case file w-0001mainnet slot———————
Witness
file w-0002 the lab · three experiments

Real proofs.
This tab.

Three experiments, each doing the actual cryptography in your browser and timing it on your device. Nothing you type or generate leaves the page.

No uploads: secrets and keys stay in memory Heavy work runs in Web Workers Circuits load on first use (up to 4 MB)
experiment 01

Prove you know it.
Twice.

A random secret, its public MiMC7 fingerprint, and two zero-knowledge proofs of the same statement: a 256-byte Groth16 proof from a circom circuit, and a 99,629-byte ZK-STARK that uses nothing but SHA-256. Flip a bit in either and it stops verifying.
your secretprivate · stays in this tab
…
public fingerprint · MiMC7(secret)public
…

Both proofs below say the same thing: “I know a secret whose MiMC7 hash is this fingerprint.” Neither one contains the secret.

item 01-a
Groth16
circom · snarkjs · BN254 pairings
forgeable on q-day
  1. 01Load snarkjs, the circuit (47 KB) and its proving key (195 KB)
  2. 02Compute the witness and prove
  3. 03Verify, with snarkjs and again from Solana-layout bytes
item 01-b
ZK-STARK
witness prover · sha-256 · fri
holds on q-day
  1. 01Run MiMC7 and keep every state (the trace)
  2. 02Mask the trace, commit with a SHA-256 Merkle tree
  3. 03Build the constraint polynomial
  4. 04Commit to it, plus a random mask
  5. 05Sample a point outside the domain (DEEP)
  6. 06FRI: fold 8 times, commit each layer
  7. 07Proof of work (16 bits)
  8. 08Open 26 random queries
experiment 02

On the list.
Not which one.

The pattern behind private airdrops and anonymous votes. Join a 1,000-member Poseidon Merkle tree, prove membership with Groth16, and play the claim program: a second claim is caught by its nullifier, and a copied proof can't be redirected to another wallet.
the list · depth 12 Poseidon tree

Each member is a Poseidon commitment to a random secret. You get one slot at random. The list (and the program checking claims) only ever stores the root.

A fresh throwaway address. Paste your own if you like; nothing is sent anywhere.

list & nullifiers: hash-based, survive q-daythe groth16 proof: forgeable on q-day
experiment 03

Add it up.
Never see it.

Twisted ElGamal on ristretto255, the scheme behind Token-2022 confidential transfers. Encrypt two amounts, add the ciphertexts, and decrypt only the total. Then see why this is the part of Solana's ZK stack a quantum computer hurts most.
your elgamal key · ristretto255

Each amount becomes a 64-byte ciphertext: a Pedersen commitment C = x·G + r·H and a decrypt handle D = r·P. Same construction as Token-2022 confidential transfers.

ciphertexts: readable after q-daypublic key 32 B · ciphertext 64 B