End-to-end encryption hides what you said. Zumbra hides that you said it. Shipped, audited, and running on mainnet today.
On-chain · public forever
Your device · decrypted locally
The gap nobody closed
Confidential Transfers went live on mainnet in September 2026. They hide balances and transfer amounts behind ZK proofs — and leave sender, recipient and mint in the clear. For payments that is a trade-off. For messaging it is the whole threat model.
A message today
Amount encrypted. Everything that matters for a messaging app is not.
A message on Zumbra
The transaction proves a valid message exists. It says nothing else.
Confidential Transfers v1 activated on Solana mainnet in September 2026, after the ZK ElGamal proof program was re-enabled in June following an independent audit. Zumbra builds on that foundation rather than around it.
Inherited from Zcash
Zumbra does not invent cryptography. It ports the one shielded-pool design that has survived a decade of adversarial review, and runs it at Solana's 400 ms block time.
Proof-system lineage
BCTV14 · trusted setup
Groth16 · pairing-based SRS
Halo 2 · setup eliminated
Halo 2 on Solana · messaging
Arithmetisation
Zcash shipped Halo 2 in Network Upgrade 5 (May 2022) for the Orchard pool. Its UltraPLONK arithmetisation with custom gates and lookup arguments is what makes a circuit this large practical to prove on a laptop.
Setup
Halo 2 uses the inner-product argument over Pallas/Vesta rather than a pairing-based SRS. There is no ceremony, no toxic waste, and no participant whose honesty you have to assume. Sapling's Groth16 needed one; Orchard does not.
Recursion
Halo's cycle of curves lets one proof verify another, so a batch of messages collapses into a single on-chain verification. Recursion is what keeps per-message cost flat as the pool grows.
Nowhere does the statement mention an address. That is the point — the chain verifies the four claims above and is structurally incapable of learning anything past them.
zero-knowledge, literally: the verifier ends the interaction knowing nothing it could not have computed on its own.
Membership — the note I am spending is a leaf in the commitment tree at a recent anchor
Authorisation — I hold the spending key for that note
Uniqueness — its nullifier has not appeared before, so this note cannot be replayed
Well-formedness — the new commitment and ciphertext are correctly derived
// public inputs — all the chain ever sees
x = { anchor, nf, cm }
// private witness — never transmitted
w = { note, path, ask, nk, rcm }
assert Halo2.Verify(vk, x, π)Anatomy of a shielded message
Proving happens in your client. Solana only ever sees the last step.
A per-conversation key is ratcheted forward (X3DH handshake, Double Ratchet thereafter). Compromising today's key does not open yesterday's messages.
k_n ← KDF(k_n-1, dh(sk_a, pk_b))The plaintext is padded to a fixed 1,024-byte frame before encryption. Every message on the network is exactly the same size, so length leaks nothing.
ct ← AEAD(k_n, pad(msg, 1024))A note commitment binds the ciphertext to the recipient's diversified address. The nullifier that will later spend it is derived deterministically from the note and your key.
cm ← Poseidon(d, pk_d, ct)
nf ← Poseidon(nk, ρ)The Halo 2 circuit is satisfied locally — Merkle path, key ownership, nullifier derivation, output well-formedness. Your secrets never leave the device.
π ← Halo2.Prove(pk_circuit, w, x)A relayer submits the proof, nullifier and commitment. The program checks the anchor is recent, the nullifier is unseen, and the proof verifies. Then it appends the leaf.
verify(π) ∧ !seen(nf) → tree.append(cm)Guarantees
Each of these is a property of the deployed construction, not a policy we promise to follow. Policies change hands. Circuits do not.
Sender and recipient are never written to the chain in any form — not hashed, not encrypted, not present. There is no field to subpoena.
Double Ratchet key rotation means a seized device yields the current conversation state and nothing before it.
Halo 2's inner-product argument removes the ceremony entirely. No SRS to leak, no toxic waste to destroy.
Witnesses are assembled and proven on your device. A compromised relayer sees a valid proof and an opaque blob.
Fixed 1,024-byte frames plus optional cover traffic. An observer cannot distinguish a message from silence.
Viewing keys let you hand a specific auditor a specific thread — scoped, revocable, and your decision alone.
Network
No waitlist, no invite code, no testnet detour. The program is deployed, the circuit is audited, and the anonymity set grows with every message.
Shielded notes in pool
Proofs verified · 24h
Median proof time
Current slot
Zumbra runs in the browser — the proving key streams on first load and everything after that happens on your device. There is no account to create, because there is no account.
No tracking pixels on this page. It would be an odd way to start.
The ones worth answering honestly.
Live. The verifier program is deployed to mainnet-beta, the Halo 2 circuit has been audited, and the commitment tree has been accumulating notes since August 2026. Connect a wallet and send one — there is no waitlist and no invite code. The network panel above reads from the deployed program.
Signal encrypts content extremely well, and it is the right benchmark for that. But Signal servers route your traffic, which means a server-shaped place exists where delivery metadata could be observed or compelled. Zumbra removes the server: messages settle as shielded notes on Solana, and there is no account in the transaction to compel.
It does, and they are genuinely good — the ZK ElGamal proof program was re-enabled on mainnet in June 2026 after an independent audit of the verifier fix, and Confidential Transfers v1 activated in September 2026. But the Token-2022 extension encrypts amounts and balances while leaving sender, recipient and mint public. For a payment that is often an acceptable trade. For messaging, the participant graph is precisely the thing worth hiding.
Because the shielded-pool construction — note commitments, nullifiers, a Merkle accumulator, a proof of membership-plus-authorisation — is the most heavily attacked privacy design in the industry and it has held. Halo 2 additionally removes the trusted setup that Sapling's Groth16 required. Novel cryptography is a liability in a privacy product; we would rather inherit a decade of review.
A proof, a nullifier, a commitment, a Merkle anchor, and a fixed-size ciphertext. It verifies the proof, checks the nullifier has not been used, and appends the commitment. It cannot determine which note was spent, who owns it, or who the output is for — that information is not in the transaction in any recoverable form.
Yes, and deliberately on your terms. Viewing keys give a chosen third party read access to a chosen conversation, scoped and revocable. The distinction that matters: disclosure is a key you hand over, not a backdoor someone else already holds.
Proving is the cost centre, not settlement. A note-spend proof takes roughly a second in browser WASM on a modern laptop and is generated before the transaction is ever submitted. On-chain verification fits inside a single Solana slot, and recursion lets a batch amortise to one verification. In practice a message lands in about two seconds end to end.