---
title: "Circom"
description: "Circom: Circuit DSL (R1CS). Kind: Circuit DSL. Arithmetisation / backend: R1CS → Groth16 / PLONK. Setup: Yes (per-circuit for Groth16). Maintained by: iden3."
type: "option"
url: "https://zkpick.com/frameworks/circom/"
section: "02 Choosing a framework"
authors:
  - "MarketComp"
publisher: "MarketComp"
version: "1.3"
updated: "2026-09-12"
license: "CC-BY-4.0"
json: "https://zkpick.com/data/frameworks/circom.json"
---

*By MarketComp. Updated 2026-09-12. Version 1.3. CC BY 4.0.*

# Circom — *Circuit DSL (R1CS)*

> Circom: Circuit DSL (R1CS). Kind: Circuit DSL. Arithmetisation / backend: R1CS → Groth16 / PLONK. Setup: Yes (per-circuit for Groth16). Maintained by: iden3. Licence: GPL-3.0. Status: Production-mature. Choose it when: Fixed, small-to-medium, high-volume statements where the verifier must be cheap and the circuit will be audited hard: membership proofs, identity and anonymity sets, signature verification.

A low-level DSL that compiles templates into R1CS, typically proved with Groth16 or PLONK. The developer writes constraints explicitly and assigns witness values separately — the source of both its efficiency and its characteristic bug class.

**Strengths**

- The largest deployed base of any ZK circuit DSL, and by far the deepest pool of engineers and auditors
- The best security tooling coverage of any ZK language — analysers and fuzzers target it first
- Very small, cheap on-chain verifiers when paired with Groth16

**Tradeoffs**

- Highest underconstrained-bug risk of the mainstream options; the assign-versus-constrain distinction is a documented footgun
- R1CS only — no custom gates or lookups, so hashing-heavy circuits are expensive relative to PLONKish and AIR systems
- Groth16 means a per-circuit trusted setup: changing the circuit means a new ceremony
- Licensing differs by layer and is routinely conflated — the compiler and snarkjs are GPL-3.0 while circomlib is LGPL-3.0; get legal review for commercial products

**Choose it when:** Fixed, small-to-medium, high-volume statements where the verifier must be cheap and the circuit will be audited hard: membership proofs, identity and anonymity sets, signature verification.

Maintained by: iden3 · Maturity: Production-mature · License: GPL-3.0 · Source: https://github.com/iden3/circom

**In the framework selection matrix** (https://zkpick.com/frameworks/#frameworks-matrix-circom)

| Project | Kind | Arithmetisation / backend | Setup | Maintained by | Licence | Status |
| --- | --- | --- | --- | --- | --- | --- |
| Circom | Circuit DSL | R1CS → Groth16 / PLONK | Yes (per-circuit for Groth16) | iden3 | GPL-3.0 | Production-mature |