ZKAuth

Zero-knowledge authentication

Prove what is true.
Reveal nothing else.

ZKAuth replaces passwords and document uploads with zero-knowledge proofs generated on the user's own device. A verifier learns the answer to its question — “over 21”, “licensed pharmacist”, “employee of this agency” — and nothing more.

$43B

lost to identity fraud in the U.S. every year.

$10M+

average cost of a data breach in the U.S.

~60%

of breaches involve stolen, phished or misused credentials.

The root cause is structural: shared secrets and central databases of personal data. As long as they exist, there is something to steal.

1The protocol

Issuer

A government agency, employer, hospital or bank signs a verifiable credential and gives it to the person.

Holder

The credential stays in a wallet on the person's own device. There is no central database of everyone's credentials.

Verifier

A service asks one specific question and receives a proof bound to that session. It cannot be intercepted and replayed elsewhere.

A single request

  1. The verifier sends a query and a fresh session challenge.
  2. The wallet computes a zero-knowledge proof on the device.
  3. The verifier checks the proof against the issuer's public key.
  4. Access is granted. No personal data crossed the wire.
// The verifier asks
{
  "credential": "GovernmentID",
  "query": { "birthDate": { "$lt": 20051107 } },
  "challenge": "0x9f2c…e41a"
}

// The verifier learns
{ "satisfied": true, "proof": "groth16:…" }

2Properties

No shared secrets
Nothing reusable is sent or stored, so there is nothing to phish, reset or leak.
Session-bound proofs
Each proof answers one challenge. Captured traffic is useless to an attacker.
Minimization by design
The verifier physically receives only the answer, which satisfies GDPR, CCPA and HIPAA “minimum necessary” without relying on policy.
On-device proving
Proofs are generated on ordinary phones in seconds, with no special hardware.
Open standards
Built on W3C Verifiable Credentials and the iden3 protocol, so credentials work across wallets, vendors and borders.

3Where it applies

Government

Citizen services verify eligibility for benefits, licensing and clearances without building new databases of citizen data.

Financial services

Prove “passed KYC and not sanctioned” without collecting and storing identity documents again at every institution.

Healthcare

A pharmacy confirms a prescription is genuine without seeing the patient's name, address or diagnosis.

Workforce access

Phishing-resistant sign-in from employer-issued credentials, with no password database to breach.

Age verification

Sites get a reliable “over 18” answer. Users don't upload a driver's license to dozens of websites.

Proof of personhood

Distinguish real people from bots, and let AI agents prove who authorized them, without a registry of everyone online.

4Why it matters

U.S. policy is moving toward exactly this model. ZKAuth implements it with open, auditable cryptography.

  • OMB M-22-09 requires federal agencies to adopt phishing-resistant authentication.
  • NIST SP 800-63-4 recognizes verifiable credentials in the digital identity guidelines.
  • National Cybersecurity Strategy (2023) names strong, privacy-preserving digital identity as an investment priority.
  • EU Digital Identity Wallet makes interoperable, user-held credentials a requirement across member states.

Get in touch

Pilots, integrations, research collaboration and partnerships.

info@zkauth.io