The one-paragraph answer

Homomorphic encryption is a kind of encryption that lets you perform calculations on encrypted values and get an encrypted result that, when decrypted, equals the calculation done on the plain values. On a blockchain, it means the network can verify "Alice paid Bob 5 XEL and her new balance is correct" without ever seeing Alice's balance, Bob's balance, or the 5.

The everyday analogy

Imagine a locked, transparent box with a special slot. You drop the number 7 inside, the slot transforms it into an opaque ciphertext, and the box snaps shut. A friend who doesn't know what's inside can still press a "+3" button on the outside. Later, when you unlock the box, the number inside reads 10 — even though your friend never saw 7, never saw 3, and never saw 10.

That's homomorphic encryption. The "press a button to add" step is computation on ciphertext. The plaintext (7 → 10) never appears outside your wallet.

Why this matters for crypto privacy

Most blockchains store balances in plain text. The chain knows Alice has 100, Bob has 50, and when Alice sends 5 to Bob it updates the records to 95 and 55. Anyone reading the chain learns everything.

With homomorphic encryption, balances are stored as ciphertexts. The chain holds encrypt(100) for Alice and encrypt(50) for Bob. When Alice sends 5, the chain:

Receives encrypt(5) from Alice's wallet (the amount, encrypted)
Computes encrypt(Alice) − encrypt(5) → Alice's new encrypted balance
Computes encrypt(Bob) + encrypt(5) → Bob's new encrypted balance
Verifies a zero-knowledge proof that Alice actually had ≥5 to spend

The chain learned nothing about the numbers. Alice's wallet (and only Alice's wallet) can still decrypt and see her current balance whenever she wants.

Partially homomorphic vs fully homomorphic

Not all homomorphic schemes are equal. They differ by what kinds of math they support on ciphertexts:

Partially homomorphic (PHE): supports one operation — typically just addition or multiplication, not both. Fast, mature, and exactly what blockchain balances need (addition and subtraction).
Somewhat homomorphic (SHE): supports both, but only a limited number of operations before the ciphertext becomes too noisy to decrypt.
Fully homomorphic (FHE): supports arbitrary computation. Theoretically lets you run any program on encrypted data. Practically: still slow, ciphertexts are huge, mostly research-grade.

XELIS uses additively-homomorphic encryption — efficient, well-studied, and exactly the right tool for balance arithmetic. You don't need FHE to hide balances; you need it only if you want to run arbitrary smart contracts on encrypted data, which is a future research direction across the whole industry.

Homomorphic encryption vs ZK proofs — what's the difference?

These two technologies are easy to confuse because both involve "doing things without revealing things". The distinction:

Homomorphic encryption hides the values and lets computation happen on them. The result is also encrypted.
Zero-knowledge proofs hide the witness (the secret input) and prove a statement about it is true. The result is a public yes/no.

A confidential transaction on XELIS uses both. Homomorphic encryption keeps the balance values opaque. A zero-knowledge proof asserts "the sender had enough, the arithmetic balances, no inflation happened" — without revealing the numbers being asserted about. They're complementary, not competing. See confidential transactions explained for how they stack.

How XELIS uses it

XELIS stores every account balance as an additively-homomorphic ciphertext on-chain. When a transaction lands in a block:

The chain mutates the sender's and receiver's encrypted balances using ciphertext arithmetic.
A zero-knowledge proof attached to the transaction guarantees the sender had a sufficient balance and the encrypted delta is consistent with the encrypted amount.
Range proofs guarantee no negative-wraparound trickery.

The on-chain state is always encrypted. Nodes can verify the chain's consistency forever without ever decrypting a single balance. Only the owner of the private key for an account can decrypt their own balance. See what is XELIS for the wider context.

What it doesn't protect against

Homomorphic encryption hides the numbers. It doesn't, by itself, hide:

Which accounts exist. The set of addresses with activity is observable. XELIS combats this with stealth addresses so receivers don't reuse identities.
Transaction timing. Anyone can see when transactions happen. Metadata-resistance requires network-layer tools like Tor or Dandelion.
IP addresses. Run a wallet over Tor or a trustworthy VPN if network surveillance is in your threat model.
Compromised endpoints. If malware reads your wallet's RAM, the encryption doesn't matter. Follow the security guide.

Common myths

"Homomorphic encryption is too slow for real use"

True for fully homomorphic schemes today. False for the additive partial homomorphic schemes XELIS uses — these have been deployed in production cryptography for over a decade and verify in milliseconds on consumer hardware.

"If amounts are encrypted, nobody can audit the supply"

False. Total supply is mathematically derivable from the issuance schedule and the conservation invariant enforced on every transaction. The chain can prove "no extra coins exist" without ever decrypting a balance — the same way a ledger can balance without you reading individual line items.

"Encrypted balances mean exchanges can't list the coin"

Exchanges deal with their own internal balances; on-chain encryption doesn't prevent them from running deposits, withdrawals, or trading. View keys also let an exchange voluntarily prove its reserves to auditors without exposing per-user balances.

The honest trade-offs

Encryption isn't free. Compared to a transparent chain:

Transactions are larger (kilobytes, not bytes).
Verification is more expensive — but well within reach of normal hardware.
Smart-contract tooling is harder to design when the inputs are encrypted, which is why most general-purpose privacy work is still an active research area.

For a wallet user the trade-off is invisible: you send and receive XEL the same way you'd send and receive any other coin. The chain just stops leaking your financial life.

Frequently asked questions

Who invented homomorphic encryption?

The concept was proposed by Rivest, Adleman, and Dertouzos in 1978. Practical partially-homomorphic schemes (Paillier, ElGamal) followed in the late 1990s. Craig Gentry's 2009 PhD thesis proved fully homomorphic encryption was possible, kicking off the modern wave of research.

Can the cryptography be broken?

The schemes XELIS uses are based on well-studied number-theoretic problems (discrete logarithm hardness over elliptic curves). They're secure against any classical attack we know of. Sufficiently powerful quantum computers would threaten them — but they'd also break HTTPS, Bitcoin signatures, and most banking crypto. The industry is moving toward post-quantum primitives in parallel.

Why don't all privacy coins use it?

Monero uses ring signatures + RingCT. Zcash uses zk-SNARKs over a shielded pool. Both are valid privacy strategies with different trade-offs. XELIS chose encrypted balances + ZK proofs because it gives confidentiality by default, supports a clean smart-contract roadmap, and is exchange-friendly via view keys. There's no single "right" answer — see privacy wallets 101 for the comparison.

Homomorphic encryption on a blockchain, in plain English