Groth16 / BN254 Proof Verifier

Paste a Groth16 proof, its verifying key and the public signals (snarkjs JSON format) and run the BN254 pairing check entirely in your browser. Verifies proofs from circom + snarkjs pipelines, zk-rollup wrappers (Brevis Pico, Citrea/RISC Zero) and any other system that emits Groth16 over BN254. Nothing is uploaded.

Verifying key (verification_key.json)

{
 "protocol": "groth16",
 "curve": "bn128",
 "nPublic": 1,
 "vk_alpha_1": [
  "13649508873720032808586204533728921249957072675078229541223572768187171708079",
  "18668166426064477844382808183998154169889137803781440671877552076505211553780",
  "1"
 ],
 "vk_beta_2": [
  [
   "15943283550373205811514633813440941792498876164835751219395945056590809645200",
   "18812426943422734162575386056734186836500705497256458798009681480828783233328"
  ],
  [
   "4942269559365615829554193787233276470692098502402651459217267890180020244702",
   "9346503046692781850619757014303590063796964767920120942564462269258258948128"
  ],
  [
   "1",
   "0"
  ]
 ],
 "vk_gamma_2": [
  [
   "10857046999023057135944570762232829481370756359578518086990519993285655852781",
   "11559732032986387107991004021392285783925812861821192530917403151452391805634"
  ],
  [
   "8495653923123431417604973247489272438418190587263600148770280649306958101930",
   "4082367875863433681332203403145435568316851327593401208105741076214120093531"
  ],
  [
   "1",
   "0"
  ]
 ],
 "vk_delta_2": [
  [
   "10857046999023057135944570762232829481370756359578518086990519993285655852781",
   "11559732032986387107991004021392285783925812861821192530917403151452391805634"
  ],
  [
   "8495653923123431417604973247489272438418190587263600148770280649306958101930",
   "4082367875863433681332203403145435568316851327593401208105741076214120093531"
  ],
  [
   "1",
   "0"
  ]
 ],
 "vk_alphabeta_12": [
  [
   [
    "13492592636338327034545822602503374768952742203628271076086881766657921112286",
    "7060600215298133067168918456879850022840762557968232982638003041868085359011"
   ],
   [
    "1772116311766490323717275028327929793364438001998907406275171760915168818442",
    "15195393660346893091881488267000630505611538888541431488492645790490392326865"
   ],
   [
    "5530150815489573434342828450116861606901968129346185562673588804967228599391",
    "15536050543615247714706484647522472535158273476369754203804416453453636549284"
   ]
  ],
  [
   [
    "4257449530303637745494566351148695083142240900110424788032529121863672069463",
    "15618098141683743644875021891194308984498759226401274912679811774214409310434"
   ],
   [
    "6558211481046217478905076116255478608568175308934868548467416012188271122224",
    "21510947978404372226295679846611057080753141183113985330256816315751264369016"
   ],
   [
    "18068946696678443711649803625957910022475684509364910160091283410937306804455",
    "4682155846837849466741141552326614337856774870948075814949519694833510400243"
   ]
  ]
 ],
 "IC": [
  [
   "1681147148305236771944886207864143911345213140756501260316405232773046648684",
   "3366698229029085549685296769341531129446235478903284509655128633524157330630",
   "1"
  ],
  [
   "15406461600403762065249905317401596885697636018287391249037130184761793528687",
   "11731635155616754246433523101619351820781873125222290165444438444929309818893",
   "1"
  ]
 ]
}

Public signals (public.json)

Proof (proof.json)

What the verifier checks

Groth16 proofs are three elliptic-curve points (pi_a, pi_b, pi_c) over the BN254 curve (snarkjs calls it bn128). Verification evaluates one bilinear pairing equation: e(pi_a, pi_b) = e(alpha, beta) · e(sum(publicSignals[i] · IC[i]) + pi_c, delta). If both sides match, the prover knew a witness satisfying the circuit for exactly those public values - without revealing the witness.

The sample above is a real, tamper-tested fixture: a multiplier2 circuit (c = a × b) with public signal 33, generated with circom 2 + snarkjs. Change 33 to any other number and the pairing equation breaks - try it.

FAQ

What can I verify with this tool?

Any Groth16 proof over BN254 in snarkjs JSON format: circom/snarkjs circuits, Semaphore-style protocols, zk-rollup Groth16 wrappers (Brevis Pico's EVM path, Citrea's RISC Zero wrapping), and Tornado-style private withdrawal proofs.

Does it verify PLONK, Halo2 or STARK proofs?

No - those use different proof systems. Groth16 only. The file's protocol field is checked and a clear error is shown for mismatches.

Is verifying a proof here safe for private data?

Yes. Verification is read-only math on public values (a proof, a verifying key, public signals - none of which are secret), and it runs 100 percent in your browser. Open the network tab and verify zero requests.

What is the difference between BN254 and bn128?

Nothing - they are two names for the same pairing-friendly curve (also called alt_bn128). Ethereum precompiles call it bn254; snarkjs files say bn128.

Continue with

Passkey Address Deriver

Derive EVM addresses from P-256 passkey public keys. For Ritual Chain TxPasskey and WebAuthn wallets.

DKMS Key Visualizer

Visualize how Ritual agents derive identity keys via DKMS from TEE-held roots to purpose-specific keys.

X402 Payment Encoder

Encode and decode X402 payment payloads for agent-to-agent transactions. Build HTTP 402 challenges.