witness

The witness is the secret that makes a proof work: the private inputs the prover knows that satisfy the circuit's constraints. If the public statement is "this hash has a preimage" or "this rollup batch is valid," the witness is the actual preimage, or the full set of transactions, signatures, and intermediate values that drive the computation. Zero-knowledge means the verifier becomes convinced the witness exists without ever seeing it.

It helps to separate three things. The public input is what everyone sees and agrees on (a Merkle root, a claimed output). The witness is the private assignment to all of the circuit's internal and secret wires. And the proof is the short object the prover sends. Crucially, SNARKs offer knowledge soundness: a prover who produces a valid proof must actually "know" a satisfying witness, in the precise sense that an extractor algorithm could pull the witness out of them — you cannot bluff a proof without the underlying secret.

Computing the witness is usually the prover's first and heaviest step: run the computation honestly, recording the value on every wire, then feed that full assignment into the proving algorithm. The witness must stay private — leaking it defeats the whole point, as in a shielded transaction where the witness contains the spending key and amounts. This is also why witness generation, not just proof generation, is a serious performance bottleneck in large circuits like zkEVMs.