---
title: "Halo2"
description: "Halo2: Rust eDSL (PLONKish). As Halo2 (upstream) — Kind: Rust eDSL. Arithmetisation / backend: PLONKish + IPA. Setup: None."
type: "option"
url: "https://zkpick.com/frameworks/halo2/"
section: "02 Choosing a framework"
authors:
  - "MarketComp"
publisher: "MarketComp"
version: "1.3"
updated: "2026-09-12"
license: "CC-BY-4.0"
json: "https://zkpick.com/data/frameworks/halo2.json"
---

*By MarketComp. Updated 2026-09-12. Version 1.3. CC BY 4.0.*

# Halo2 — *Rust eDSL (PLONKish)*

> Halo2: Rust eDSL (PLONKish). As Halo2 (upstream) — Kind: Rust eDSL. Arithmetisation / backend: PLONKish + IPA. Setup: None. Maintained by: Electric Coin Company (Zcash). Licence: MIT / Apache-2.0. Status: Production in its home ecosystem. As Halo2 (KZG fork) — Kind: Rust eDSL. Arithmetisation / backend: PLONKish + KZG. Setup: Yes (universal). Maintained by: Ethereum Foundation PSE. Licence: MIT / Apache-2.0. Status: Maintenance mode. Choose it when: Teams needing trusted-setup-free proving with a non-EVM or off-chain verifier, who have cryptography-capable engineers.

PLONKish arithmetisation with custom gates, lookup arguments and explicit region and column layout under developer control. The upstream implementation uses an inner-product argument and needs no trusted setup; a widely used fork swaps in KZG for constant-size, cheaply verifiable proofs.

**Strengths**

- The upstream IPA instantiation needs no trusted setup, and is deployed in a long-running production shielded protocol
- Custom gates and lookups allow far more efficient hashing and range-check circuits than R1CS
- Permissive dual licence

**Tradeoffs**

- The steepest learning curve of any mainstream option — correct circuits require manual reasoning about regions, rotations and selectors
- Very easy to underconstrain, in library gadgets as well as user circuits: a query-collision bug affected edge-case circuits across multiple forks, and in 2026 a counterfeiting bug in the ECC gadget of the upstream library prompted an emergency response in its flagship deployment — verify the current status of any Halo2 deployment you are citing as evidence of maturity
- IPA proofs are logarithmic in size but the verifier's work is linear in circuit size, so direct L1 verification is impractical without a wrapper
- The ecosystem is fragmented across forks with divergent maintenance postures — choose deliberately

**Choose it when:** Teams needing trusted-setup-free proving with a non-EVM or off-chain verifier, who have cryptography-capable engineers.

Maintained by: Electric Coin Company (upstream); Ethereum Foundation PSE (KZG fork, maintenance mode); Axiom (halo2-lib) · Maturity: Long production history; verify current status · License: MIT / Apache-2.0 · Source: https://github.com/zcash/halo2

**In the framework selection matrix** (https://zkpick.com/frameworks/#frameworks-matrix-halo2-upstream)

| Project | Kind | Arithmetisation / backend | Setup | Maintained by | Licence | Status |
| --- | --- | --- | --- | --- | --- | --- |
| Halo2 (upstream) | Rust eDSL | PLONKish + IPA | None | Electric Coin Company (Zcash) | MIT / Apache-2.0 | Production in its home ecosystem |

**In the framework selection matrix** (https://zkpick.com/frameworks/#frameworks-matrix-halo2-kzg-fork)

| Project | Kind | Arithmetisation / backend | Setup | Maintained by | Licence | Status |
| --- | --- | --- | --- | --- | --- | --- |
| Halo2 (KZG fork) | Rust eDSL | PLONKish + KZG | Yes (universal) | Ethereum Foundation PSE | MIT / Apache-2.0 | Maintenance mode |