--- title: Is Zcash quantum-safe? chain: Zcash ticker: ZEC hardy_score: 41 rank: 10 of 23 tier: "3: Committed" url: "https://hardyindex.com/chains/zcash" updated: 2026-08-12 methodology_version: 1.1 --- # Is Zcash quantum-safe? **Hardy Score 41.0 / 100. Rank 10 of 23. Tier 3: Committed. As of 12 August 2026.** No, and the distinction matters more here than almost anywhere else in this index. Zcash is a privacy chain, and privacy is routinely confused with quantum safety. They are different properties. Zcash spends are authorised by RedDSA and RedPallas signatures, which are elliptic-curve schemes, and the Halo 2 proof system they underpin rests on the same mathematics. A large fault-tolerant quantum computer running Shor's algorithm is expected to break them. What Zcash does have is an unusually thoughtful sequencing of the problem. ZIP 2005 introduces Orchard quantum recoverability, an emergency path that changes how recoverable Orchard notes are constructed so that if a quantum adversary forced the network to disable the vulnerable shielded protocols, holders could still recover funds into a future post-quantum protocol. Full post-quantum migration is targeted on a twelve to eighteen month horizon from mid-2026. > This is a security-readiness assessment, not investment advice. ## Summary Privacy is not quantum safety: Zcash spends are authorised by elliptic-curve signatures, though ZIP 2005 adds a quantum recovery path for shielded notes ahead of a full transition. ## Where we are making a judgement call Zcash is the clearest case in the index of two different security properties being conflated. Zero-knowledge privacy hides who paid whom. Quantum safety concerns whether the signature authorising a payment can be forged. Zcash currently has the first and not the second, and a reader who takes shielded transactions as evidence of quantum resistance has drawn the wrong conclusion. ## Score breakdown | # | Dimension | Score | Weight | Contribution | |---:|---|---:|---:|---:| | 1 | Signature scheme | 0/10 | 30% | 0.0 | | 2 | Deployment stage | 5/10 | 25% | 12.5 | | 3 | NIST alignment | 5/10 | 15% | 7.5 | | 4 | Migration path | 8/10 | 15% | 12.0 | | 5 | Exposure | 5/10 | 10% | 5.0 | | 6 | Verification | 8/10 | 5% | 4.0 | | | **Hardy Score** | | | **41.0** | ### 1. Signature scheme: 0/10 Zcash spend authorisation uses RedDSA and RedPallas, both elliptic-curve signature schemes, and the Halo 2 proving system rests on the same curve mathematics. Nothing post-quantum authorises spends on mainnet today. Source: https://zips.z.cash/protocol/protocol.pdf ### 2. Deployment stage: 5/10 Tier 3: Committed. A named ZIP is deploying a quantum recovery path and a full post-quantum transition is on a published horizon, but no post-quantum signature authorises spends on mainnet. Source: https://www.coindesk.com/tech/2026/05/08/zcash-to-roll-out-quantum-recoverable-wallets-within-a-month-go-quantum-proof-by-2027 ### 3. NIST alignment: 5/10 Zcash has committed to a direction and to a recovery mechanism, but we could not confirm a specific NIST-standardised signature scheme selected for the full transition. The recoverability work in ZIP 2005 is a bespoke construction rather than an adoption of FIPS 204 or FIPS 205. Source: https://zips.z.cash/protocol/protocol.pdf ### 4. Migration path: 8/10 The strongest sequencing logic in the committed group. Rather than waiting for a full migration, Zcash is shipping a recovery path first, so that funds remain recoverable into a future post-quantum protocol even if the shielded protocols had to be disabled in an emergency. Solving the rescue case before the upgrade case is the right order. Source: https://www.coindesk.com/tech/2026/05/08/zcash-to-roll-out-quantum-recoverable-wallets-within-a-month-go-quantum-proof-by-2027 ### 5. Exposure: 5/10 Shielded Zcash is a genuine exception in this index. Funds held in shielded pools do not publish a spending public key on-chain in the way a transparent account does, which materially limits what an attacker can harvest today. Transparent addresses behave like Bitcoin's and are exposed on spend. Source: https://zips.z.cash/protocol/protocol.pdf ### 6. Verification: 8/10 Zcash's protocol is specified in a public document, changes go through numbered public ZIPs, the cryptography is peer-reviewed and the implementation is open source. The quantum recoverability work is identified by a specific ZIP number rather than described in a blog post. Source: https://zips.z.cash/protocol/protocol.pdf ## Signature scheme - **On mainnet today:** RedDSA and RedPallas elliptic-curve signatures, with Halo 2 proofs - **Post-quantum scheme:** Not yet selected. ZIP 2005 adds Orchard quantum recoverability ahead of a full transition. - **NIST standard:** None confirmed for the full migration at the time of writing - **Readiness tier:** Tier 3: Committed. A funded roadmap with public dates and active research exists, but no post-quantum signature is live on mainnet. ## Roadmap - **May 2026** (shipped): Zcash sets out a plan for quantum-recoverable wallets within a month and full post-quantum protection on a twelve to eighteen month horizon. Source: https://www.coindesk.com/tech/2026/05/08/zcash-to-roll-out-quantum-recoverable-wallets-within-a-month-go-quantum-proof-by-2027 - **2026** (in-progress): ZIP 2005 deploys Orchard quantum recoverability, changing how recoverable notes are constructed so funds can later be moved into a post-quantum recovery protocol. Source: https://zips.z.cash/protocol/protocol.pdf - **Targeting 2027** (planned): Full post-quantum protocol migration. Source: https://www.coindesk.com/tech/2026/05/08/zcash-to-roll-out-quantum-recoverable-wallets-within-a-month-go-quantum-proof-by-2027 ## Exposure Zcash is the one chain in this index where the privacy design genuinely reduces quantum exposure, though not for the reason people usually assume. Funds held in shielded pools do not publish a spending public key on-chain the way a transparent account does, so there is materially less for an attacker to harvest today. That is a real advantage and it is why Zcash scores at the midpoint rather than near the bottom. It is not the same as quantum safety: the signatures authorising shielded spends are still elliptic-curve, so a quantum adversary that could break them could still forge spends. Transparent Zcash addresses behave like Bitcoin's and reveal their key on spend. ## Frequently asked questions ### Is Zcash quantum-safe? No, and the distinction matters more here than almost anywhere else in this index. Zcash is a privacy chain, and privacy is routinely confused with quantum safety. They are different properties. Zcash spends are authorised by RedDSA and RedPallas signatures, which are elliptic-curve schemes, and the Halo 2 proof system they underpin rests on the same mathematics. A large fault-tolerant quantum computer running Shor's algorithm is expected to break them. What Zcash does have is an unusually thoughtful sequencing of the problem. ZIP 2005 introduces Orchard quantum recoverability, an emergency path that changes how recoverable Orchard notes are constructed so that if a quantum adversary forced the network to disable the vulnerable shielded protocols, holders could still recover funds into a future post-quantum protocol. Full post-quantum migration is targeted on a twelve to eighteen month horizon from mid-2026. ### Is Zcash quantum-safe? No. Zcash spends are authorised by RedDSA and RedPallas, elliptic-curve signature schemes that a sufficiently large quantum computer would break, and the Halo 2 proof system rests on the same mathematics. Zcash is shipping a quantum recovery path and targeting a full post-quantum migration, but neither is complete. ### Does zero-knowledge privacy make Zcash quantum-resistant? No, and this is the most common misunderstanding about Zcash. Privacy hides the parties and amounts in a transaction. Quantum safety is about whether the signature authorising that transaction can be forged by an attacker with a quantum computer. Zcash's shielded pools deliver the first property. They do not deliver the second. ### What is ZIP 2005 and what does it actually protect? ZIP 2005 introduces Orchard quantum recoverability. It changes how recoverable Orchard notes are constructed so that if a future quantum adversary forced the network to disable the vulnerable shielded protocols, holders could still recover their funds into a future post-quantum recovery protocol. It is an escape hatch, not a post-quantum signature scheme. ### Why does Zcash score better than most chains on exposure? Because shielded funds do not publish a spending public key on-chain in the way a transparent account does, so there is less material for an attacker to collect today against a future quantum computer. That is a genuine structural advantage of the shielded design, and it is separate from whether the underlying signatures are quantum-safe, which they are not. ## What this rating means if you hold Zcash Plain-language guidance from the same publication, with no product recommendation attached. - [Is my crypto safe from quantum computers?](https://hardyindex.com/guides/is-my-crypto-safe-from-quantum-computers.md) - [How to protect your crypto from quantum computers](https://hardyindex.com/guides/how-to-protect-crypto-from-quantum-computers.md) - [All guides](https://hardyindex.com/guides.md) Nothing on this profile is sponsored and nothing on it is an affiliate link. See https://hardyindex.com/how-we-make-money.md. ## Sources 1. [Zcash Protocol Specification](https://zips.z.cash/protocol/protocol.pdf): Electric Coin Company / Zcash Foundation (primary, checked 12 August 2026) 2. [Zcash to roll out quantum-recoverable wallets within a month, go quantum-proof by 2027](https://www.coindesk.com/tech/2026/05/08/zcash-to-roll-out-quantum-recoverable-wallets-within-a-month-go-quantum-proof-by-2027): CoinDesk (secondary, checked 12 August 2026) 3. [FIPS 205: Stateless Hash-Based Digital Signature Standard (SLH-DSA)](https://csrc.nist.gov/pubs/fips/205/final): NIST (primary, checked 12 August 2026) --- Methodology: https://hardyindex.com/methodology (v1.1). Cite as: The Hardy Index, "Zcash", https://hardyindex.com/chains/zcash, as of 12 August 2026.