Vesper is a privacy cryptocurrency on its own new blockchain, built to outdo both Monero and Zcash. Your money, your business: nobody sees what you earn, what you spend or who you pay, and nobody gets to ask where it came from. Privacy is never optional, so every user hides in the same crowd, and that crowd is three times the size of Monero's. When you do want to prove something, to an accountant, a partner or a court, you hand over exactly one thing and nothing more. Money that works like cash, anywhere in the world, built in the open by people who publish every weakness instead of hiding it.
How it works. No transaction ever names who paid or who was paid. Every payment lands at a one-time key only its owner can recognise, its amount is sealed so the chain can check the books without reading them, and its sender is hidden among 48 possible spenders, three times Monero's crowd. A view key shows your own history to an accountant or a court, and nobody else's.
Not hidden behind a setting most people never turn on, as on Zcash. Hidden for everyone, on every payment, with no transparent kind of transaction to leak from.
Monero uses 16. Vesper's decoys are drawn from how people really spend, and the leak is measured in public: an informed attacker names the real coin 2.1% of the time, where 2.1% (1 in 48) would be perfect.
A view key shows an accountant everything of yours and lets them spend nothing. A payment proof shows one payment to one person and nothing else. Both built in, one command each.
44 checks run in public on every change, a page lists every known weakness, and the network leak has a number, not an adjective. Privacy that is attacked in the open is the only kind worth trusting.
Security and privacy come first, and nobody here treats that as a game. The goal is real privacy in everyday money, the kind cash used to give and no longer can, and a coin good enough to be the one serious people reach for.
Being asked where money came from and where it is going, every time you pay someone, is not how free people should have to live. Cash cannot cross the world; a private currency can. Vesper is meant to be the modern, legitimate way to do that, built in the open, tested in the open, and launched the only fair way there is: mined from block one by anyone who shows up.
Which is exactly why there is no sale and no price. Test coins have no value, the code is unaudited, and the honest state of its privacy is written plainly further down this page and on Breaking Vesper. Privacy that is claimed is worthless; privacy that is measured and attacked in public is the only kind worth having.
On Bitcoin and Ethereum every payment is written down forever, in the open, with both addresses attached. Give an analyst one address and they can walk your whole financial life: who pays you, who you pay, how much, when. Companies sell exactly that service.
Two coins fixed it, each with a flaw. Monero hides the sender in a ring of 16, the real output and 15 decoys, a small crowd that statistics have cracked before. Zcash has stronger math but made privacy optional, so almost nobody used it and the chain leaked anyway. Both still reveal which computer first announced a transaction.
Vesper sets out to beat both. It takes the best idea from each, mandatory privacy and a hidden sender from Monero, strong proofs from Zcash, adds the two things they lack, a bigger crowd for every spend and a way to prove your own history on demand, and is written in a few thousand lines of Python, with libsodium doing the curve arithmetic, so you can read every trick line by line. Where it stands against that aim today is stated plainly further down: Monero's design with three times its ring, not yet more.
| Commitment | Monero | Zcash | Vesper |
|---|---|---|---|
| Privacy is mandatory | Yes | No, optional, and most people skipped it | Yes. There is no transparent transaction type. |
| Receiver hidden | Stealth addresses | Shielded addresses | Stealth addresses, done |
| Amount hidden | Yes (RingCT) | Yes | Yes, done: commitments the chain checks without reading, with range proofs |
| Sender hidden | Ring of 16: the real output and 15 decoys | Zero-knowledge proof over the shielded pool | Hidden in a ring of 48 today, three times Monero's: an attacker who knows how people spend names the real coin 2.1% of the time, where 2.1% is fair. Hiding among every output on the chain is the research target, not a promise. |
| Prove your own history | View key, incoming only | Viewing keys | View keys from day one: see everything of yours, spend nothing. Payment proofs for one payment at a time. |
| Network layer | Dandelion++ | None built in | Dandelion++-style stem relay, built; the leak is measured and published (an attacker with 10% of nodes names the sender's node 11% of the time); Tor with one flag |
| Mining | RandomX: favours CPUs, hostile to mining chips | Equihash: graphics cards and chips | Argon2id, memory-hard, hostile to Bitcoin's chips; an interim choice, RandomX likely for production |
| Can a person read the code? | Hundreds of thousands of lines of C++ | Rust, Halo 2 | A few thousand lines of Python written to be read |
| Speed budget | Large transactions | Proofs take seconds to create | Every phase reports milliseconds; the rule is nobody waits |
A Vesper address is two public keys made from two secret numbers, and one wallet hands out as many addresses as it likes, none linkable to another. The values below are from a real run of demo.py on node v0.9.0 at testnet-1 settings.
Two secret numbers on his PC, as many addresses as he likes. His first, and one he hands only to Carol: they share no key, and both pay into the same wallet.
Each payment draws a fresh secret, publishes its own R, and lands at a fresh key with a sealed amount. Two payments of 5 tVESP to the same person: nothing in common.
She has her own keys and all the time in the world. She recomputes the test for every output.
Bob's view key finds both instantly. His accountant, holding only the view key, sees the same two payments and can spend neither.
The whole trick is two lines of arithmetic on an elliptic curve. The sender computes the one-time key from Bob's public keys D and C; Bob recomputes it from his private view key, because a·R equals r·C. Spending needs the private spend key as well.
Give someone a and B and they can list your incoming payments forever and never move a coin. That is the view key. Monero has one too; Vesper makes it, and the one-payment receipt, a first-class tool rather than an afterthought.
Alice pays Bob 12.5 VESP from a 50 VESP mining reward (keys from the recorded test drive). Switch viewpoints.
Measured on an ordinary laptop with receivers, amounts and senders all hidden: Python with libsodium doing the curve arithmetic. Numbers from the self-test.
Each layer has a price on the node: about 4 ms per payment with only receivers hidden, 8.4 with amounts sealed, 18.6 with senders hidden in a ring of 16, back to 15.1 with one joint range proof per payment, 23 at a ring of 32, and 33 at the ring of 48 the testnet runs. Ring signatures cannot be batch-checked, which is one reason the research target matters: a proof of membership among every output has to beat the ring's per-input cost to ship.
No address ever appears on the chain. Wallets find their coins by scanning. View keys audit without spending.
Amounts are sealed in commitments with one 736-byte range proof per payment, batch-checked per block. Nodes prove inputs equal outputs and nothing is negative without seeing a number. Every payment has at least two shuffled outputs.
Every input is signed as one of a ring of 48 outputs, three times Monero's, with a one-way spent marker that makes double spends impossible without ever naming the output. Monero's strength. Stage two, hiding among every output on the chain, is research with no design chosen yet. 44 self-test checks across all phases.
A payment travels quietly from node to node before anyone broadcasts it, so the first announcer is a relay, not the sender. Measured in a 200-node simulation: an attacker with 10% of the nodes names the sender's node 11% of the time, 25% without the stem. Nothing between nodes is encrypted; one flag sends everything through Tor.
Vesper has no value, is not listed anywhere, and never will be. Testnet-1's tVESP are test coins, worth nothing by design. It exists so a person can read exactly how private money works and then try to do it better.
Homemade privacy cryptography is unaudited. The real projects spent years and several audits getting this right, and their first versions still had traceability bugs. If you want private money for real, use Monero.
What the chain still shows an observer today, stated plainly: that the sender is one of 48 outputs rather than one of all of them (an attacker who knows how people spend names the real one 2.1% of the time; fair would be 2.1%), the fee, the amount of each mining reward, the count and size of inputs and outputs, and that the outputs of one payment belong together. Off the chain, the first broadcast of your payment comes from a relay rather than your node, but an attacker running a share of the nodes still guesses your node about that share of the time, your peers see your address unless you run through Tor, and a dishonest node could feed your wallet decoys of its choosing, so for real privacy you run your own node, the same rule Monero users live by. The self-test includes a check that lists exactly that, so the claim on this page and the code never drift apart. The honest line today: Monero's design with three times its ring, which is still a crowd of 48 and not of everyone. "Untraceable" waits for stage two of phase 3 and an outside audit.
Python 3.10 or newer and pip install -r requirements.txt. Everything lives in one folder. python coin.py reset-chain starts a fresh chain and keeps your wallets. A coin can be spent, or used as a decoy, only once it is 10 blocks old, so a new chain needs 48 such coins, about 58 blocks or fifteen to thirty minutes, before its first payment: there is nothing to hide among before that. On testnet-1 your node finds the network through the seed node in config.json; the coins are tVESP and worth nothing.
python coin.py send tvspTHEIRADDRESS 12.5 # pay someone; change comes back to you unlinkably python coin.py wallet new-address --label carol # one more address, for one payer; nobody can link it to the others python coin.py wallet export-view # write a view-key file: can see, cannot spend python coin.py watch data\wallets\default.viewkey.json # what an accountant with your view key sees python coin.py proof pay TXID # prove one payment to one person, and nothing else python node.py --proxy socks5h://127.0.0.1:9050 # every connection to a peer through Tor python demo.py # the math, step by step, with timings