World Open-Sources ProveKit, a Post-Quantum Proving Toolkit That Runs on a Phone

On the first of September a dark web service calling itself Nexus began advertising bulk access to the identity documents of more than 170 million people across North America. The inventory it published reads like an audit of everything the verification industry has been quietly accumulating for a decade. There were 153 million driving licence scans, upwards of 10 million other identification cards, more than 3 million travel and international documents and at least 579,000 medical cards. The files carried the infrared and ultraviolet layers that belong to one particular scanning pipeline, the timestamps lined up with the dates on which people had handed their documents across a counter, while the trail itself led to IDScan.net, a New Orleans verification firm that processes something in the region of 21 million checks a month for clients including Hertz, Target and FedEx. The FBI's New Orleans field office opened an investigation. Somebody had listed the United States defense secretary's driving licence at one hundred dollars.Identity documents offered by the Nexus serviceThe following morning World open-sourced ProveKit, a toolkit built on the argument that none of those files should ever have existed.An argument about what a verification is supposed to return ProveKit generates zero-knowledge proofs on a person's own phone or in their browser, which means somebody can demonstrate that they are over a given age or hold a particular nationality or possess a valid identity document while the party doing the checking receives confirmation of that single claim and absolutely nothing else. No document is uploaded anywhere. No copy is retained by anyone. There is no server-side record waiting to turn up on a Russian-language forum in three years, because the sensitive material never leaves the handset in the first place. The toolkit has been running quietly inside World ID since April and shipped publicly on the second of September under an MIT licence after roughly two years of development. World ID Credentials can hold the contents of an NFC chip-enabled identity document locally on a device. World's position is that the underlying data stays inaccessible to the World Foundation, to Tools for Humanity and to any third party who might ask.The decision carrying the whole argument is local proof generation rather than delegated proving. A good many systems will cheerfully produce a proof on your behalf, which requires you to first send them the very thing you were trying not to disclose, an arrangement that solves the cryptography while leaving the trust problem exactly where it started. ProveKit does the work on the device, which is considerably harder to engineer and is the only version of this that survives the week it launched into.The demand is arriving whether the plumbing is ready or not Verification is about to stop being a product decision and start being a legal obligation, which is what makes the timing of all this more than a coincidence. Juniper Research puts the digital identity market at roughly $51 billion in 2025 and expects it to reach about $80 billion by 2030. The slice of that market concerned specifically with verified identity is compounding at something near 49% a year on KuppingerCole's numbers, which is about five times the rate of the whole. Money has followed the obligation, with fraud-detection funding up around three and a half times year on year and funding for digital identity and verifiable credentials more than doubling over the same period. Underneath the market sits a hard date. eIDAS 2.0 requires every European Union member state to offer citizens a digital identity wallet by December 2026, fewer than a third are currently assessed as ready. The architecture the regulation mandates is selective disclosure rather than document collection. Around it sits a widening set of age-verification statutes, from the UK Online Safety Act to Australia's under-16 restrictions to a growing patchwork of American state laws, every one of which pushes platforms toward the model that has just failed so publicly. Collect the document, store it somewhere, defend it forever.Why running on a phone is the hard part Most zero-knowledge tooling assumes a server, or at the very least a desktop, because proving has always been computationally expensive enough to make anything else impractical. The engineering claim in this release is that ProveKit fits inside the constraints of the hardware people actually own, completing proofs in a matter of seconds on a typical phone and in under thirty seconds on the low-end device World used for testing, all while operating with limited memory and supporting offline use. Under the bonnet it compiles circuits written in Noir, the Rust-inspired language Aztec built for zero-knowledge applications, down into R1CS constraints, then generates and verifies WHIR proofs through a Spartan-based protocol. It carries custom SIMD-accelerated field arithmetic together with memory-efficient algorithms written specifically for resource-constrained environments. It ships bindings for Swift, Kotlin, JavaScript and Rust alongside a C-compatible foreign function interface for anything else a developer might be building in. The repository is public and the code is there to read.The two properties most proving systems have to trade away The cryptographic choices are where this parts company with what an identity system would normally reach for. Both of them look overly cautious until you remember what is being protected. How four zero-knowledge proving approaches compareProveKit targets 128-bit post-quantum security and requires no trusted setup, using the WHIR hash-based commitment scheme to get there.Consider the trusted setup first. Groth16 demands a ceremony for every circuit and PLONK needs a universal one. In either case the security of every proof generated afterwards rests on the assumption that at least one participant genuinely destroyed their share of a secret. That is a perfectly reasonable assumption and an awkward thing to install underneath a national identity credential, because it plants a moment in the past that everybody thereafter has to take on faith, including people who were not born when the ceremony happened. A transparent system removes the moment rather than asking you to trust it.Then there is the quantum question, which for most applications of this technology is a problem for somebody else's decade. For a payment that settles this afternoon and is forgotten by Thursday, pairing-based cryptography is entirely adequate. For a credential asserting facts about a person who will still be that same person in twenty years, harvest-now-decrypt-later stops being a slogan and becomes the actual threat model, since an adversary need only record the traffic today then wait. Hash-based commitments are the conservative answer. The conservative answer happens to be the right one when the asset in question is somebody's date of birth. The implementation has been independently audited by Least Authority, which has reviewed a good deal of the serious cryptography in this field.Looking at the document stopped working anyway There is a second argument for not collecting identity documents that has nothing to do with breaches. It is that the traditional method of checking one has quietly become unreliable. Estimated deepfakes produced worldwide, millionsDeepfake production has gone from something in the region of 500,000 in 2023 to a projected 8 million in 2025, a sixteenfold rise in two years, while human ability to tell the difference has fallen through the floor. iProov's testing found that 0.1% of participants correctly identified every real and fake stimulus put in front of them. A 2026 study from Veriff put average detection performance at roughly the level of a coin flip. A verification model built on somebody examining a photograph of a document, or on software examining a photograph of a document, is being asked to do a job that is getting measurably harder every quarter.Cryptographic authentication of the chip inside the document does not care how convincing the picture is, which is the quieter half of the case for this approach and the half that will still matter after the news cycle moves on.What the collect-and-store model actually costs IBM puts customer personal data in 52% of all breaches at roughly $160 for every record exposed, while anonymised data is the cheapest thing an organisation can lose at $115. The average breach reached a record $4.99 million in 2026, up 12%, rising to $11.5 million in the United States. Every one of those figures describes a cost that exists solely because a record was created and then kept. A verification returning a proof rather than a document does not produce a row to price in the first place, which is a different kind of security argument from the usual one about better encryption or tighter access controls. What developers actually get The distribution mechanic is the most underrated thing in the release. Developers can create new provable claims and distribute them without those claims being bundled into an application, which decouples what can be proven from the app release cycle entirely and means a verifier does not need to ship a new build in order to start accepting a new kind of proof. For on-chain use, ProveKit v1 exports verifier and proof data for a recursive verifier where a Groth16 wrapper is required, which is a pragmatic answer rather than an elegant one, though World has not pretended otherwise. Version two is in development and targets smaller proofs, faster proving, lower memory use and more efficient on-chain verification without the wrapper.What to watch The honest read on ProveKit is that the cryptography is not the news at all. WHIR is not new, Noir is not new and hash-based commitments have been the conservative choice among people who think about these things for years. What is new is that somebody has done the deeply unglamorous engineering required to make all of it run inside the memory budget of a phone that an ordinary person is carrying around, then handed the result over under an MIT licence after two years of work plus an external audit. Three things will show whether it lands. The first is whether an identity provider entirely outside World's orbit ships something built on it, because that is the only real test of whether the neutrality claim means anything. The second is the first regulated verifier who accepts a proof in place of a document, since that is the moment this stops being a developer tool and becomes a compliance option a lawyer can sign off. The third is what version two actually delivers, because native on-chain verification without a pairing-based wrapper would close the one remaining seam in the technical argument.The larger point is that this industry spent a decade treating identity verification as a data collection problem and then built infrastructure beautifully suited to that mistake, which is how a company running 21 million checks a month ended up holding infrared scans of 153 million driving licences on behalf of car rental counters. Remco Bloemen of World put it about as plainly as anyone has managed, saying that identity documents should only ever be authenticated using zero-knowledge proofs. The argument for that has been available for years. What was missing was a version that ran on the phone in your pocket. That is what turned up this week.Don’t forget to like and share the story!Vested Interest Disclosure: HackerNoon has reviewed the report for quality, but the claims herein belong to the author. #DYOR.