{
  "type": "option",
  "name": "Circom",
  "slug": "circom",
  "section": {
    "id": "frameworks",
    "number": "02",
    "title": "Choosing a framework",
    "url": "https://zkpick.com/frameworks/"
  },
  "url": "https://zkpick.com/frameworks/circom/",
  "markdown": "https://zkpick.com/md/frameworks/circom.md",
  "category": "Circuit DSL (R1CS)",
  "summary": "Circom: Circuit DSL (R1CS). Kind: Circuit DSL. Arithmetisation / backend: R1CS → Groth16 / PLONK. Setup: Yes (per-circuit for Groth16). Maintained by: iden3. Licence: GPL-3.0. Status: Production-mature. Choose it when: Fixed, small-to-medium, high-volume statements where the verifier must be cheap and the circuit will be audited hard: membership proofs, identity and anonymity sets, signature verification.",
  "description": "A low-level DSL that compiles templates into R1CS, typically proved with Groth16 or PLONK. The developer writes constraints explicitly and assigns witness values separately — the source of both its efficiency and its characteristic bug class.",
  "notes": [],
  "sections": [],
  "strengths": [
    "The largest deployed base of any ZK circuit DSL, and by far the deepest pool of engineers and auditors",
    "The best security tooling coverage of any ZK language — analysers and fuzzers target it first",
    "Very small, cheap on-chain verifiers when paired with Groth16"
  ],
  "tradeoffs": [
    "Highest underconstrained-bug risk of the mainstream options; the assign-versus-constrain distinction is a documented footgun",
    "R1CS only — no custom gates or lookups, so hashing-heavy circuits are expensive relative to PLONKish and AIR systems",
    "Groth16 means a per-circuit trusted setup: changing the circuit means a new ceremony",
    "Licensing differs by layer and is routinely conflated — the compiler and snarkjs are GPL-3.0 while circomlib is LGPL-3.0; get legal review for commercial products"
  ],
  "bestFit": "Fixed, small-to-medium, high-volume statements where the verifier must be cheap and the circuit will be audited hard: membership proofs, identity and anonymity sets, signature verification.",
  "maintainers": "iden3",
  "maturity": "Production-mature",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "source": "https://github.com/iden3/circom",
  "facts": [
    {
      "table": "Framework selection matrix",
      "url": "https://zkpick.com/frameworks/#frameworks-matrix-circom",
      "name": "Circom",
      "kind": "Circuit DSL",
      "arith": "R1CS → Groth16 / PLONK",
      "setup": "Yes (per-circuit for Groth16)",
      "by": "iden3",
      "license": "GPL-3.0",
      "status": "Production-mature"
    }
  ],
  "relatedFailureModes": [],
  "sources": [
    {
      "title": "Circom — circuit compiler and language",
      "url": "https://github.com/iden3/circom",
      "kind": "project"
    },
    {
      "title": "Circomspect — static analyser for Circom",
      "url": "https://github.com/trailofbits/circomspect",
      "kind": "tool"
    }
  ],
  "updated": "2026-09-12",
  "version": "1.3",
  "canonical": "https://zkpick.com/frameworks/circom/",
  "authors": [
    "MarketComp"
  ]
}