Prove it.
Reveal
nothing.
A zero-knowledge lab for Solana. Make real proofs in your browser and weigh them against a transaction. Find out which ones a quantum computer could forge, and see what your wallet already gives away.
One secret.
Two proofs.
Three curve points. Solana checks it with its alt_bn128 syscalls in about 78,000 compute units.
Only hashes. Nothing for Shor's algorithm to attack, and no trusted setup to leak.
Can you shrink a STARK by wrapping it in a SNARK? Yes, and production systems do. But the wrapper is a pairing proof again, so it inherits the pairing's quantum weakness. Small, quantum-safe, and checkable in a single Solana transaction: today you get two of the three.
What q-day
actually breaks.
- B-1Groth16 proofpairing SNARK on BN254 · what Solana verifies todaysecrets:holds
Old proofs stay silent. Groth16 is perfectly zero-knowledge, so a proof holds no information about the secret, even for an attacker with unlimited compute.
forgeries:breaksShor's algorithm solves discrete logs on the setup's public points, which gives the trapdoor. With the trapdoor anyone can prove false statements.
- B-2Witness ZK-STARKSHA-256 Merkle trees + FRIsecrets:holds
The trace is masked with random polynomials and every opened leaf is salted. Hiding rests on hashes alone.
forgeries:holdsNo curve to attack. This style of proof is proven secure in the quantum random-oracle model (Chiesa–Manohar–Spooner, 2019).
- B-3Encrypted balancetwisted ElGamal · Token-2022 confidential transferssecrets:breaks
Your ElGamal public key sits on chain. Shor turns it into the decryption key, and every ciphertext ever stored opens: harvest now, decrypt later.
forgeries:breaksThe proofs attached to each transfer are built on the same curve, so they can be forged too.
- B-4Hash commitmentPoseidon · allowlists, nullifiers, ZK compressionsecrets:holds
With a random salt, a commitment hides what is inside. Quantum attacks on hashes are generic and give only a square-root speedup.
forgeries:holdsYou cannot open a commitment to something else without finding a hash collision.
- B-5Your wallet signatureEd25519 · every Solana transactionsecrets:n/a
Nothing secret is inside a signature.
forgeries:breaksYour address is your public key. Shor recovers the private key from it.
Old Groth16 proofs never give up your secret. Not even to a quantum computer.
What breaks is trust in new proofs. Encrypted balances lose their secrecy completely.
Read the briefingRun it.
Don't trust it.
Your wallet
already talks.
- subject
- 7Gk2…f9Qx
- first deposit
- 0.25 SOL from a busy hub, likely an exchange
- linked wallets
- 3, by repeat transfers
- asleep
- 05:00–11:00 UTC · UTC−6 to UTC−4
- on display
- $48,210
- primary name
- someone
Five briefings.
Every claim sourced.
- briefing 01Proof without the revealWhat a zero-knowledge proof promises, how a conversation becomes a single message, and where Solana already uses one.7 min
- briefing 02Commitments, Merkle trees and nullifiersThe hash-based building blocks behind private allowlists, airdrops and ZK Compression, and why they hold up against quantum attacks.8 min
- briefing 03SNARKs: why a proof can be 256 bytesCircuits, Groth16's single pairing check, the trusted setup it needs, and exactly what Solana charges to verify one.9 min
- briefing 04Q-day for proofsShor and Grover, what each one breaks, why old Groth16 proofs keep your secret, why encrypted balances don't, and the cost of going hash-based.10 min
- briefing 05ZK on Solana todayThe syscalls, groth16-solana, ZK Compression, confidential transfers after their 2026 return, and what bigger v1 transactions change.9 min
This panel is the only source of official Witness addresses. Compare every character before you trust an address.
notice · Witness is not an audit or a certification, and running the lab does not make anything quantum-safe. The STARK prover was written for teaching: tested here, not audited. The Groth16 phase-2 setup has a single contributor, which is fine for a demo and not for money. Throwaway secrets never leave your browser. Read the docs.