Groth16

Groth16, named for Jens Groth's 2016 construction, is the SNARK that set the bar for compactness: a proof is just three group elements — roughly 128 to 200 bytes — and verification is a fixed handful of pairing operations, no matter how enormous the underlying computation. For years it was the default for on-chain verification precisely because its proofs are tiny and its verifier gas cost is small and constant. Zcash's Sapling shielded transactions and many early zk-rollups verified Groth16 proofs.

The price of that compactness is a circuit-specific trusted setup. Groth16 consumes a circuit expressed as R1CS, compiles it through a Quadratic Arithmetic Program, and bakes that exact circuit into its structured reference string. Verification reduces to checking a single pairing equation of the form e(A, B) = e(α, β) · e(C, δ) · e(vk_x, γ), where A, B, C are the proof and the rest come from the verifying key; the equation holds only if the prover knew a satisfying witness. Because the SRS is tied to one circuit, any change to the program — even a bug fix — demands a brand-new ceremony, which is its central inconvenience.

The trade-off versus PLONK is sharp and well understood: Groth16 gives you the smallest proofs and cheapest verification, while PLONK gives you a reusable universal setup. Projects that deploy a single, stable, high-volume circuit (a shielded-payment statement, a fixed rollup verifier) often still prefer Groth16; projects iterating on logic or supporting arbitrary circuits prefer universal-setup systems. Like all pairing-based SNARKs, Groth16 relies on hardness assumptions that are not post-quantum.