Rough numbers for halo2 from the Q3 livestream: These are for a sapling shielded tx: Groth16 Size 192 bytes Verification time: 7-10ms Proving time: 2s This is for 2inputs-2outputs Halo2 - naively implemented Size 1.5KB Verification time: 30ms Proving time: 1 second This is also for 2inputs-2outputs Verification is parallisable, so I guess 3 proofs verified in parallel will give you the same speed as Groth16. 3 proofs would equal 3 sapling transactions. Where the improvements come in is due to the fact that: 1) the circuit is no longer static, so you can create a Xinputs-Youtputs transaction. When you look at the amortised cost of each input, it is better than groth16. So the more inputs you have the better it performs than Groth16, I’m guessing this is up to some overhead. The information on that part was still a bit ambiguous for me. 2) a different hash function for merkle trees that is 20X more efficient than pedersen hash. He mentions that this haha function can not be efficiently implemented in Groth16, I think he means R1CS here, which is why PLONK is used instead