Proof of personhood

• 1. One Vote, One Human

  ›

  Proof of personhood sets a single rule for digital democracy: each human participant gets one vote, and no more. The attack it defends against is the Sybil attack. One bad actor floods a peer-to-peer network with fake identities, and those identities vote as a bloc. Decentralized platforms are especially vulnerable, because they are designed to respond to large voting blocks at face value. In 2014, Vitalik Buterin named the demand precisely. He called for a 'unique identity system' that would issue each real user exactly one anti-Sybil token. Three years later, in 2017, the phrase 'proof of personhood' was coined for an approach based on pseudonym parties. What that phrase describes is a set of competing methods, none yet perfect. Each one attempts to confirm a participant's humanity without building a surveillance apparatus in the process.

  15626

• 2. What Came Before

  ›

  CAPTCHAs try to hold back automated Sybil attacks by using automated Turing tests to separate human account-creators from bots. Even a CAPTCHA that works exactly as intended leaves a gap. One human can solve multiple CAPTCHAs in sequence and accumulate as many separate accounts. Accessibility creates a further complication: many users who are visually impaired or have learning disabilities struggle to complete the puzzles. Some recently developed AI has also succeeded in solving CAPTCHA challenges, undermining the technical barrier at its foundation. The other natural remedy is to require users to authenticate with verified government identities or through a trusted third-party service. That approach conflicts with privacy and anonymity. It also raises the barrier to entry for anyone who cannot produce or afford the required documents. Recognizing that a human body can only be in one place at a time, researchers proposed something radical. They would require participants to show up in person, simultaneously, and verify each other directly.

  2314

• 3. The Pseudonym Party

  ›

  Borge et al. proposed the founding version of the in-person approach. Participants would gather periodically at pseudonym parties and receive anonymous tokens, with no identity verification required. Physical presence at a specific moment was the only proof the system required. The encointer project adapted this model by dispersing participants into small groups that convene simultaneously at randomly chosen locations. Each group verifies its members' presence. The simultaneous, dispersed design makes it structurally difficult for any one person to attend twice. Two practical difficulties limit this model. Designated locations at fixed times create genuine inconvenience, particularly for anyone with conflicting obligations. The second problem is harder. Multiple simultaneous sites must each confirm that the others are operating honestly. No group can be permitted to quietly issue more credentials than its actual attendance warrants. Those coordination problems pushed some researchers toward a different architecture. Rather than physical proximity, the new approach would use the social connections between people.

  6489

• 4. Webs of Trust

  ›

  The social network approach draws on the model of the PGP Web of Trust. Users vouch for each other's identities rather than deferring to a central authority. UniqueID, described in a 2018 paper by researchers at Sharif University of Technology, incorporates biometric verification into this social model. Participants attest to their own biometrics and then check one another's submitted claims for inconsistencies, all overseen by a DAO governance structure. One sharp criticism of the social approach is structural. An attacker can build multiple fake identities, each embedded in a separate, disconnected cluster of social contacts. Graph-based detection algorithms tend to catch only large, densely clustered groups of Sybil nodes, leaving small-scale fabrications invisible. A different strand of thinking requires participants to hold verified identities but to anonymize those identities for all subsequent use. Apple's implementation of facial recognition in the iPhone routes biometric data through the Secure Enclave. The mathematical structure of a face, captured by the TrueDepth camera, does not leave the user's device. Cases have been documented in which family members were mistakenly recognized as their siblings, pointing to limits in current facial accuracy. Privacy and surveillance concerns run deeper than individual errors. Biometric databases represent concentrations of sensitive information. Users must rely entirely on whoever manages them to keep that data protected. Crypto-biometrics emerged as an attempt to resolve that trust problem. Encrypting the biometric data allows verification to proceed without the underlying information ever being disclosed.

  2010111214

• 5. Systems in Operation

  ›

  The Humanode project describes its approach as combining Confidential Computing, homomorphic encryption, and zero-knowledge proofs, all running inside Confidential Virtual Machines. The original biometric data stays on the user's device throughout, so verification never requires transmitting sensitive information to an outside server. World ID, developed by Tools for Humanity, uses a dedicated hardware device called the Orb to capture an iris scan. The Orb derives an IrisCode from the scan. That code is checked against a blockchain registry using zero-knowledge proofs via the open-source Semaphore protocol. The comparison confirms that the participant has not previously registered, without linking any verification event to the user's biometric data. Idena takes a path that avoids biometrics entirely. Participants confirm their humanity by solving 'flip' puzzles: human-authored image sequences that demand semantic understanding rather than simple object recognition. Verification happens within a globally synchronous two-minute window. That narrow, shared window makes it impractical for any single person to validate more than one account per session. Whether any of these systems can scale to full global participation became a formal research question in 2026.

  1819212317

• 6. Scalability and Stakes

  ›

  A 2026 survey of biometric-enabled decentralized identity systems identified scalability and interoperability as the two major open problems in the field. No standard protocol connects these systems to one another, and their integration had been largely unexamined in the research literature. Face-matching accuracy degrades as population size grows. The probability of false positives rises accordingly, in ways that may be difficult to engineer around. Hardware constraints cut differently. Systems that depend on specialized capture devices may be unavailable or financially out of reach in many regions. Exclusion can also happen through a test that wrongly rejects a participant. Others may simply refuse to submit sensitive biological data to any system, for well-founded reasons. The problems these systems address are consequential. Proof of personhood is proposed as a way to keep voting power in permissionless consensus algorithms widely distributed. Proof of work mining pools have already demonstrated how such systems can quietly re-centralize. Proof of stake systems are predicted to face the same pressure over time. A second application is enforcing a genuine 'one person, one vote' rule in decentralized online governance. Blockchains and cryptocurrencies are the primary contexts where that rule is both desirable and currently unenforceable. Deepfake technologies present a distinct threat to peer-based verification. They can convince a real human participant that a synthetic identity is genuine, turning the human verifier into an unwitting accomplice.

  2214252426