---
title: "Groth16"
description: "Groth16: Pairing-based SNARK. Setup: Circuit-specific. Proof size: 3 group elements: 128 B compressed, 256 B as EVM calldata."
type: "option"
url: "https://zkpick.com/proof-systems/groth16/"
section: "01 Choosing a proof system"
authors:
  - "MarketComp"
publisher: "MarketComp"
version: "1.3"
updated: "2026-09-12"
license: "CC-BY-4.0"
json: "https://zkpick.com/data/proof-systems/groth16.json"
---

*By MarketComp. Updated 2026-09-12. Version 1.3. CC BY 4.0.*

# Groth16 — *Pairing-based SNARK*

> Groth16: Pairing-based SNARK. Setup: Circuit-specific. Proof size: 3 group elements: 128 B compressed, 256 B as EVM calldata. On-chain verification: Cheapest deployed option. PQ: No. Recursion: Via curve cycles; awkward. Maturity: Production since 2016. Prover cost profile: 256-bit-field MSMs and FFTs; roughly linear in constraints with a high constant. Mature GPU provers exist. Peak prover memory: Proving key resident in RAM, growing with circuit size — the usual browser and mobile limit. Off-chain verifier: Milliseconds: three pairings. Implementations and maintainers: snarkjs and rapidsnark (iden3), gnark (Consensys), arkworks, bellman (Zcash lineage), ICICLE GPU backends (Ingonyama). Where it is measured: Delendum zk-benchmarking; wrapper cost inside every zkVM benchmark on ethproofs.org. Choose it when: A stable circuit verified on-chain at high frequency where gas is the binding constraint. Also the standard final compression layer for STARK-based systems.

The 2016 pairing-based preprocessing SNARK over R1CS: the proof is three group elements verified with a single pairing product equation. Requires a per-circuit setup on top of a reusable universal phase one.

**Strengths**

- The smallest proofs and cheapest verifier of any widely deployed system
- The cheapest realistic on-chain verification on Ethereum
- Extremely well understood, with many independent implementations and a decade of scrutiny

**Tradeoffs**

- Circuit-specific trusted setup: any circuit change means a new ceremony, and toxic waste breaks soundness for that circuit permanently
- No universality — setup cannot be amortised across circuits
- Not post-quantum
- Proofs are re-randomisable, which breaks any application treating a proof as a unique object

**Choose it when:** A stable circuit verified on-chain at high frequency where gas is the binding constraint. Also the standard final compression layer for STARK-based systems.

Maintained by: Construction by Jens Groth (2016). Implementations: snarkjs and rapidsnark (iden3), gnark (Consensys), arkworks, bellman (Zcash lineage), ICICLE GPU backends (Ingonyama) · Maturity: Production since 2016 · License: n/a (construction) · Source: https://eprint.iacr.org/2016/260

**In the proof system selection matrix** (https://zkpick.com/proof-systems/#proof-systems-matrix-groth16)

| Family | Setup | Proof size | On-chain verification | PQ | Recursion | Maturity |
| --- | --- | --- | --- | --- | --- | --- |
| Groth16 | Circuit-specific | 3 group elements: 128 B compressed, 256 B as EVM calldata | Cheapest deployed option | No | Via curve cycles; awkward | Production since 2016 |

**In the prover profile, implementations and benchmarks** (https://zkpick.com/proof-systems/#proof-systems-matrix-2-groth16)

| Family | Prover cost profile | Peak prover memory | Off-chain verifier | Implementations and maintainers | Where it is measured |
| --- | --- | --- | --- | --- | --- |
| Groth16 | 256-bit-field MSMs and FFTs; roughly linear in constraints with a high constant. Mature GPU provers exist. | Proving key resident in RAM, growing with circuit size — the usual browser and mobile limit | Milliseconds: three pairings | snarkjs and rapidsnark (iden3), gnark (Consensys), arkworks, bellman (Zcash lineage), ICICLE GPU backends (Ingonyama) | Delendum zk-benchmarking; wrapper cost inside every zkVM benchmark on ethproofs.org |