What Are Ring Signatures?
Ring signatures are the cryptographic technique Monero uses to hide who sent a transaction. When you send Monero, your transaction is grouped with 15 decoys from the blockchain into a ring of 16. An observer sees 16 possible senders and can't tell for certain which one is real. Combined with stealth addresses and RingCT, ring signatures make every Monero transaction private by default.
How Ring Signatures Work
Think of it like signing a document for a group of 16 people. You sign with your own key and the public keys of 15 others. Anyone can verify that one of the 16 signed it. But they can't figure out which one. The real signer is hidden among the group.
An observer cannot tell which is real.
In Monero, this works with cryptographic outputs instead of physical signatures. When you send XMR, your wallet picks 15 other transaction outputs from the blockchain as decoys. Your real output is mixed in with them. The resulting ring of 16 outputs is published on the blockchain. Anyone can verify that one of them was spent, but the signature does not show which one.
Ring Size History
Monero's ring size has increased over time as the protocol matured:
- 2014: no minimum. Many early transactions had no decoys at all
- March 2016: minimum ring size of 3
- September 2017: minimum ring size of 5, and every transaction must use RingCT
- April 2018: minimum ring size of 7
- October 2018: fixed ring size of 11, so wallets can no longer pick the size
- October 2020: CLSAG, a smaller and faster ring signature, replaces the old format. The ring size stays at 11
- August 2022: fixed ring size of 16, the size today
The dates come from the network upgrade table in the Monero source code.
Larger rings mean more decoys, which means stronger privacy. The trade-off is slightly larger transaction sizes, but the Monero community has consistently chosen privacy over efficiency.
What Comes After Ring Signatures: FCMP++
Monero plans to replace ring signatures with full-chain membership proofs, called FCMP++. A getmonero.org post from April 2024 calls them "a replacement for rings within the Monero protocol." With FCMP++, an input no longer hides among 15 decoys. It proves that it spends one output from all the eligible outputs on the blockchain. The same post says that "every input goes from an immediate anonymity set of 16 to 100,000,000." Double spends are still blocked.
FCMP++ needs a network upgrade. As of October 2026, the Monero project has not set a date for it. Until that upgrade, every Monero transaction uses a ring of 16.
The Three Layers of Monero Privacy
Ring signatures are one piece of a three-part system. Each part protects different information:
- Ring signaturesHide the sender
- Stealth addressesHide the receiver
- RingCTHides the amount
Every transaction uses all three.
Ring Signatures: Hiding the Sender
Ring signatures answer the question "who sent this?" with "it could have been any of these 16 outputs." The real sender is cryptographically indistinguishable from the decoys.
A key innovation is the key image. Each transaction output can only be spent once. When you spend it, a unique key image is published. The network checks that this key image hasn't appeared before, preventing double-spending. But the key image doesn't reveal which of the 16 ring members created it.
Stealth Addresses: Hiding the Receiver
When someone sends you Monero, they don't send it to your public address. They generate a one-time stealth address derived from your public key. This address appears on the blockchain instead of your real address.
Even if you post your Monero address publicly, nobody can scan the blockchain and find your incoming transactions. Each payment creates a unique stealth address that only your wallet can recognize using your private view key.
RingCT: Hiding the Amount
Ring Confidential Transactions hide how much Monero was sent. The network needs to verify that inputs equal outputs (you can't create money from nothing), but it does this using cryptographic commitments instead of visible numbers.
The blockchain shows that a valid transaction occurred. It does not show whether you sent 0.001 XMR or 1,000 XMR.
How This Differs from Bitcoin
Bitcoin has none of these protections. Every Bitcoin transaction shows:
- Which address sent the funds (sender is public)
- Which address received them (receiver is public)
- Exactly how much was sent (amount is public)
Companies like Chainalysis analyze the Bitcoin blockchain as a business. They can trace funds across addresses, cluster addresses belonging to the same person, and link transactions to real identities.
Monero makes this kind of analysis extremely difficult. The sender is hidden among 15 decoys, the receiver uses a one-time address, and the amount is encrypted. For a deeper comparison, read our Monero vs Bitcoin privacy analysis.
The CryptoNote Origin
Ring signatures in cryptocurrency originated from the CryptoNote protocol, published in 2013. Monero launched in 2014 as a fork of Bytecoin (the first CryptoNote implementation) after the community discovered that Bytecoin's developers had premined a large portion of the supply.
Monero's developers took the CryptoNote foundation and improved it significantly. RingCT was added in 2017. Ring sizes have increased. The protocol continues to evolve with regular hard forks that upgrade privacy and efficiency.
Common Questions About Ring Signatures
Can ring signatures be broken?
Early rings could often be traced. A 2017 study, revised in 2018, found that about 62% of the inputs it checked with one or more decoys could be traced by elimination. It also found that the newest ring member was the real one about 80% of the time, because early wallets picked decoys that were older than real coins. Mandatory RingCT, larger rings and better decoy selection fixed the main causes. Statistical attacks on rings of 16 are still studied, and they are one reason Monero plans to replace rings with FCMP++.
Do ring signatures make Monero slower?
Ring signatures increase transaction size compared to a simple transaction. Each ring member adds data to the transaction. Monero developers have worked to optimize this with techniques like Bulletproofs (which dramatically reduced RingCT proof sizes). In practice, Monero transactions confirm in about two minutes.
Can I verify my own transactions?
Yes. You can share your view key or generate a payment proof to prove you sent or received a specific transaction. Privacy is the default, but you can selectively disclose when you need to.
Do all Monero wallets use ring signatures?
Yes. Ring signatures are part of the Monero protocol. Every wallet that sends Monero uses them automatically. There's no way to send a "non-private" Monero transaction. When you use Monero One or any other Monero wallet, ring signatures, stealth addresses, and RingCT are applied to every transaction without any action on your part.
Using Monero Privately
The privacy protections from ring signatures, stealth addresses, and RingCT are built into the protocol. But your wallet choice still matters. Some wallets use light wallet servers that require your view key, which gives a third party visibility into your transactions.
Monero One scans the blockchain on your phone, so no server gets your view key. Every privacy feature Monero offers works automatically. Read our guide to storing Monero safely for more on choosing the right setup, or see how Monero compares in our list of the best private cryptocurrencies. Download Monero One for iPhone or Android.