{
  "type": "option",
  "name": "Groth16",
  "slug": "groth16",
  "section": {
    "id": "proof-systems",
    "number": "01",
    "title": "Choosing a proof system",
    "url": "https://zkpick.com/proof-systems/"
  },
  "url": "https://zkpick.com/proof-systems/groth16/",
  "markdown": "https://zkpick.com/md/proof-systems/groth16.md",
  "category": "Pairing-based SNARK",
  "summary": "Groth16: Pairing-based SNARK. Setup: Circuit-specific. Proof size: 3 group elements: 128 B compressed, 256 B as EVM calldata. On-chain verification: Cheapest deployed option. PQ: No. Recursion: Via curve cycles; awkward. Maturity: Production since 2016. Prover cost profile: 256-bit-field MSMs and FFTs; roughly linear in constraints with a high constant. Mature GPU provers exist. Peak prover memory: Proving key resident in RAM, growing with circuit size — the usual browser and mobile limit. Off-chain verifier: Milliseconds: three pairings. Implementations and maintainers: snarkjs and rapidsnark (iden3), gnark (Consensys), arkworks, bellman (Zcash lineage), ICICLE GPU backends (Ingonyama). Where it is measured: Delendum zk-benchmarking; wrapper cost inside every zkVM benchmark on ethproofs.org. Choose it when: A stable circuit verified on-chain at high frequency where gas is the binding constraint. Also the standard final compression layer for STARK-based systems.",
  "description": "The 2016 pairing-based preprocessing SNARK over R1CS: the proof is three group elements verified with a single pairing product equation. Requires a per-circuit setup on top of a reusable universal phase one.",
  "notes": [],
  "sections": [],
  "strengths": [
    "The smallest proofs and cheapest verifier of any widely deployed system",
    "The cheapest realistic on-chain verification on Ethereum",
    "Extremely well understood, with many independent implementations and a decade of scrutiny"
  ],
  "tradeoffs": [
    "Circuit-specific trusted setup: any circuit change means a new ceremony, and toxic waste breaks soundness for that circuit permanently",
    "No universality — setup cannot be amortised across circuits",
    "Not post-quantum",
    "Proofs are re-randomisable, which breaks any application treating a proof as a unique object"
  ],
  "bestFit": "A stable circuit verified on-chain at high frequency where gas is the binding constraint. Also the standard final compression layer for STARK-based systems.",
  "maintainers": "Construction by Jens Groth (2016). Implementations: snarkjs and rapidsnark (iden3), gnark (Consensys), arkworks, bellman (Zcash lineage), ICICLE GPU backends (Ingonyama)",
  "maturity": "Production since 2016",
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "source": "https://eprint.iacr.org/2016/260",
  "facts": [
    {
      "table": "Proof system selection matrix",
      "url": "https://zkpick.com/proof-systems/#proof-systems-matrix-groth16",
      "name": "Groth16",
      "setup": "Circuit-specific",
      "size": "3 group elements: 128 B compressed, 256 B as EVM calldata",
      "verify": "Cheapest deployed option",
      "pq": "No",
      "recursion": "Via curve cycles; awkward",
      "maturity": "Production since 2016"
    },
    {
      "table": "Prover profile, implementations and benchmarks",
      "url": "https://zkpick.com/proof-systems/#proof-systems-matrix-2-groth16",
      "name": "Groth16",
      "prover": "256-bit-field MSMs and FFTs; roughly linear in constraints with a high constant. Mature GPU provers exist.",
      "memory": "Proving key resident in RAM, growing with circuit size — the usual browser and mobile limit",
      "offchain": "Milliseconds: three pairings",
      "impls": "snarkjs and rapidsnark (iden3), gnark (Consensys), arkworks, bellman (Zcash lineage), ICICLE GPU backends (Ingonyama)",
      "bench": "Delendum zk-benchmarking; wrapper cost inside every zkVM benchmark on ethproofs.org"
    }
  ],
  "relatedFailureModes": [],
  "sources": [
    {
      "title": "Groth16 — On the size of pairing-based non-interactive arguments",
      "url": "https://eprint.iacr.org/2016/260",
      "kind": "paper"
    }
  ],
  "updated": "2026-09-12",
  "version": "1.3",
  "canonical": "https://zkpick.com/proof-systems/groth16/",
  "authors": [
    "MarketComp"
  ]
}