World open-sources ProveKit to bring private ID checks to everyday smartphones

The technology behind World ID can let people prove their age, nationality or possession of a valid ID without handing over the personal information behind it

World is opening up one of the privacy technologies behind World ID, giving developers a new way to build identity checks that can happen directly on a user’s phone rather than sending sensitive information to a third party.

The company has introduced ProveKit , an open-source zero-knowledge proving toolkit designed to let people prove facts about themselves, such as being over a certain age, holding a valid identity document or meeting nationality or residency requirements, without revealing the underlying personal data .

For users, the practical promise is straightforward. Instead of uploading a passport or ID card and trusting another company to store it securely, a person could potentially prove only the information that matters. A service checking whether someone is over 18, for example, could receive confirmation that the requirement has been met without receiving their name, date of birth or a copy of their ID.

The release lands at a moment when the risks of the status quo are hard to ignore. Security researcher Brian Krebs reported this week that a dark web service called Nexus is selling digital scans of more than 153 million drivers licenses from people in the United States and Canada, apparently siphoned from a widely used identity verification vendor whose clients include several Fortune 500 companies. The FBI has opened an investigation into the source of the breach. The records reportedly include front and back scans, infrared and ultraviolet images, and timestamps tied to everyday moments like renting a car or visiting a dispensary, all collected simply because a business asked to see an ID.

That is exactly the model ProveKit is built to move away from. Rather than a person handing a business their actual license or passport, which then has to be stored somewhere and becomes a target, ProveKit lets a person prove only the specific fact a service needs, such as being over 18 or holding a valid document, while the underlying ID never leaves their device. If the sensitive images at the center of the Nexus breach had never been collected and centrally stored in the first place, they would not have been available to steal.

ProveKit generates those proofs locally on a smartphone or browser, meaning the underlying information does not need to be sent to an external server for processing. World says proofs can be generated within seconds on a typical smartphone and in under 30 seconds on a low-end device used in testing. The system can also operate offline and with limited memory.

That distinction could make zero-knowledge technology significantly more practical outside crypto. Privacy-preserving identity systems have existed for years, but generating sophisticated cryptographic proofs has traditionally come with computational and infrastructure requirements that can make deployment difficult on ordinary consumer devices. ProveKit is designed specifically to make local proving viable on the hardware people already carry.

The technology is not purely experimental. ProveKit is already integrated into World ID , where it supports privacy-preserving verification across World’s identity network.

World ID Credentials, for example, can store information obtained from NFC-enabled identity documents locally on a user’s device. ProveKit can then be used to prove specific attributes from those credentials without exposing the rest of the document. According to World, that underlying information remains inaccessible to World Foundation, Tools for Humanity and other third parties, an approach that stands in sharp contrast to the kind of centralized document warehousing implicated in the Nexus breach.

For developers , World is releasing ProveKit as a production ready open-source codebase. It supports Noir , the Rust-inspired programming language developed by Aztec for building zero-knowledge applications, allowing developers to create additional types of provable claims.

The toolkit is also designed with longer-term security in mind. ProveKit targets 128-bit post-quantum security, requires no trusted setup and uses the WHIR hash-based commitment scheme. Its implementation has been independently audited by Least Authority.

Opening the technology could extend World’s privacy model well beyond World ID itself. Age-gated websites, financial services, online marketplaces, travel platforms and other applications routinely ask users to submit far more personal information than is actually necessary to complete a verification, the same pattern of over-collection that made a service like Nexus possible in the first place.

ProveKit offers a different model: prove the fact, not the identity behind it.

World is already working on ProveKit v2, which is expected to make proofs smaller and faster while reducing memory requirements and improving the efficiency of on-chain verification. As incidents like the Nexus breach put new pressure on companies to rethink how they handle identity documents, tools like ProveKit point toward a way of doing ID verification that never puts a stockpile of scanned licenses at risk to begin with.

Contributed article. Not produced by the TNW newsroom and does not reflect the editorial stance of TNW.