S-two, StarkWare’s next-generation prover, is now available for builders and devs—and it’s entirely open-source. It’s the fastest prover in the world—built for client-side proving, making it the ideal prover for real-world ZK applications on real-world hardware and end-devices.
With instant offchain zero knowledge proof generation on any local device, S-two will enable devs to unlock a new generation of proving use cases: onchain privacy, verifiable AI, proofs of humanity and identity, and many more.
While many zkVMs promise broad compatibility and an easy developer experience, when you dig deeper, the reality doesn’t match the claims. S-two is different: it delivers what matters most—real-world performance. Optimized for performance, S-two will achieve what others cannot: instant proving on phones, browsers, and laptops for efficient proof verification publicly onchain—expected by the end of the year.
The numbers back S-two up. In benchmark tests, S-two using Cairo0 code outperforms leading zkVM precompiles built around hand-optimized dedicated AIRs. For example, on a Keccak chain of length ~3.5:
- S-two is 28X faster than a Risc0 precompile.
- S-two is 39X faster than a SP1 precompile.
S-two does this while using a high-level general-purpose language—not low-level, hand-tuned circuits. Performance isn’t a nice-to-have. This is what’s going to make client-side proving real.
We expect a S-two onchain verifier to be deployed on Starknet by the end of the year. So if you’re looking to build apps implementing integrity based on math—you should check out the S-two repo today.
ZK infrastructure that’s already battle-tested
StarkWare has been at the forefront of ZK proof technology from the beginning. We invented STARKs and introduced Rollups as a way to scale blockchains. Then we shipped Stone—our first prover and the driving power behind our shared prover service SHARP, securing over $1.3 trillion in cumulative trading volume, $133 million in TVL, and 1 billion transactions across StarkEx and Starknet. No other ZK tech stack has been battle-tested at this scale in production, making it the most reliable proving infrastructure in the ZK space.
S-two is our next generation prover—delivering faster performance and making a wide range of proving use cases feasible for the first time.
StarkWare was the first to apply ZK technology for scaling blockchain through Layer 2 solutions, but ZK was never just about scalability—it always carried a promise for solving additional societal issues and numerous challenges of our digital lives.
With S-two, StarkWare enables solutions to the two most pressing problems of permissionless blockchains: not only scalability but also privacy—increasing economic freedom by enabling private transactions on Bitcoin and Ethereum at massive scale.
The same architecture that would allow using S-two for onchain privacy use cases—proving locally and submitting only a compact proof for efficient onchain verification—also opens the door for a host of digital identity solutions. Individuals could reclaim ownership of their digital identity from corporate platforms, or prove their humanity in an online world saturated with bots—all without revealing personally identifiable information.
And speaking of “proving your humanity”—as the world turns, new pressing issues arrive at the scene. StarkWare has spent years perfecting both the theoretical and practical sides of zero-knowledge proofs. That work now extends beyond blockchains: AI technology stands to benefit most from efficient verification of computations, answering the urgent need for verifiable AI.
Fastest prover in the world—across all benchmarks
S-two outperforms every other prover on the market—across a wide range of real-world use cases. Whether you’re working on Bitcoin, Ethereum, AI, zkML, or in need of recursive proofs—S-two delivers faster performance.
These performance gains don’t just look good on paper—they will make S-two the only prover fast enough to run client-side in production. S-two builds on the proven experience that has already powered real-world systems at scale. It’s not just faster—it will actually work.
Benchmarked against top-performing zkVMs and precompiles, S-two wins by 10-30X depending on the task. And unlike others, it uses a general-purpose language—not hand-coded circuits. Here are the results.
Proven-Benchmarks
Lower is faster.
Sha3
Sha3-Chain
Fibonacci
Matrix Multiplication
Instant ZK proofs on any device
S-two is a next-generation ZK-STARK prover and zkVM framework, designed for performance, flexibility, and real-world integration.
Written in Rust and fully open-source, S-two implements the Circle STARK protocol—a breakthrough proving system operating over a 31-bit chip-friendly Mersenne prime field. It supports multiple hardware backends: CPU, SIMD, GPU, and soon WebGPU and WASM compile, enabling in-browser proving. It also supports recursive proving out of the box.
This will result in fast, efficient, and portable proof generation—whether it’s running on a phone, a laptop, or a browser tab. It’s also the fastest prover in the market today, outperforming alternatives across key benchmarks.
S-two is fully compatible with Cairo, StarkWare’s provable programming language, which is heavily inspired by Rust syntax and optimized to leverage STARK validity proofs. Cairo makes it easy to prove anything and verify everything. It abstracts away the cryptography and math involved in proof generation and allows developers to write provable programs immediately, without needing to familiarize themselves with the zero-knowledge world.
We’ve already shared S-two with close ecosystem partners, who are already building exciting things with it. We’ll be showcasing those soon—so keep an eye out for real-world examples and inspiration for what you can build in the near future.
Build ZK applications with client-side proving
S-two is the fastest prover in the market, and it’s built to power the next generation of ZK applications. With client-side proving at its core, S-two will make it feasible to run proof generation anywhere—locally, in-browser, or on-device. That unlocks use cases that were previously out of reach:
- Onchain privacy
- Verifiable AI
- Proof of humanity
- zkML
- Decentralized identity
- Next-gen onchain gaming
- Verifiable credentials… and many more.
With S-two you’ll be able to prove any computation—just write your logic in Cairo, and use S-two to generate proofs with a single command. Whether you’re scaling your app with validity proofs, verifying private inputs, or validating ML inferences, S-two brings performance and flexibility that fits your hardware setup.
We’re building toward a future where S-two is the default prover for ZK applications—whether they run on local devices offchain, on Ethereum or on Bitcoin. The benchmarks are just the beginning. It’s the new proving standard for real-world use.
Unlock powerful use cases with S-two
Onchain privacy
Blockchains introduced transparency to the financial system, challenged centralized power and promoted economic freedom—but transparency came at the expense of privacy. Today, using a blockchain means exposing your entire transaction history, balances, and even identity to the world.
Zero-knowledge proofs were expected to solve this. But in most rollups today, ZK is used to prove correctness—not to protect data. Sender, recipient, amounts, and function calls are still fully visible. S-two can change this. By enabling client-side proving on real devices, S-two will allow users to keep their data local—only submitting a proof onchain. S-two is the only prover fast enough to make this work. Others may support the idea—but without performance, privacy at scale stays out of reach.
With S-two, you can build apps that have:
- Private transactions: shield sender, recipient, amounts, balances, or messages, while maintaining data as necessary for regulatory compliance.
- Private trading: enable swaps and order matching without exposing strategy or trade history.
And because S-two integrates directly with Starknet, you don’t need to choose between privacy and scalability. S-two will enable privacy solutions that scale—across both Bitcoin and Ethereum, scaling privacy to a 1 billion users.
Proof of humanity & identity
The same architecture that enables private transactions—proving locally, submitting only a compact proof—can also power new forms of digital identity.
With S-two, you could build apps that enable users to prove who they are without revealing who they are. That enables:
- Age verification
- zkKYC and due diligence
- Proof of uniqueness (personhood)
- Proof of humanity
Everything is computed locally. Only the zero-knowledge proof is shared. In a world of digital platforms run by corporations, and a web increasingly overrun by bots, ZK-based identity is becoming not just useful—but necessary.
Verifiable AI
As AI systems become more powerful and more widely integrated into applications, the ability to verify that a given model was actually run, with specific inputs and weights, is becoming essential.
S-two is the best at proving that computation happened the way someone claims it did. S-two’s performance makes it practical to generate proofs of machine learning inference on real-world hardware. With S-two, you can build:
- Model authenticity: prove that a known model produced a given output.
- Input integrity: prove what inputs were used—without revealing them.
- zkML inference: run provable inference locally, with proofs verified onchain.
- AI automation: trigger onchain actions based on verifiable AI outcomes.
S-two brings ZK to the age of AI—not just to check correctness, but to anchor trust in machine-powered systems. S-two brings ZK to where it’s needed most next—not just blockchains, but the AI-powered web.
ZK proofs at scale
With S-two, ZK proofs will finally become practical infrastructure for the real world.
For years, ZK has been used to prove the correctness of state transitions. Now it can also protect what matters: data, identity, intent—without sacrificing decentralization. Privacy and payments at scale are no longer theoretical. They’re about to become live, local, and programmable.
And this goes beyond blockchains. The same performance that unlocks private transactions also unlocks decentralized identity and verifiable AI.
We’ve spent years developing zero-knowledge technology that actually scales. S-two is how we will propagate it—into browsers, into mobile apps, into the hands of developers everywhere.
This is what zero-knowledge was always meant to do—and what StarkWare was always building toward.
Start proving with S-two today
S-two is available on GitHub. Check it out and don’t forget to add a star.
If you’re building with Cairo, or launching a ZK-native app: Now’s the time to explore proving with S-two.
