---
title: "PLONK and the PLONKish family"
description: "PLONK and the PLONKish family: Pairing-based SNARK, universal SRS. Setup: Universal, updatable. Proof size: Sub-kilobyte."
type: "option"
url: "https://zkpick.com/proof-systems/plonk/"
section: "01 Choosing a proof system"
authors:
  - "MarketComp"
publisher: "MarketComp"
version: "1.3"
updated: "2026-09-12"
license: "CC-BY-4.0"
json: "https://zkpick.com/data/proof-systems/plonk.json"
---

*By MarketComp. Updated 2026-09-12. Version 1.3. CC BY 4.0.*

# PLONK and the PLONKish family — *Pairing-based SNARK, universal SRS*

> PLONK and the PLONKish family: Pairing-based SNARK, universal SRS. Setup: Universal, updatable. Proof size: Sub-kilobyte. On-chain verification: Practical; above Groth16. PQ: No. Recursion: Well-exercised. Maturity: Production; most common deployed family. Prover cost profile: 256-bit-field FFTs dominate; custom gates and lookups trade prover work for constraint count. Peak prover memory: SRS and witness polynomials resident; comparable to Groth16 at equal size. Off-chain verifier: Milliseconds. Implementations and maintainers: Barretenberg / UltraHonk (Aztec), gnark (Consensys), plonky2 (Polygon Zero lineage), Kimchi (o1Labs), Halo2 forks. Where it is measured: Vendor-published only; no neutral cross-implementation suite. Choose it when: General-purpose circuits where churn is expected and a per-circuit ceremony would be painful, and where on-chain verification is required but need not be absolutely minimal.

A permutation-argument-based universal SNARK over a custom-gate arithmetisation — selector columns, copy constraints, optional lookup columns. One SRS serves all circuits up to a size bound. The most frequently occurring family among deployed on-chain verifiers.

**Strengths**

- Universal, updatable SRS — one ceremony, many circuits, no per-circuit phase two
- Flexible arithmetisation: custom gates and lookups express non-arithmetic operations efficiently
- Verifier cost close to Groth16 and still practical on-chain
- Very large ecosystem with many independent implementations

**Tradeoffs**

- Larger proofs and higher gas than Groth16
- Not post-quantum
- Prover requires large-field FFTs, the main bottleneck at scale
- Arithmetisation flexibility is also a footgun — custom gates and lookup tables are a common source of underconstrained circuits
- 'PLONK' names a family, not one artefact: two implementations may share little

**Choose it when:** General-purpose circuits where churn is expected and a per-circuit ceremony would be painful, and where on-chain verification is required but need not be absolutely minimal.

Maintained by: Construction by Gabizon, Williamson and Ciobotaru (Aztec, 2019). Implementations: Barretenberg / UltraHonk (Aztec), gnark (Consensys), plonky2 (Polygon Zero lineage), Kimchi (o1Labs), Halo2 forks · Maturity: Production; most common deployed family · License: n/a (construction) · Source: https://eprint.iacr.org/2019/953

**In the proof system selection matrix** (https://zkpick.com/proof-systems/#proof-systems-matrix-plonk-family)

| Family | Setup | Proof size | On-chain verification | PQ | Recursion | Maturity |
| --- | --- | --- | --- | --- | --- | --- |
| PLONK family | Universal, updatable | Sub-kilobyte | Practical; above Groth16 | No | Well-exercised | Production; most common deployed family |

**In the prover profile, implementations and benchmarks** (https://zkpick.com/proof-systems/#proof-systems-matrix-2-plonk-family)

| Family | Prover cost profile | Peak prover memory | Off-chain verifier | Implementations and maintainers | Where it is measured |
| --- | --- | --- | --- | --- | --- |
| PLONK family | 256-bit-field FFTs dominate; custom gates and lookups trade prover work for constraint count | SRS and witness polynomials resident; comparable to Groth16 at equal size | Milliseconds | Barretenberg / UltraHonk (Aztec), gnark (Consensys), plonky2 (Polygon Zero lineage), Kimchi (o1Labs), Halo2 forks | Vendor-published only; no neutral cross-implementation suite |