← → Print all
02 — Framework · Framework

Circom

Circuit DSL (R1CS)

In one paragraph

Circom: Circuit DSL (R1CS). Kind: Circuit DSL. Arithmetisation / backend: R1CS → Groth16 / PLONK. Setup: Yes (per-circuit for Groth16). Maintained by: iden3. Licence: GPL-3.0. Status: Production-mature. Choose it when: Fixed, small-to-medium, high-volume statements where the verifier must be cheap and the circuit will be audited hard: membership proofs, identity and anonymity sets, signature verification.

By MarketComp Updated v1.3 About the authors Changelog
Kind
Circuit DSL
Arithmetisation / backend
R1CS → Groth16 / PLONK
Setup
Yes (per-circuit for Groth16)
Maintained by
iden3
Licence
GPL-3.0
Status
Production-mature
Selection matrix · see the row in context

What it is

A low-level DSL that compiles templates into R1CS, typically proved with Groth16 or PLONK. The developer writes constraints explicitly and assigns witness values separately — the source of both its efficiency and its characteristic bug class.

Strengths and tradeoffs

Strengths
  • The largest deployed base of any ZK circuit DSL, and by far the deepest pool of engineers and auditors
  • The best security tooling coverage of any ZK language — analysers and fuzzers target it first
  • Very small, cheap on-chain verifiers when paired with Groth16
Tradeoffs
  • Highest underconstrained-bug risk of the mainstream options; the assign-versus-constrain distinction is a documented footgun
  • R1CS only — no custom gates or lookups, so hashing-heavy circuits are expensive relative to PLONKish and AIR systems
  • Groth16 means a per-circuit trusted setup: changing the circuit means a new ceremony
  • Licensing differs by layer and is routinely conflated — the compiler and snarkjs are GPL-3.0 while circomlib is LGPL-3.0; get legal review for commercial products

Choose it whenFixed, small-to-medium, high-volume statements where the verifier must be cheap and the circuit will be audited hard: membership proofs, identity and anonymity sets, signature verification.

Maintained implementations

iden3

Maturity: Production-mature · License: GPL-3.0 · github.com ↗

How to decide
Other frameworks in §02
NoirHalo2gnarkPlonky3Cairo and the Stwo proverSP1RISC Zero (R0VM)OpenVMZKsync AirbenderJoltMiden VMHosted proving servicesDecentralised proof markets

Sources cited on this page · 2

  1. Circom — circuit compiler and languageproject
  2. Circomspect — static analyser for Circomtool

All 45 sources for §02 are listed on the section page →

Cite this page 
MarketComp (2026). Circom. The ZK Field Manual (Version 1.3). MarketComp. https://zkpick.com/frameworks/circom/
@misc{zkfieldmanual-circom,
  title        = {Circom — The ZK Field Manual},
  author       = {MarketComp},
  year         = {2026},
  version      = {1.3},
  howpublished = {\url{https://zkpick.com/frameworks/circom/}},
  note         = {Accessed: YYYY-MM-DD}
}