Search

Search projects, tokens and protocols by name or address

Privacy

Privacy

Reviews of privacy protocols on Ethereum: privacy pools, shielded ledgers, stealth addresses, confidential tokens and anonymous access. Each is rated by what it hides from each adversary, alongside its anonymity set and trusted setup where it has them. The reviews follow the CROPS principles: censorship resistance, open source, privacy and security.

Total value locked

4 Nov 2025 — 4 Nov 2026

Total deposit and withdrawal counts

4 Nov 2025 — 4 Nov 2026

Total value locked

4 Nov 2025 — 4 Nov 2026

How to read the privacy rosette

Each slice is one adversary testing the protocol's privacy promise. Read the methodology

  • Private: The promise holds for a careful user with the app's own settings.
  • At risk: The promise holds only with significant extra work, like a custom build or your own servers.
  • Exposed: The promise breaks, and no reasonable effort prevents that.

Link privacy
12

Hides which deposit became which withdrawal. Both stay public.

Name
Setup
1
Tornado Cash logo
Tornado Cash
Tornado Cash
Pool
Privacy assessment
  • Public observer: Private. Each pool has one fixed amount and no in-pool transfers, so every withdrawal spends exactly one deposit.
  • Chain analyst: Private. A relayed withdrawal hides among all unspent deposits of its pool, the anonymity set, which differs sharply between pools.
  • Network observer: Private. The app works in Tor Browser and downloads every deposit of a pool, so its services learn the pool but not the user's note.
  • Privileged insider: Private. The pools cannot be paused, upgraded or made to reveal anything.
  • Future adversary: At risk. Whoever breaks elliptic-curve cryptography can test whether a given deposit could fund a withdrawal, since commitments use a Pedersen hash on an elliptic curve.
$739.40 M1.93%
2
Railgun logo
Railgun
Railgun
Shielded ledger
Privacy assessment
  • Public observer: Private. Everything inside the pool is hidden, including which shield funds which unshield.
  • Chain analyst: Private. The candidates for an unshield are the shields of the same token.
  • Network observer: Private. With a local node as direct endpoint for reads, RailOxide keeps Ethereum reads local and sends the rest over built-in Tor.
  • Privileged insider: Private. Only the user holds viewing keys, and DAO upgrades wait 7 days.
  • Future adversary: At risk. Whoever breaks elliptic-curve cryptography decrypts every note sent to a 0zk address they know.
$107.91 M2.55%
3
Privacy Pools v1 logo
Privacy Pools v1
Privacy Pools v1
Pool
Privacy assessment
  • Public observer: Private. A zero-knowledge proof hides which approved deposit a withdrawal spends.
  • Chain analyst: Private. A relayed withdrawal of a common amount hides among all approved deposits of its pool.
  • Network observer: Private. The website works in Tor Browser and scans every pool whole, matching notes locally without revealing the user's deposits to third parties.
  • Privileged insider: At risk. The ASP postman can publish a new approved list at any time with no delay, and withdrawals must prove against the latest one.
  • Future adversary: Private. Nothing encrypted is written onchain and commitments are Poseidon hashes, so whoever breaks elliptic-curve cryptography recovers nothing from the chain.
$9.09 M0.37%
4
Privacy Pools v2 logo
Privacy Pools v2
Privacy Pools v2
Shielded ledger
Privacy assessment
  • Public observer: Private. A zero-knowledge proof hides which approved notes a withdrawal or transfer spends, and a transfer publishes only encrypted notes.
  • Chain analyst: At risk. A note's label passes to every later payee, and the ASP update that first approved it often leaves one candidate deposit.
  • Network observer: At risk. The default RPCs, led by Alchemy under 0xbow's key, see the account at sign-in and can time it against the withdrawal.
  • Privileged insider: At risk. The ASP postman can publish a new approved list at any time with no delay, and every private spend must prove against the latest one.
  • Future adversary: Exposed. Every registered account's viewing public key sits in the Keystore, so whoever breaks elliptic-curve cryptography decrypts every note ever sent to it from the chain.
$512.72 K14.7%
5
zkAPI logo
zkAPI
zkAPI
Anonymous access
Privacy assessment
  • Public observer: Private. Requests stay offchain, so nothing onchain ties a request to the deposit that pays for it.
  • Chain analyst: Private. Authorizations never reach the chain, so correlating public data adds nothing to the note record.
  • Network observer: Private. The app works in Tor Browser, and no third party sees both a deposit and a request.
  • Privileged insider: Exposed. The operator sees each request's time and budget tier but not its note, and too few active notes cover even the default model's budget to hide among.
  • Future adversary: Private. Note leaves and nullifiers are Poseidon hashes and nothing encrypted is written onchain, so there is nothing to decrypt.
$2.05 K12.3%
No data
6
Monero via Cake Wallet logo
Monero via Cake Wallet
Monero via Cake Wallet
Shielded ledger
Privacy assessment
  • Public observer: Private. The Monero transactions between the deposit into a swap service and the payout from its hot wallet hide sender, recipient and amount.
  • Chain analyst: Private. Only amount and timing can pair a deposit into a swap service with a payout from a hot wallet serving every asset the service trades.
  • Network observer: Private. Over an IP-hiding route, Moralis, Etherscan and PublicNode get each Ethereum wallet in its own session, so none of them sees both legs.
  • Privileged insider: Exposed. Each swap service custodies its leg and can hold the funds until the user passes identity checks, and identities on both legs link them.
  • Future adversary: Exposed. Whoever breaks elliptic-curve cryptography recovers every Monero output key from public chain data, so every ring shows its real spend.
N/A
N/A
7
Interfold CRISP logo
Interfold CRISP
Interfold CRISP
Secret ballot
Privacy assessment
  • Public observer: Private. Ballots stay encrypted, and only the totals per option are decrypted.
  • Chain analyst: At risk. Voting power is public, so the totals per option can reveal how a voter with outsized weight voted.
  • Network observer: Private. The ballot leaves the browser only as ciphertext with its proof, so traffic shows at most that the user sent a ballot.
  • Privileged insider: Exposed. Any 10 of the 19 ciphernodes in a vote's committee can combine their key shares and decrypt every ballot of that vote.
  • Future adversary: At risk. Whoever breaks elliptic-curve cryptography learns at least what the chain analyst sees: the totals can show how a voter with outsized weight voted.
N/A
N/A
8
Zcash via NEAR Intents logo
Zcash via NEAR Intents
Zcash via NEAR Intents
Shielded ledger
Privacy assessment
  • Public observer: Private. Zcash's shielded pool hides which payout into it funds which later exit.
  • Chain analyst: Private. Only the amount and timing of a round trip can pair a payout into the pool with a later deposit to the bridge.
  • Network observer: At risk. Each sync sends the account's transparent addresses to lightwalletd before fetching its transactions, so lightwalletd can tie the payout and the exit to the account.
  • Privileged insider: Exposed. The operator custodies both legs in transit and can freeze any account or deposit, setting the terms on which the user's funds return.
  • Future adversary: Exposed. Whoever breaks elliptic-curve cryptography recovers an account's incoming viewing key from any of its payout addresses, which are public on NEAR.
N/A
N/A
9
STRK-20 logo
STRK-20
STRK-20
Shielded ledger
Privacy assessment
  • Public observer: At risk. Transfers inside the pool are encrypted, but the first payment to each new contact writes the recipient's address in cleartext.
  • Chain analyst: At risk. Every token except STRK has fewer than 1,000 depositors to hide among.
  • Network observer: Private. Every pool request goes through Starknet Holdings' gateway, so AVNU and StarkWare's discovery service see only the gateway.
  • Privileged insider: Exposed. Every user's viewing key is escrowed onchain, encrypted to one auditor key that a role holder can replace at any time with no delay.
  • Future adversary: Exposed. Whoever breaks elliptic-curve cryptography recovers the auditor key from its onchain public key, and with it every escrowed viewing key and the whole history.
$1.08 M1.51%
10
zk.money logo
zk.money
zk.money
Shielded ledger
Privacy assessment
  • Public observer: Private. Private payments publish encrypted notes.
  • Chain analyst: At risk. A DAI withdrawal hides among the DAI portal's depositors, an sUSDS one among the sUSDS portal's.
  • Network observer: At risk. Alchemy, called under Aztec Labs' key, sees an account's deposit addresses and withdrawals in one session unless the user sets their own Ethereum node.
  • Privileged insider: Exposed. An AWS Nitro enclave reads payments, withdrawals and deposit claims, and the image it runs is unpublished.
  • Future adversary: Exposed. Whoever breaks elliptic-curve cryptography can decrypt the notes and events published to Ethereum, since each Aztec address is its owner's encryption key.
N/A
11
Privacy Boost logo
Privacy Boost
Privacy Boost
Shielded ledger
Privacy assessment
  • Public observer: Private. Transfers inside publish only encrypted notes.
  • Chain analyst: Exposed. The anonymity set is very small.
  • Network observer: Exposed. Alchemy, under the operator's key, sees the signed-in wallet in the session that submits each withdrawal, so it can pair them by timing.
  • Privileged insider: Exposed. The operator's enclave holds every transfer in plaintext and a key to every note.
  • Future adversary: Exposed. Whoever breaks elliptic-curve cryptography decrypts every note, since each one also wraps its key to the enclave's long-lived public key.
$720.04 K2.25%
12
Payy logo
Payy
Payy
Shielded ledger
Privacy assessment
  • Public observer: Exposed. Every transaction names the notes it spends and creates, so which notes fund which is public.
  • Chain analyst: Exposed. Along a path without splits or merges, the deposit and withdrawal amounts fix every amount in between.
  • Network observer: Exposed. The payment-link website hands each link's redeem secret to PostHog analytics, which records the full page URL.
  • Privileged insider: Exposed. One company runs the only validator and prover, the node, the note registry, the deposit relayer and the KYC checks.
  • Future adversary: Exposed. Whoever breaks elliptic-curve cryptography learns at least what the public observer sees: which notes fund which.
$710.350.01%
No data

Recipient privacy
3

Hides who is paid. Each payment lands at a fresh one-time address.

Name
1
Umbra Cash logo
Umbra Cash
Umbra Cash
Stealth address
Privacy assessment
  • Public observer: Private. Each payment goes to a fresh stealth address, and only the recipient's viewing key shows whose it is.
  • Chain analyst: Private. Any of the 11,983 registered recipients could be behind a stealth address.
  • Network observer: At risk. The hosted app checks the payee's address with its Alchemy RPC seconds before each payment, so timing ties the payee to the payment.
  • Privileged insider: At risk. The hosted app gives the operator the user's wallet address on every scan and withdrawal address in the same session.
  • Future adversary: Exposed. Whoever breaks elliptic-curve cryptography matches every past payment to its registered recipient from chain data alone.
$1.15 M
2
Cloaked logo
Cloaked
Cloaked
Stealth address
Privacy assessment
  • Public observer: Private. Each payment reaches a fresh address, and nothing onchain names the account behind it.
  • Chain analyst: Private. Cloaked's relayers and fee Safe mark every spend as a Cloaked user's, so an address hides among all stealth addresses Cloaked has ever spent from.
  • Network observer: At risk. Cloaked's servers read and spend each account's addresses through RPC providers such as Alchemy, which can group them by account.
  • Privileged insider: Exposed. Cloaked holds the viewing key, so it can regenerate every address and tie its activity to the user's account.
  • Future adversary: Private. No announcement is published, so address derivations cannot be replayed from the chain alone.
No data
N/A
3
Fluidkey logo
Fluidkey
Fluidkey
Stealth address
Privacy assessment
  • Public observer: Private. Each payment reaches a fresh Safe, and nothing onchain names the account behind it.
  • Chain analyst: Private. At least 2,204 accounts have claimed Fluidkey's 'score' token, giving a lower bound of the anonymity set.
  • Network observer: At risk. Alchemy, behind Fluidkey's proxy, receives the Safes the app shows and can group those of one account.
  • Privileged insider: Exposed. Fluidkey holds the viewing key, so it can regenerate every address and tie its activity to the user's account.
  • Future adversary: Private. No announcement is published, so address derivations cannot be replayed from the chain alone.
No data
N/A

Amount privacy
1

Hides how much moves. Balances and transfers are encrypted.

Name
1
Zama Confidential Tokens logo
Zama Conf. Tokens
Zama Conf. Tokens
Confidential amounts
Privacy assessment
  • Public observer: At risk. Wraps, unwraps and vault batch totals publish their amounts, while confidential transfers keep theirs encrypted.
  • Chain analyst: At risk. An account's balance is bounded by its public wraps and unwraps, and exact if it never took part in a confidential transfer.
  • Network observer: Private. No third party sees a transfer amount, since the app encrypts amounts on the device and reads balances under a key only the device holds.
  • Privileged insider: Exposed. Any 5 of the 13 KMS operators can combine their key shares and decrypt every balance and transfer ever made.
  • Future adversary: Exposed. Whoever breaks elliptic-curve cryptography recovers a user's wallet key from any past transaction and can have the KMS decrypt that user's history.
$117.86 M12.4%
Ready for a new identity?
Onchain privacy best practices