Private Zcash (shielded balance)

Simple

Zcash (ZEC) can be held in two ways. Public ZEC is like a shop window: anyone can see how much is there and where it goes. Private ZEC, called shielded, is like a sealed envelope: the amount, who sent it and any note inside stay hidden from everyone else.

On the ZEC page, flip the ZEC card to its private side to see your shielded balance. Whichever side is showing decides what Send and Receive do, so you can pay and get paid privately. After you open the app, the private balance can take a moment to catch up.

Shield ZEC moves your public ZEC into your private balance; Unshield ZEC moves some back to the public side. Exchanges usually only pay public addresses, so give them your public ZEC address.

Tip: moving ZEC between the two sides can be seen publicly. Leave some time between moves and avoid shielding and unshielding the exact same amount, so nobody can match them up.

Every account type is private: Kalda uses your private ZEC on its own. The card's private side shows with the Developer account type.

Detailed

Two pools in one coin

Zcash is a public blockchain with two kinds of value. Transparent ZEC (addresses starting t1) works like Bitcoin: amounts and addresses are public. Shielded ZEC lives in shielded pools, where the network verifies every payment without seeing the amount, the sender or the recipient.

• Sapling (2018) was the first widely used shielded pool; its addresses start with zs1. • Orchard (2022) removed the need for a trusted setup. • Ironwood, introduced by the NU6.3 network upgrade in 2026, is the pool that receives new shielded value; Orchard notes can still be spent out.

Unified addresses

A unified address (it starts with u1, defined in ZIP 316) bundles several receivers into one string. A paying wallet must use the most private receiver it supports, so wallets that handle shielded payments pay you privately.

Every shielded payment can carry an encrypted note (a memo) of up to 512 bytes that only the recipient can read. Fees follow ZIP 317, Zcash's published fee rule: a typical shielded payment costs 0.0001 ZEC, a little more when it combines many smaller amounts.

Light-wallet servers

A phone can't hold the whole Zcash blockchain, so light wallets download compact blocks from a light-wallet server (lightwalletd is open source, and anyone can run one). The wallet recognises its own payments on the device; the server never gets the keys, though like any server it sees the connecting IP address.

In depth

Commitments instead of balances

A shielded pool doesn't record who owns what. Each payment creates notes: small records of a value, an owner and some randomness. Only a commitment to each note is published, a cryptographic fingerprint that binds the note's contents without revealing them. All commitments are collected in an append-only Merkle tree, whose root summarises every note ever created.

Nullifiers stop double spending

Spending a note publishes its nullifier, a value derived from the note and the owner's secret key. Anyone can check that a nullifier has never appeared before, yet nobody can tell which commitment it belongs to. The same note always gives the same nullifier, so it can't be spent twice.

Zero-knowledge proofs

Each spend carries a zk-SNARK: a short proof that the spender knows a note in the tree, holds its key, computed the nullifier correctly, and that inputs equal outputs plus the fee, all without revealing any of those values. Sapling uses Groth16 proofs on the BLS12-381 curve, which needed a one-time trusted-setup ceremony; Orchard-style pools use Halo 2 on the Pallas and Vesta curves, which needs none.

Finding your payments

Each note is encrypted to its recipient with elliptic-curve Diffie–Hellman key agreement: the sender combines a fresh random key with the recipient's address to reach a shared secret that only the recipient can also compute. A wallet tries to decrypt every new shielded output with its incoming viewing key, and only its own succeed. This is called trial decryption.

What stays visible

Moving value between the transparent and shielded sides is public on the transparent side, so matching amounts and timing can link the two moves. Inside the pool, privacy grows with the anonymity set: the more people use shielded payments, the harder any one note is to trace.