---
title: "STIR and WHIR"
description: "STIR and WHIR: Hash-based low-degree tests. Setup: None. Proof size: Markedly smaller than FRI at equal security."
type: "option"
url: "https://zkpick.com/proof-systems/stir-whir/"
section: "01 Choosing a proof system"
authors:
  - "MarketComp"
publisher: "MarketComp"
version: "1.3"
updated: "2026-09-12"
license: "CC-BY-4.0"
json: "https://zkpick.com/data/proof-systems/stir-whir.json"
---

*By MarketComp. Updated 2026-09-12. Version 1.3. CC BY 4.0.*

# STIR and WHIR — *Hash-based low-degree tests*

> STIR and WHIR: Hash-based low-degree tests. Setup: None. Proof size: Markedly smaller than FRI at equal security. On-chain verification: Impractical directly. PQ: Plausibly. Recursion: Inherits FRI approaches. Maturity: Research maturing into implementation. Prover cost profile: Comparable to FRI; the WHIR prover is somewhat heavier. Peak prover memory: As FRI. Off-chain verifier: Sub-millisecond for WHIR in the authors' reported settings. Implementations and maintainers: Reference implementations by the authors; integrations into production hash-based stacks under way. Where it is measured: Authors' comparisons only; measure on your own parameters. Choose it when: Replacing FRI where hash-based proof size or verifier latency is the binding constraint, for teams who will follow the literature.

Two successors to FRI from the same research lineage. STIR reduces query complexity by recursively improving the rate of the tested code; WHIR builds on constrained Reed–Solomon codes to give very fast verification, and doubles as a polynomial commitment.

**Strengths**

- Concretely smaller proofs than FRI at equal security — roughly half, in the authors' reported comparisons
- WHIR verification is reported in hundreds of microseconds where prior hash-based verifiers took milliseconds
- Public reference implementations exist and integration into production stacks is under way

**Tradeoffs**

- Newer analyses and fewer independent implementations than FRI
- The most aggressive parameterisation relied on an up-to-capacity conjecture disproved for large fields in late 2025; Johnson-bound parameters are unaffected but the optimistic discount is not available as originally stated
- Requires a team able to track fresh cryptanalysis

**Choose it when:** Replacing FRI where hash-based proof size or verifier latency is the binding constraint, for teams who will follow the literature.

Maintained by: Arnon, Chiesa, Fenzi and Yogev (2024). Reference implementations by the authors; integrations at several hash-based zkVM teams · Maturity: Research maturing into implementation · License: n/a (construction) · Source: https://eprint.iacr.org/2024/1586

**In the proof system selection matrix** (https://zkpick.com/proof-systems/#proof-systems-matrix-stir-whir)

| Family | Setup | Proof size | On-chain verification | PQ | Recursion | Maturity |
| --- | --- | --- | --- | --- | --- | --- |
| STIR / WHIR | None | Markedly smaller than FRI at equal security | Impractical directly | Plausibly | Inherits FRI approaches | Research maturing into implementation |

**In the prover profile, implementations and benchmarks** (https://zkpick.com/proof-systems/#proof-systems-matrix-2-stir-whir)

| Family | Prover cost profile | Peak prover memory | Off-chain verifier | Implementations and maintainers | Where it is measured |
| --- | --- | --- | --- | --- | --- |
| STIR / WHIR | Comparable to FRI; the WHIR prover is somewhat heavier | As FRI | Sub-millisecond for WHIR in the authors' reported settings | Reference implementations by the authors; integrations into production hash-based stacks under way | Authors' comparisons only; measure on your own parameters |