The blockchain page ended on a catch. We had built a shared ledger that nobody runs and nobody can quietly rewrite — genuinely new — but it works by making everything public. Every payment, every amount, every address sits in the open, copied across thousands of machines, kept forever. For a system whose whole job is that nothing can be hidden, that is the feature. For money, it is a problem: you have traded a trusted bank for a permanent, world-readable record of everything you ever paid for.
So the question this page answers is the one the last page left hanging: can you keep the good part — a ledger nobody controls, where nobody can cheat — and still put the privacy back? Zcash is one answer people built. This page explains the shape of how it does it; the machinery itself is the next page.
The first thing to know is that Zcash does not force one mode on you. A wallet can hold two kinds of address, and you choose which to use for a given payment.
Both live on the same blockchain, checked by the same network. The only difference is how much each payment reveals.
When you pay from one shielded address to another, the public ledger records that a valid payment took place — and almost nothing else. It does not show who sent it, who received it, or how much moved. (Even the short note you can attach to a payment is encrypted.) The three facts a transparent chain like Bitcoin publishes by default are simply absent from the record.
One honest caveat, so this is not oversold: that full hiding holds when both ends are shielded. Zcash also lets you move funds between the transparent and shielded sides, and whenever value crosses that line the amount moved is public — the net value shifted between the shielded and transparent pools is recorded in the clear, in the transaction itself. You get the strongest privacy by staying shielded end to end — not by routing through a transparent address along the way.
Hiding the details sounds easy until you remember why the blockchain made everything public in the first place. On Bitcoin, everyone sees every transaction, so everyone can confirm the things that matter: the coins being spent really exist, the spender actually owns them, and they were not already spent elsewhere. Visibility is the check.
Take the details away and that check seems to fall apart. If nobody can see the sender, the amount, or which coins are moving, how can the network be sure the payment isn't forged or spent twice? You cannot verify what you cannot read. Zcash's whole contribution is a way to keep the check while dropping the visibility, and it rests on three pieces, built up next.
Instead of posting a payment in the clear, a shielded transaction posts a commitment to it. A commitment is a short cryptographic stand-in, computed from the hidden details — the amount, the destination — and published on the chain in their place. The specification puts it plainly: "to each note there is cryptographically associated a note commitment" (a note is just the protocol's word for a parcel of shielded funds).
Picture a sealed, tamper-proof envelope placed on the public record. Anyone can see that an envelope was filed and when; nobody can see inside; and because the stand-in is computed from the exact contents, nobody can later swap those contents for something else without it showing. Every shielded payment adds its envelope to one long public list. That list of sealed envelopes — not a stack of open pages — is what the network has to work with.
A list of sealed envelopes raises an obvious worry: if nobody can see inside, what stops you from spending the same one twice?
The answer is the nullifier. When you spend shielded funds, your transaction publishes a single short tag — the nullifier — derived from the exact funds being spent. It does two jobs at once. First, it is unique to those funds, so spending them a second time would publish the very same tag; the network remembers every tag it has seen and rejects a repeat. That is exactly how a double-spend is stopped — the spec notes the "nullifiers ... are revealed (preventing them from being spent again)" and that "the nullifiers are necessary to prevent double-spending." Second, computing the tag needs your secret key, and without that key it cannot be matched to any envelope on the list. So a nullifier announces "some funds were just spent, don't allow them again" without ever revealing which funds.
An envelope and a tag still do not show that the payment is honest — that the funds exist, that you own them, that nothing was conjured out of nowhere. Revealing the details would prove all that at once, but revealing them is the one thing we are trying to avoid. This is the knot a zero-knowledge proof unties.
A zero-knowledge proof is a way to prove a statement is true while revealing nothing beyond the fact that it is true. Zcash attaches one to every shielded payment (the specific kind it uses is a zk-SNARK — a zero-knowledge succinct non-interactive argument of knowledge). In one step, and without disclosing the sender, receiver, or amount, the proof lets the network confirm that: the funds being spent match an envelope already on the public list; the spender is authorized to spend them; and the nullifier was computed correctly from those funds. A companion check, carried out alongside the proof, confirms that the amounts balance, so nothing is created from nothing. Anyone can check the proof against the public record, and the payment is accepted only if it holds.
This is the heart of it. The specification's normative account of nullifiers states it precisely: when a note is spent, "the spender creates a zero-knowledge proof that it knows [the spending secrets], consistent with the publically disclosed nullifier and some previously committed note commitment" — a valid envelope is on the list, without revealing which one. The proof is honest about validity and silent about everything else — no magic, just a statement proved without its details.
Put the three pieces together and the trick stops being mysterious. Shielded funds enter the chain as sealed commitments. Spending one publishes a one-time nullifier that blocks a second spend without saying which funds moved. And a zero-knowledge proof, with a companion balance check, shows the whole payment is valid — the money exists, its owner authorized it, the totals balance — while the sender, receiver, and amount stay hidden. The public ledger stays fully checkable; it just no longer has to be fully readable.
That is what Zcash adds to the blockchain we built earlier: the same trustless, un-rewritable shared record, with the privacy put back. The idea did not start with Zcash — it is an implementation of an earlier research design called Zerocash (what Zcash now calls a nullifier, that work called a serial number), as the specification itself notes: "Zcash is an implementation of the Decentralized Anonymous Payment scheme Zerocash."
We have described the shape on purpose, and stopped at the machinery's door. What a note actually contains, how those envelopes are stored so a proof can point at one, and how a zk-SNARK is really built (Zcash's uses a system called Halo 2, with no trusted setup) — that is the technical tier, and it is where the next page goes.