The ZK App Mental Model

Every ZK system — regardless of the proof system, the toolchain, or the use case — has exactly three components.

The Witness

The witness is the secret.

It's the private input — the data the prover knows but will never reveal. Your age. Your private key. Your salary. The preimage of a hash. Whatever the thing is that you're trying to prove knowledge of without exposing.

In code, you'll see it referred to as: - witness in Circom - private inputs in Noir (let x: Field declared without pub) - w or aux in academic literature `` Witness = the secret data only the Prover holds ``

One important distinction: the witness is not the proof. The proof is derived from the witness. The witness itself never leaves the prover's machine.

The Prover

The prover is the party with the secret — and the one doing the heavy lifting.

They take the witness, feed it into a circuit alongside any public inputs, and run the proof generation process. The output is a compact cryptographic proof that says: "I ran this computation correctly and I know valid inputs that satisfy it." `` Prover = holds the witness → runs the circuit → outputs a proof ``

In a real ZK app, the prover is typically the user's device — their browser, mobile app, or local machine. The computation happens client-side. The proof is what gets sent out.

Proof generation is computationally expensive. This is the slow part of ZK. The verifier's job, by contrast, is cheap.

The Verifier

The verifier receives the proof and checks it — without ever seeing the witness.

They only need two things: the proof and the public inputs (the parts of the computation that are meant to be visible). From these, the verifier runs a fast mathematical check and outputs one of two answers: true or false. `` Verifier = receives proof + public inputs → checks → accept or reject ``

In a ZK app, the verifier is typically a smart contract deployed on-chain. It doesn't re-run the computation. It just verifies the proof is valid. This is why verification is fast and cheap — even if the original computation was enormous.

Public Inputs vs Private Inputs

Not everything in a ZK proof is secret. You always have:

| | Who sees it | Example | |---|---|---| | Witness (private input) | Prover only | Your exact salary | | Public input | Everyone | The threshold you're proving against | | Public output | Everyone | true — you are above the threshold |

A concrete example: you want to prove your credit score is above 700.

• Witness: your actual credit score (e.g. 742) — private
• Public input: the threshold 700 — visible to the verifier
• Public output: 1 (true) — the verifier accepts the proof

The verifier learns that your score is above 700. They learn nothing else.