. A Groth16 proof is exactly 3 group elements whether the underlying computation had 10 steps or 10 million — see the homepage for that fact in full, and Applications for where it’s used in production. This is the property that makes zk-SNARKs practical for blockchains: you can verify a proof about a huge computation in milliseconds.

Non-interactive

The prover produces the proof once, unilaterally — no back-and-forth challenge-response with the verifier required. The Fiat–Shamir transform (1986) is the standard way to get here: replace the verifier’s random challenge with the output of a hash function the prover computes themselves. See History.

ARgument of Knowledge

A proof would be sound against a computationally unbounded prover; an argument is only sound against a prover bounded by realistic computing power — which is the setting every practical SNARK actually operates in. “Of Knowledge” means the prover isn’t just showing a statement is true, but that they specifically know a witness (the secret) that makes it true — formally, that a witness can in principle be extracted from a convincing prover.

What this site’s demo shows, and what it doesn’t

This is the part to read before trying the interactive demo.

A real zk-SNARK needs two more layers of machinery this site does not implement from scratch: arithmetization (turning an arbitrary computation into a system a proof system can talk about) and polynomial commitments over pairing-based elliptic curves (what actually delivers the Succinct property for a big computation). Building those correctly, from scratch, for a browser demo is a substantial engineering project on its own — not something that can be done honestly in the scope of an explainer site.

So the demo on this site implements something smaller but real: Schnorr identification, made non-interactive with the Fiat–Shamir transform. It’s not a rebrand or a toy stand-in — it’s the actual historical building block zero-knowledge proofs (and eventually SNARKs) grew out of, and it genuinely has three of SNARK’s four properties:

• Zero-knowledge — yes. The secret is never transmitted or derivable from the proof.
• Non-interactive — yes. Fiat–Shamir removes the verifier’s live challenge entirely.
• ARgument of Knowledge — yes. The proof only verifies if the prover actually knows the discrete logarithm in question.
• Succinct — no, and this is the one this site is explicit about. The demo’s proof is already small (two numbers), so smallness by itself proves nothing interesting here. Succinctness is a claim about proof size staying flat as the underlying computation grows arbitrarily large — that only becomes a meaningful, checkable claim once there’s a large computation and a polynomial commitment scheme behind it, which is exactly the part this demo doesn’t build. See how it works for the exact scheme the demo runs, and how it conceptually — not literally — scales toward a real SNARK.

Succinctness, on this site, is demonstrated with real numbers instead of a demo: a Groth16 proof is 3 group elements regardless of circuit size — see the homepage and Applications.