diff --git a/browser/index.html b/browser/index.html
index 8dbc9702..f044ac53 100644
--- a/browser/index.html
+++ b/browser/index.html
@@ -3,6 +3,8 @@
 <head>
 	<script src="browser-rpc/resources/snarkjs/snarkjs.min.js">
 	</script>
+	<script src="browser-rpc/resources/stwo/s2circuits.js">
+	</script>
 	<script type="module">
 		import * as ReclaimAttestorCore from './browser-rpc/resources/attestor-browser.min.mjs'
 		window.ReclaimAttestorCore = ReclaimAttestorCore
diff --git a/package-lock.json b/package-lock.json
index cdcdd461..7c06f214 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -14,7 +14,7 @@
         "@peculiar/webcrypto": "^1.5.0",
         "@peculiar/x509": "^1.14.0",
         "@reclaimprotocol/tls": "github:reclaimprotocol/tls",
-        "@reclaimprotocol/zk-symmetric-crypto": "^5.0.4",
+        "@reclaimprotocol/zk-symmetric-crypto": "^5.0.9",
         "ajv": "^8.17.1",
         "bs58": "^6.0.0",
         "canonicalize": "^2.0.0",
@@ -2408,9 +2408,9 @@
       }
     },
     "node_modules/@reclaimprotocol/zk-symmetric-crypto": {
-      "version": "5.0.7",
-      "resolved": "https://registry.npmjs.org/@reclaimprotocol/zk-symmetric-crypto/-/zk-symmetric-crypto-5.0.7.tgz",
-      "integrity": "sha512-5pLWYgPBg5yMb+pgFz7JNc+m39eLSBb60Be+YrDffBVCNV7GuH78+/VZSGNX6e5UYBwr8Ga4gZoetJYDrUIZsA==",
+      "version": "5.0.9",
+      "resolved": "https://registry.npmjs.org/@reclaimprotocol/zk-symmetric-crypto/-/zk-symmetric-crypto-5.0.9.tgz",
+      "integrity": "sha512-VxjpJnUJ5TOZ6xi1SbCiDbOegQaFGsDR08FsQH+WnxmeZ1snCt3I7gx9OXfmCvK2ilnVI5aMgqejxVsI36W8tg==",
       "license": "See License in <https://github.com/reclaimprotocol/.github/blob/main/LICENSE>",
       "dependencies": {
         "js-base64": "^3.7.7"
@@ -7418,9 +7418,9 @@
       }
     },
     "node_modules/js-base64": {
-      "version": "3.7.7",
-      "resolved": "https://registry.npmjs.org/js-base64/-/js-base64-3.7.7.tgz",
-      "integrity": "sha512-7rCnleh0z2CkXhH67J8K1Ytz0b2Y+yxTPL+/KOJoa20hfnVQ/3/T6W/KflYI4bRHRagNeXeU2bkNGI3v1oS/lw==",
+      "version": "3.7.8",
+      "resolved": "https://registry.npmjs.org/js-base64/-/js-base64-3.7.8.tgz",
+      "integrity": "sha512-hNngCeKxIUQiEUN3GPJOkz4wF/YvdUdbNL9hsBcMQTkKzboD7T/q3OYOuuPZLUE6dBxSGpwhk5mwuDud7JVAow==",
       "license": "BSD-3-Clause"
     },
     "node_modules/js-sha3": {
diff --git a/package.json b/package.json
index ea708ac9..4beab42c 100644
--- a/package.json
+++ b/package.json
@@ -81,7 +81,7 @@
     "@peculiar/webcrypto": "^1.5.0",
     "@peculiar/x509": "^1.14.0",
     "@reclaimprotocol/tls": "github:reclaimprotocol/tls",
-    "@reclaimprotocol/zk-symmetric-crypto": "^5.0.4",
+    "@reclaimprotocol/zk-symmetric-crypto": "^5.0.9",
     "ajv": "^8.17.1",
     "bs58": "^6.0.0",
     "canonicalize": "^2.0.0",
diff --git a/proto/api.proto b/proto/api.proto
index 605c71e3..a3999bff 100644
--- a/proto/api.proto
+++ b/proto/api.proto
@@ -62,6 +62,7 @@ enum ErrorCode {
 enum ZKProofEngine {
   ZK_ENGINE_SNARKJS = 0;
   ZK_ENGINE_GNARK = 1;
+  ZK_ENGINE_STWO = 2;
 }
 
 message ClaimContext {
diff --git a/src/client/create-claim.ts b/src/client/create-claim.ts
index d8c75297..30aa3858 100644
--- a/src/client/create-claim.ts
+++ b/src/client/create-claim.ts
@@ -4,7 +4,7 @@ import { asciiToUint8Array } from '@reclaimprotocol/tls'
 import { makeRpcTlsTunnel } from '#src/client/tunnels/make-rpc-tls-tunnel.ts'
 import { getAttestorClientFromPool } from '#src/client/utils/attestor-pool.ts'
 import { DEFAULT_HTTPS_PORT, PROVIDER_CTX, TOPRF_DOMAIN_SEPARATOR } from '#src/config/index.ts'
-import { ClaimTunnelRequest, ZKProofEngine } from '#src/proto/api.ts'
+import { ClaimTunnelRequest } from '#src/proto/api.ts'
 import { providers } from '#src/providers/index.ts'
 import type {
 	CreateClaimOnAttestorOpts,
@@ -304,9 +304,7 @@ async function _createClaimOnAttestor<N extends ProviderName>(
 			owner: getAddress(),
 		},
 		transcript:transcript,
-		zkEngine: zkEngine === 'gnark'
-			? ZKProofEngine.ZK_ENGINE_GNARK
-			: ZKProofEngine.ZK_ENGINE_SNARKJS,
+		zkEngine: getEngineProto(zkEngine),
 		fixedServerIV: serverIV!,
 		fixedClientIV: clientIV!,
 	})
diff --git a/src/proto/api.ts b/src/proto/api.ts
index 8192aca1..27fff3bf 100644
--- a/src/proto/api.ts
+++ b/src/proto/api.ts
@@ -318,13 +318,14 @@ export function errorCodeToJSON(object: ErrorCode): string {
   }
 }
 
-export const ZKProofEngine = { ZK_ENGINE_SNARKJS: 0, ZK_ENGINE_GNARK: 1, UNRECOGNIZED: -1 } as const;
+export const ZKProofEngine = { ZK_ENGINE_SNARKJS: 0, ZK_ENGINE_GNARK: 1, ZK_ENGINE_STWO: 2, UNRECOGNIZED: -1 } as const;
 
 export type ZKProofEngine = typeof ZKProofEngine[keyof typeof ZKProofEngine];
 
 export namespace ZKProofEngine {
   export type ZK_ENGINE_SNARKJS = typeof ZKProofEngine.ZK_ENGINE_SNARKJS;
   export type ZK_ENGINE_GNARK = typeof ZKProofEngine.ZK_ENGINE_GNARK;
+  export type ZK_ENGINE_STWO = typeof ZKProofEngine.ZK_ENGINE_STWO;
   export type UNRECOGNIZED = typeof ZKProofEngine.UNRECOGNIZED;
 }
 
@@ -336,6 +337,9 @@ export function zKProofEngineFromJSON(object: any): ZKProofEngine {
     case 1:
     case "ZK_ENGINE_GNARK":
       return ZKProofEngine.ZK_ENGINE_GNARK;
+    case 2:
+    case "ZK_ENGINE_STWO":
+      return ZKProofEngine.ZK_ENGINE_STWO;
     case -1:
     case "UNRECOGNIZED":
     default:
@@ -349,6 +353,8 @@ export function zKProofEngineToJSON(object: ZKProofEngine): string {
       return "ZK_ENGINE_SNARKJS";
     case ZKProofEngine.ZK_ENGINE_GNARK:
       return "ZK_ENGINE_GNARK";
+    case ZKProofEngine.ZK_ENGINE_STWO:
+      return "ZK_ENGINE_STWO";
     case ZKProofEngine.UNRECOGNIZED:
     default:
       return "UNRECOGNIZED";
diff --git a/src/scripts/build-browser.sh b/src/scripts/build-browser.sh
index 81635884..a3c65239 100644
--- a/src/scripts/build-browser.sh
+++ b/src/scripts/build-browser.sh
@@ -2,8 +2,15 @@ set -e
 cp -r node_modules/@reclaimprotocol/zk-symmetric-crypto/resources/ ./browser/resources
 cp node_modules/snarkjs/build/snarkjs.min.js ./browser/resources/snarkjs/snarkjs.min.js
 # remove r1cs files, we don't need them in prod
-rm -r ./browser/resources/snarkjs/*/*.r1cs
+rm -rf ./browser/resources/snarkjs/*/*.r1cs 2>/dev/null || true
 # remove gnark libs, they are only for nodejs
-rm -r ./browser/resources/gnark
+rm -rf ./browser/resources/gnark 2>/dev/null || true
+# ensure stwo resources exist (s2circuits.js + s2circuits_bg.wasm)
+if [ ! -f ./browser/resources/stwo/s2circuits.js ]; then
+    echo "Warning: stwo/s2circuits.js not found in resources"
+fi
+if [ ! -f ./browser/resources/stwo/s2circuits_bg.wasm ]; then
+    echo "Warning: stwo/s2circuits_bg.wasm not found in resources"
+fi
 npm run run:tsc -- src/scripts/build-browser.ts
 npm run run:tsc -- src/scripts/build-jsc.ts
\ No newline at end of file
diff --git a/src/scripts/build-browser.ts b/src/scripts/build-browser.ts
index bdfe13b6..942ca610 100644
--- a/src/scripts/build-browser.ts
+++ b/src/scripts/build-browser.ts
@@ -17,6 +17,7 @@ const rslt = await esbuild.build({
 		'ip-cidr': '#src/scripts/fallbacks/empty.ts',
 		'snarkjs': '#src/scripts/fallbacks/snarkjs.ts',
 		're2': '#src/scripts/fallbacks/re2.ts',
+		'@reclaimprotocol/zk-symmetric-crypto/stwo': '#src/scripts/fallbacks/stwo.ts',
 	},
 	external: [
 		'dotenv',
diff --git a/src/scripts/build-jsc.ts b/src/scripts/build-jsc.ts
index 31a25c65..6f9a4706 100644
--- a/src/scripts/build-jsc.ts
+++ b/src/scripts/build-jsc.ts
@@ -32,6 +32,7 @@ const rslt = await esbuild.build({
 		'ip-cidr': '#src/scripts/fallbacks/empty.ts',
 		'snarkjs': '#src/scripts/fallbacks/empty.ts',
 		're2': '#src/scripts/fallbacks/re2.ts',
+		'@reclaimprotocol/zk-symmetric-crypto/stwo': '#src/scripts/fallbacks/stwo.ts',
 	},
 	external: [
 		'dotenv',
diff --git a/src/scripts/fallbacks/stwo.ts b/src/scripts/fallbacks/stwo.ts
new file mode 100644
index 00000000..4b8fb100
--- /dev/null
+++ b/src/scripts/fallbacks/stwo.ts
@@ -0,0 +1,227 @@
+/**
+ * Browser fallback for stwo - loads from window.s2circuits
+ * The s2circuits.js script must be loaded before this runs
+ */
+
+import type {
+	EncryptionAlgorithm,
+	FileFetch,
+	Logger,
+	MakeZKOperatorOpts,
+	ZKOperator,
+	ZKProofInput
+} from '@reclaimprotocol/zk-symmetric-crypto'
+
+// Browser-native base64 utilities
+const Base64 = {
+	fromUint8Array(arr: Uint8Array): string {
+		let binary = ''
+		for(const element of arr) {
+			binary += String.fromCharCode(element)
+		}
+
+		return btoa(binary)
+	},
+	toUint8Array(str: string): Uint8Array {
+		const binary = atob(str)
+		const arr = new Uint8Array(binary.length)
+		for(let i = 0; i < binary.length; i++) {
+			arr[i] = binary.charCodeAt(i)
+		}
+
+		return arr
+	}
+}
+
+type StwoWitnessData = {
+	algorithm: EncryptionAlgorithm
+	key: string // base64
+	nonce: string // base64
+	counter: number
+	plaintext: string // base64
+	ciphertext: string // base64
+}
+
+type ProveResult = {
+	success?: boolean
+	error?: string
+	proof?: string
+	blocks?: number
+	algorithm?: string
+	proof_size_bytes?: number
+}
+
+type VerifyResult = {
+	valid?: boolean
+	error?: string
+	algorithm?: string
+}
+
+// Get s2circuits from window (loaded via script tag)
+function getS2Circuits() {
+	const s2 = (window as unknown as { s2circuits?: unknown })['s2circuits'] as {
+		initSync?: (options: { module: Uint8Array }) => void
+		generate_chacha20_proof?: (key: Uint8Array, nonce: Uint8Array, counter: number, plaintext: Uint8Array, ciphertext: Uint8Array) => string
+		generate_aes128_ctr_proof?: (key: Uint8Array, nonce: Uint8Array, counter: number, plaintext: Uint8Array, ciphertext: Uint8Array) => string
+		generate_aes256_ctr_proof?: (key: Uint8Array, nonce: Uint8Array, counter: number, plaintext: Uint8Array, ciphertext: Uint8Array) => string
+		verify_chacha20_proof?: (proof: string, nonce: Uint8Array, counter: number, plaintext: Uint8Array, ciphertext: Uint8Array) => string
+		verify_aes_ctr_proof?: (proof: string, nonce: Uint8Array, counter: number, plaintext: Uint8Array, ciphertext: Uint8Array) => string
+	} | undefined
+
+	if(!s2) {
+		throw new Error('s2circuits not loaded. Make sure s2circuits.js is loaded before using stwo.')
+	}
+
+	return s2
+}
+
+function assertU32Counter(counter: number): void {
+	if(!Number.isInteger(counter) || counter < 0 || counter > 0xFFFFFFFF) {
+		throw new RangeError('counter must be a uint32 integer (0 to 4294967295)')
+	}
+}
+
+let wasmInitialized = false
+let initPromise: Promise<void> | undefined
+
+async function ensureWasmInitialized(fetcher: FileFetch, logger?: Logger): Promise<void> {
+	if(wasmInitialized) {
+		return
+	}
+
+	if(initPromise) {
+		return initPromise
+	}
+
+	initPromise = (async() => {
+		try {
+			const s2 = getS2Circuits()
+			const wasmBytes = await fetcher.fetch('stwo', 's2circuits_bg.wasm', logger)
+			s2.initSync!({ module: wasmBytes })
+			wasmInitialized = true
+		} catch(err) {
+			initPromise = undefined
+			throw err
+		}
+	})()
+
+	return initPromise
+}
+
+function serializeWitness(algorithm: EncryptionAlgorithm, input: ZKProofInput): Uint8Array {
+	if(!input.noncesAndCounters?.length) {
+		throw new Error('noncesAndCounters must be a non-empty array')
+	}
+
+	const { noncesAndCounters: [{ nonce, counter }] } = input
+	assertU32Counter(counter)
+	// Note: In the JS library, 'in' is ciphertext and 'out' is plaintext
+	// Stwo expects (key, nonce, counter, plaintext, ciphertext)
+	const data: StwoWitnessData = {
+		algorithm,
+		key: Base64.fromUint8Array(input.key),
+		nonce: Base64.fromUint8Array(nonce),
+		counter,
+		plaintext: Base64.fromUint8Array(input.out), // out = decrypted plaintext
+		ciphertext: Base64.fromUint8Array(input.in), // in = encrypted ciphertext
+	}
+	return new TextEncoder().encode(JSON.stringify(data))
+}
+
+function deserializeWitness(witness: Uint8Array): StwoWitnessData {
+	const json = new TextDecoder().decode(witness)
+	return JSON.parse(json)
+}
+
+export function makeStwoZkOperator({
+	algorithm,
+	fetcher,
+}: MakeZKOperatorOpts<object>): ZKOperator {
+	return {
+		generateWitness(input) {
+			return serializeWitness(algorithm, input)
+		},
+
+		async groth16Prove(witness, logger) {
+			await ensureWasmInitialized(fetcher, logger)
+			const s2 = getS2Circuits()
+			const data = deserializeWitness(witness)
+
+			const key = Base64.toUint8Array(data.key)
+			const nonce = Base64.toUint8Array(data.nonce)
+			const plaintext = Base64.toUint8Array(data.plaintext)
+			const ciphertext = Base64.toUint8Array(data.ciphertext)
+
+			let resultJson: string
+			switch (data.algorithm) {
+			case 'chacha20':
+				resultJson = s2.generate_chacha20_proof!(key, nonce, data.counter, plaintext, ciphertext)
+				break
+			case 'aes-128-ctr':
+				resultJson = s2.generate_aes128_ctr_proof!(key, nonce, data.counter, plaintext, ciphertext)
+				break
+			case 'aes-256-ctr':
+				resultJson = s2.generate_aes256_ctr_proof!(key, nonce, data.counter, plaintext, ciphertext)
+				break
+			default:
+				throw new Error(`Unsupported algorithm: ${data.algorithm}`)
+			}
+
+			const result: ProveResult = JSON.parse(resultJson)
+			if(result.error) {
+				throw new Error(`Stwo proof generation failed: ${result.error}`)
+			}
+
+			if(!result.proof) {
+				throw new Error('Stwo proof generation failed: no proof returned')
+			}
+
+			return { proof: result.proof }
+		},
+
+		async groth16Verify(publicSignals, proof, logger) {
+			await ensureWasmInitialized(fetcher, logger)
+			const s2 = getS2Circuits()
+
+			const expectedNonce = publicSignals.noncesAndCounters[0]?.nonce
+			const expectedCounter = publicSignals.noncesAndCounters[0]?.counter
+			const expectedCiphertext = publicSignals.in
+			const expectedPlaintext = publicSignals.out
+
+			if(!expectedNonce || expectedCounter === undefined) {
+				logger?.warn('Invalid publicSignals: missing nonce or counter')
+				return false
+			}
+
+			assertU32Counter(expectedCounter)
+
+			const proofStr = typeof proof === 'string'
+				? proof
+				: new TextDecoder().decode(proof)
+
+			let resultJson: string
+			if(algorithm === 'chacha20') {
+				resultJson = s2.verify_chacha20_proof!(
+					proofStr, expectedNonce, expectedCounter, expectedPlaintext, expectedCiphertext
+				)
+			} else {
+				resultJson = s2.verify_aes_ctr_proof!(
+					proofStr, expectedNonce, expectedCounter, expectedPlaintext, expectedCiphertext
+				)
+			}
+
+			const result: VerifyResult = JSON.parse(resultJson)
+			if(result.error) {
+				logger?.warn({ error: result.error }, 'Stwo STARK verification failed')
+				return false
+			}
+
+			return result.valid === true
+		},
+
+		release() {
+			wasmInitialized = false
+			initPromise = undefined
+		}
+	}
+}
diff --git a/src/scripts/generate-receipt.ts b/src/scripts/generate-receipt.ts
index dcec4ecd..97fd804a 100644
--- a/src/scripts/generate-receipt.ts
+++ b/src/scripts/generate-receipt.ts
@@ -57,7 +57,7 @@ export async function main<T extends ProviderName>(
 		.replace('ws://', 'http://')
 		.replace('wss://', 'https://')
 
-	const zkEngine = getCliArgument('zk') === 'gnark' ? 'gnark' : 'snarkjs'
+	const zkEngine = getCliArgument('zk') === 'gnark' ? 'gnark' : 'stwo'
 	const { request, error, claim } = await createClaimOnAttestor({
 		name: paramsJson.name,
 		secretParams: paramsJson.secretParams,
diff --git a/src/server/utils/assert-valid-claim-request.ts b/src/server/utils/assert-valid-claim-request.ts
index e436cd8b..303e1553 100644
--- a/src/server/utils/assert-valid-claim-request.ts
+++ b/src/server/utils/assert-valid-claim-request.ts
@@ -11,8 +11,7 @@ import type {
 	ProviderClaimInfo } from '#src/proto/api.ts'
 import {
 	ClaimTunnelRequest,
-	TranscriptMessageSenderType,
-	ZKProofEngine
+	TranscriptMessageSenderType
 } from '#src/proto/api.ts'
 import { providers } from '#src/providers/index.ts'
 import { niceParseJsonObject } from '#src/server/utils/generics.ts'
@@ -32,6 +31,7 @@ import {
 	extractApplicationDataFromTranscript,
 	hashProviderParams,	SIGNATURES,
 	verifyZkPacket } from '#src/utils/index.ts'
+import { getEngineString } from '#src/utils/zk.ts'
 
 /**
  * Asserts that the claim request is valid.
@@ -88,7 +88,7 @@ export async function assertValidClaimRequest(
 	const receipt = await decryptTranscript(
 		request.transcript,
 		logger,
-		zkEngine === ZKProofEngine.ZK_ENGINE_GNARK ? 'gnark' : 'snarkjs',
+		getEngineString(zkEngine),
 		fixedServerIV,
 		fixedClientIV
 	)
diff --git a/src/utils/zk.ts b/src/utils/zk.ts
index 830140e8..b7e4a2fc 100644
--- a/src/utils/zk.ts
+++ b/src/utils/zk.ts
@@ -25,6 +25,7 @@ import {
 	makeGnarkZkOperator,
 } from '@reclaimprotocol/zk-symmetric-crypto/gnark'
 import { makeSnarkJsZKOperator } from '@reclaimprotocol/zk-symmetric-crypto/snarkjs'
+import { makeStwoZkOperator } from '@reclaimprotocol/zk-symmetric-crypto/stwo'
 import PQueue from 'p-queue'
 
 import { DEFAULT_REMOTE_FILE_FETCH_BASE_URL, DEFAULT_ZK_CONCURRENCY, TOPRF_DOMAIN_SEPARATOR } from '#src/config/index.ts'
@@ -688,6 +689,7 @@ const oprfEngines: {
 const operatorMakers: { [z in ZKEngine]?: (opts: MakeZKOperatorOpts<{}>) => ZKOperator } = {
 	'snarkjs': makeSnarkJsZKOperator,
 	'gnark': makeGnarkZkOperator,
+	'stwo': makeStwoZkOperator,
 }
 
 const OPRF_OPERATOR_MAKERS: { [z in ZKEngine]?: MakeOPRFOperator<{}> } = {
@@ -774,6 +776,10 @@ export function getEngineString(engine: ZKProofEngine) {
 		return 'snarkjs'
 	}
 
+	if(engine === ZKProofEngine.ZK_ENGINE_STWO) {
+		return 'stwo'
+	}
+
 	throw new Error(`Unknown ZK engine: ${engine}`)
 }
 
@@ -787,6 +793,10 @@ export function getEngineProto(engine: ZKEngine) {
 		return ZKProofEngine.ZK_ENGINE_SNARKJS
 	}
 
+	if(engine === 'stwo') {
+		return ZKProofEngine.ZK_ENGINE_STWO
+	}
+
 	throw new Error(`Unknown ZK engine: ${engine}`)
 }
 
