Zcash vs Monero

Short answer: Monero is private by default, so every transaction on its chain hides the sender, receiver and amount, and you cannot forget to turn it on. Zcash's shielded transactions hide more per transaction, using zero-knowledge proofs instead of decoys, but shielding is optional, and a large share of ZEC has historically sat in transparent addresses that are as public as Bitcoin's. If you want privacy that holds without you thinking about it, Monero. If you want strong privacy on demand and an auditable fixed supply, Zcash, used with care.

The one difference that matters most

Zcash vs Monero is mostly a question of defaults.

On Monero, there is no public mode. Every transaction uses the same privacy machinery, so every user is part of everyone else's cover. The anonymity set is the whole network.

On Zcash, there are two worlds on one chain. Transparent addresses (starting with t) work exactly like Bitcoin's: addresses, amounts and history are public. Shielded addresses (starting with z, or unified addresses starting with u that include a shielded receiver) hide sender, receiver and amount. A transaction is only as private as the addresses it touches, and moving ZEC between the two worlds is visible on chain.

Everything else in this comparison follows from that.

How each one hides a transaction

Monero combines three mechanisms. Stealth addresses give every payment a one-time output address, so the receiver's public address never appears on chain. Ring signatures hide the real input among fifteen decoys pulled from the chain. RingCT hides the amount behind a cryptographic commitment. Our post on whether Monero is traceable goes through each in detail.

Zcash uses zero-knowledge proofs (zk-SNARKs). A shielded transaction proves that it spends notes that exist and have not been spent before, without saying which notes, who owns them or how much they hold. There are no decoys: inside the shielded pool, the spent note could be any note in the pool. The current shielded pool, Orchard, uses the Halo 2 proving system, which needs no trusted setup. The older Sprout and Sapling pools relied on setup ceremonies whose secret material had to be destroyed.

On paper, a fully shielded Zcash transaction gives a larger anonymity set than a Monero ring of sixteen. In practice, the size of that set depends on how many people actually use the shielded pool, and how carefully.

Where Monero leaks

• Ring analysis. Decoys are only useful if they look like real spends. Older research showed that early rings with no or few decoys could be unravelled, and that a poor decoy-selection algorithm makes the newest output in a ring the likely real one. Those problems were fixed by mandatory minimum ring sizes, now sixteen, and better decoy selection, but the ring is still a statistical hide, not a mathematical one. Monero developers have been working on full-chain membership proofs (FCMP++) to replace the ring with the whole set of chain outputs.
• Off-chain links. An exchange that verified you, a remote node that sees your IP address, or reusing one subaddress everywhere all give away what the chain does not.
• Supply visibility. Because amounts are hidden, the total supply cannot be summed by an outside observer. It is enforced cryptographically, and a 2017 bug that could have allowed hidden inflation was found and patched before any known exploit, but you are trusting the maths rather than counting coins.

Where Zcash leaks

• Transparent use. ZEC in a t address is as visible as Bitcoin, and for most of Zcash's history the majority of coins and transactions sat there. Shielded use has grown, but a shielded transaction on a mostly transparent network still stands out.
• Pool boundaries. Moving ZEC from a transparent address into the shielded pool, and back out, is visible. If 3.271 ZEC goes in and 3.270 ZEC comes out a few minutes later, the pool has hidden very little. Shielding and then waiting, and spending from the pool to another shielded address, is what makes it work.
• Exchange payouts. Most exchanges and swap services, including the ones behind AnonExch, pay ZEC to transparent addresses only. You receive it in public view and shield it yourself afterwards.
• History. In 2018 a flaw in the original Sprout proving system would have allowed undetectable counterfeiting of shielded ZEC. It was quietly fixed and disclosed in 2019, with no evidence it was exploited. The turnstile that tracks value moving out of each shielded pool is one reason Zcash's supply remains auditable even so.

Side by side

Which should you choose?

Choose Monero if you want privacy that cannot be skipped. There are no wrong address types to pick and no shielding step to forget, and every other user adds to your cover. It is also the more practical coin to mine on hardware you already own; see how to mine Monero.

Choose Zcash if you value a fixed, auditable supply and want the stronger per-transaction cryptography of the shielded pool, and you are willing to keep your coins shielded and avoid patterns that link them in and out of the pool. Use a wallet that shields by default.

Many people hold both for different reasons. Moving between them is one swap: ZEC to XMR for someone who would rather not have to remember the shielding step, or BTC to ZEC to get into Zcash from Bitcoin. Neither needs an account. A ZEC payout arrives at a transparent address, so shield it once it lands.

Related: Monero · Zcash · Best Monero wallet · Is Bitcoin anonymous?