Monero vs Zcash: one hides every payment, the other only while you stay shielded

Which one, for the payment you cannot afford to publish

Use Monero when you will not inspect the address. Use shielded Zcash when you will stay in one pool and someone must see both directions without spending. Is Zcash more private than Monero? Only on a payment that stays fully shielded, where the proof is the pool rather than a ring of 16. If you will not check a setting, Monero is the stricter coin.

Only one of the three Zcash wallets keeps the history private

The getting-started page sorts wallets into three. One shields every payment, so addresses, history and memos stay off the public chain. One lets you choose, payment by payment. One allows only transparent transactions, and those expose the wallet and the payments. Bitcoin, the same page says, only allows that last kind. The short version on their difference page is the one to remember: a shielded address keeps the financial information private, and a transparent address makes it public.

Monero's FAQ calls the mandate exclusive to Monero. Read that next to Zcash's own page. Zcash declines the mandate: the chain will publish a payment when the address is transparent, and the project says so. Exclusive, in the FAQ, means no other coin forces privacy on every transaction. A shielded Zcash payment is still Zcash, with a public mode beside it.

A unified address was supposed to spare you from picking the pool by hand, and it hid the risk instead. Revision 0 of ZIP 316 is the active format. The ZIP records the complaint itself: you could not tell, by looking, whether the address was willing to receive transparent funds, and a transparent receiver inside it tempted the sender to fall back to a transparent transfer. Revision 2 would mark a shielded-only address with a zu prefix and a transparent-capable one with tu. That revision is still a draft. A prefix your wallet does not show is not a rule you can follow. The rule on the getting-started page is the one that exists this week: use a wallet they mark shielded by default, the shield icon on their ecosystem list.

ZIP 315, also still a draft, is the wallet note that says funds should sit shielded over the long term, and that transparent receipts should be shielded on arrival rather than left in the public pool. Moving them is not quiet. A shielding transaction is linked to the transparent addresses it spends. Those addresses get linked to each other, and the recipient, or anyone holding an incoming viewing key for the destination, can see the link. The ZIP also says not to shield from several transparent addresses in one transaction, and not to fold the shielding into some later payment you meant to keep separate. Entering the pool leaves a seam. The private history starts after that seam, not before it.

Is Zcash anonymous? A transparent address is not. A fully shielded payment is the one the project calls private, and the spec limits that claim to a payment that stays shielded. Anonymity is the wrong word for the exchange that already holds your name. What that withdrawal record still contains does not change because the coins later sat in a pool.

A shielded spend hides in its own pool, not in every ZEC

The spec's claim, in the 16 October 2026 text at NU6.2, is narrow: when a note is spent, the spender proves that some commitment for it was revealed, without revealing which one. From an outsider's point of view the candidates, which the spec calls the note traceability set, are the earlier notes that outsider does not already control or already know were spent. The next sentence is the comparison with Monero's family of designs. CoinJoin and CryptoNote mix a limited number of transactions, and the spec says those mixes have smaller traceability sets. Monero is the CryptoNote line. Its sender set today is a ring of 16, and the project marks that row probabilistic. Whether a Monero payment can be traced, and where the name gets attached, is the Monero page. A shielded spend, in that contrast, is not a list of decoys.

The spec then limits its own sentence. The claim is only for a fully shielded transaction. It does not stop an outsider from using what the transaction still prints in the clear, and the examples it gives are the number of inputs and outputs, or a timing guess. A payment can be shielded and still look unlike the one before it, because it was built at an unusual hour or it moved an unusual number of notes. The proof did not fail. The cleartext was never inside the proof.

ZIP 224 is what stops the phrase "all earlier notes" from meaning every ZEC. Orchard is a separate anonymity set from Sprout and from Sapling. The new pool started empty, the way Sapling had. Spending Orchard funds to a non-Orchard address reveals the value of the transaction. The ZIP calls the mechanism a transparent turnstile, and it says a wallet should tell you, in the act of building the payment, that the amount is about to be published. Hide in the pool you actually spend inside. Walking out prints the amount. When the overview and this ZIP disagree about how large the set is, use the ZIP. The overview is a fully shielded payment. The ZIP is the fact that the pools are not one crowd.

The turnstile is also how Zcash checks the supply. ZIP 224 says each pool's balance is not allowed to go negative, so a counterfeiting bug in Orchard stays inside Orchard, and a bug in an older pool cannot inflate Orchard. Monero's note of 17 January 2020 says the same trade in the other direction. A transparent supply can be counted. Hidden amounts, which that note names for Monero and for shielded Zcash, put the guarantee on the proof being right. It says a flaw of that kind did hit Zcash, and that pushing exploited funds through the transparent pool could be spotted, with the consequence that remaining funds, honest holders included, could be frozen. Monero's note says there are no plans to add that kind of detection. The cap sits on Zcash's side of the same choice. The spec sets MAX_MONEY at 2.1 × 10¹⁵ zatoshi, defines one ZEC as 10⁸ zatoshi, and rejects a block that would push issued supply over the cap. That cap is 21 million ZEC. Monero's FAQ describes a tail instead of a cap: emission changed at block 2,641,623, on 9 June 2022 at 00:29 UTC, and stays at 0.6 XMR per block, with no maximum supply. The countable cap and the uncapped tail are the privacy decision again. Neither figure is a reason to hold the coin.

Does Zcash still use a trusted setup?

Not for Orchard, the current shielded pool. Sprout and Sapling used a ceremony, and people still describe the whole coin as if that were still the design. It is stale for the pool ZIP 224 tells wallets to move into. Before Halo, the zk-SNARK page says, the efficient way to put a short proof on a chain was a setup that generated public parameters. Anyone who had the secret randomness from that setup could forge proofs that looked valid. On Zcash, forged proofs would have been counterfeit coins. The parameters came from two ceremonies, one for each of those older pools. ZIP 224 counts them: 6 participants in the Sprout ceremony, and around 90 per round in the Sapling ceremony two years later. It also records that the original Sprout proving system, BCTV14, had a bug that left shielded Zcash open to counterfeiting until the proving system was replaced and a new ceremony was run.

Network Upgrade 5, in May 2022, added the Orchard protocol and Halo 2. The same page says Halo removed the trusted setup and still met the speed a payment network needs. ZIP 224's reason for building Orchard is a proving system that does not need the structured reference string the older circuits required. Monero's Bulletproofs are not that ceremony. The page quotes the paper: short non-interactive zero-knowledge proofs that require no trusted setup. The ceremony is not the difference between the two coins you would use now. It is why Zcash still carries older pools, and why the funds are supposed to end up in Orchard.

The key you can hand someone, and the one that spends

A charity that must show what arrived and what left, without posting an address the whole chain can read, is the job the full viewing key is for. On Sapling and on Orchard the spec derives that key from the spending key, and it recognizes both incoming and outgoing notes. Spending authority is not included. You can give the key to an accountant, or to the person who has to file the receipt. You have not given them the coins.

Monero's own name for this idea is "private, optionally transparent." The chain is opaque, and the view key is the allowance you can share. What the allowance covers is incoming transactions for that address. Outgoing transactions, the page says, cannot be reliably viewed, and it dates that limit to June 2017. Therefore, it says, the balance shown via a view key should not be relied upon. The page still says so. A shared Monero view key is a record of what came in, plus a balance you are told not to trust. It is the wrong file if the question was what you spent.

The seed is not that key. On both coins the phrase that restores the wallet can spend, and a viewing key cannot. Sharing the seed with the person who asked for an audit is how the audit becomes their coins. Which Monero app keeps the view key on the device, and which lightweight wallet gives it to a node, is the wallet section of the Monero page.

The exchange's file, and the computer that sent the payment

Neither proof edits the record at the exchange that sold you the coins. The company kept the withdrawal: that it happened, what it sent, and where it sent it. A shielded Zcash payment after that changes what a stranger can read on the chain. It does not change the exchange's copy. The hub draws both branches, transparent and shielded, with that file on the left of the picture. Leaving the coins on the exchange means there is no proof in the path at all. The company has the name and the balance.

A venue can treat the two coins differently because a transparent Zcash payment can be read the way a Bitcoin payment is read, and a Monero payment cannot. Optional privacy gives the venue a public payment to point at. Mandatory privacy does not. Kraken's European delisting, and the dates, are on the Monero page. The EU rule that tells a trading platform to keep out a coin with an inbuilt anonymisation function, unless it can identify holders and their history, is the hub's legal map, beside why a listing dies.

The other copy is the computer that announced the transaction. The shielded proof and the ring are statements about the ledger. They are not a statement about your IP. What a remote Monero node can see, and what wrapping the node in Tor changes, is spelled out on that page, including the project's own split between the chain and the network. A cold key does not choose the address type either. It signs the transaction the online wallet built. If that wallet built a transparent Zcash payment, the chain publishes a public payment that happened to be signed on a machine that never saw the network.

If you will not look at the address, take Monero, and then read what the ring leaves open. If you will keep the coins inside the shielded pool and someone has to see both directions without spending, take Zcash, and do not spend out of the pool when the amount has to stay hidden. A payment you wanted published was Bitcoin the whole time, and the exchange's file is there on either coin.