Zcash vs Monero: how the privacy actually differs, and which to use

Both coins exist to solve the same problem: on Bitcoin and almost every other chain, anyone can see which address paid which, how much, and follow the money from there. Monero hides the parties and the amount of every transaction. Zcash hides the transactions you choose to shield and leaves the rest as public as Bitcoin. Most of the practical differences follow from that one decision.

Neither is "untraceable". Both resist on-chain analysis when used correctly, and both can be undone by mistakes made off-chain. This is what each one hides, what it does not, and which fits which situation.

How Monero hides a transaction

Every Monero transaction hides three things with three separate mechanisms.

The receiver is hidden by a stealth address: the sender derives a fresh one-time address for each payment, so two payments to the same person share nothing visible on-chain.

The sender is hidden by a ring signature: the real input is signed alongside 15 decoy outputs pulled from the chain, so an observer sees sixteen possible sources and cannot tell which one spent. Ring size has been fixed at 16 since 2022.

The amount is hidden by RingCT, which locks the value in encrypted form while still letting the network check that inputs equal outputs.

Because this applies to every transaction, no Monero transaction has a public mode. A holder can hand a view key — a secondary key that reveals incoming payments without allowing spending — to an accountant, but the chain itself has no public mode.

What Monero does not hide: that a transaction happened and when, your IP address if you broadcast without Tor, and anything an exchange recorded when you bought it. Its decoy model has also had weaknesses over the years, where the way wallets picked decoys let analysts guess the real spend more often than chance; those were mitigated by later changes to decoy selection and larger rings rather than eliminated. The planned successor, full-chain membership proofs (FCMP++), would replace decoys with a proof over the whole chain. It is in development and not live.

How Zcash hides a transaction

Zcash has a transparent pool, which works like Bitcoin — t1… and t3… addresses, visible amounts, a public graph — and a shielded pool, which uses zero-knowledge proofs: a small proof that a transaction is valid which reveals nothing else. The shielded side is really a few generations of pool; the current one, Orchard, arrived with the NU5 upgrade in May 2022 and uses the Halo 2 proof system, which needs no trusted setup (a one-time ceremony whose secret material, if leaked, could let someone forge coins — the older Sapling pool still relies on one). A shielded transaction reveals to the chain that a valid transaction occurred, its fee and its timing; the sender, receiver and amount are encrypted.

The hiding set for a shielded spend is every note (a shielded coin) in the pool it lives in, not sixteen candidates. That is stronger in principle. In practice the pool is only as large as the number of people who shield: as of 2026, public pool-balance trackers put roughly a quarter to a third of the supply in shielded pools, up sharply from earlier years but still a minority.

Unified addresses (u1…), also introduced with NU5, let a wallet publish one address that receives into the shielded pool by default. A viewing key lets you disclose your own account history to a chosen party without publishing it.

What Zcash does not hide: anything done with a t1… address, which is what many exchanges hand out. Funds moving from the transparent pool into the shielded pool are visible as a shielding transaction — the amount entering is public even though where it goes afterwards is not — and the same applies in reverse when unshielding. A user who receives ZEC to a transparent address and never shields has Bitcoin-grade privacy: pseudonymous, and traceable.

Mandatory versus optional, in practice

The design choice shows up in three places.

Who is in the private set. On Monero every transaction is private, but each spend hides among 16 candidates. On Zcash a shielded spend hides among the whole pool, but only the minority who shield are in it, and a transaction can leak by crossing between pools. If you use Zcash for privacy you have to use the shielded side deliberately — receive to u1…, keep funds shielded, send shielded — and each lapse is a leak that Monero does not let you make.

Exchange access. Several major exchanges removed XMR from 2024 onward under regulatory pressure, Binance among them in February 2024. ZEC has been delisted less often; the usual explanation is that its transparent pool and viewing keys let them comply. If you need to move between fiat and a privacy coin through a regulated venue, that matters.

Disclosure. Both coins let you prove a payment to a third party — Zcash through viewing keys, Monero through view keys and per-transaction proofs. Zcash additionally lets you operate fully in public when you want to, which some businesses and some jurisdictions require.

Can either be traced?

On-chain, a correctly used shielded Zcash transaction gives an analyst no amount, no counterparty and no graph. A Monero transaction gives no amount and no counterparty, and a graph of sixteen candidates per input rather than one. Tracing rarely happens on-chain alone, though. It happens where privacy coins meet the rest of the world: an exchange that knows your name and saw you withdraw; an IP address in a node's log; a transparent Zcash address you reused; the timing between a Bitcoin send and a Monero receive.

Monero removes on-chain tracing for everyone and leaves the off-chain problems to you. Zcash removes it for the shielded pool and leaves both the off-chain problems and the discipline of staying shielded to you.

Which one, for what

You want privacy without having to think about it. Monero. No wrong address to give, no unshielded mode to fall into.

You want privacy with the option of proof or public use. Zcash. Receive to a unified address, keep funds shielded, and use a viewing key or a transparent address on the occasions you need one.

You need to move through regulated exchanges. Zcash is more likely to be listed. Monero increasingly has to be bought peer to peer or swapped from other coins.

You are choosing on protocol design alone. Zero-knowledge proofs give Zcash the larger hiding set per transaction; Monero's mandatory model makes every user's transactions private, where Zcash's shielded pool holds a minority of the supply.

Swapping between them

SwapToZec pays out both and accepts both as deposits. For Monero, give a standard (4…) address, a subaddress (8…) or an integrated address. For Zcash, a unified (u1…) address carries a shielded receiver and is the one to give if you want the payout in the shielded pool; t1… and t3… are accepted too. Both directions work — Zcash to Monero and Monero to Zcash — as does any of Bitcoin, Ethereum, USDT and 16 other coins into Monero or Zcash. The rate, the 0.5% swap fee and the network fee are shown before you send, and no account is involved.

For the Zcash side in more depth: shielded vs transparent addresses and unified addresses explained. For getting Monero without an exchange at all: how to buy Monero without KYC.