World Open-Sources ProveKit, a Post-Quantum Proving Toolkit That Runs on a Phone

On September 1st, the dark web service Nexus began offering bulk access to the identity documents of over 170 million people across North America. The inventory included 153 million driving licence scans, over 10 million identification cards, more than 3 million travel documents and at least 579,000 medical cards. The files contained infrared and ultraviolet layers from a specific scanning pipeline, with timestamps matching the dates people handed their documents.

IDScan.net, a New Orleans verification firm processing 21 million checks monthly for clients like Hertz, Target and FedEx, was implicated. The FBI's New Orleans office launched an investigation. One individual listed the US defense secretary's driving licence for $100. Later that day, World open-sourced ProveKit, a post-quantum proving toolkit designed to run on a phone or in a browser.

ProveKit generates zero-knowledge proofs without transmitting the sensitive material anywhere. It allows users to demonstrate claims such as being over a certain age, holding a nationality, or possessing a valid identity document while the verifier receives confirmation of that single claim. The toolkit has been integrated into World ID since April and was made publicly available on September 2nd under an MIT license, following two years of development.

World ID Credentials store the contents of an NFC chip-enabled identity document locally on a device, with the underlying data remaining inaccessible to the World Foundation, Tools for Humanity, or any third party. ProveKit's approach focuses on local proof generation rather than delegated proving, which is harder to engineer but ensures the sensitive data never leaves the handset.

The demand for verification is growing, with the digital identity market expected to reach $51 billion in 2025 and $80 billion by 2030. Verification is becoming a legal obligation, particularly in regions like the European Union, where eIDAS 2.0 mandates digital identity wallets by December 2026. ProveKit's key feature is generating zero-knowledge proofs on a person's own device, completing proofs in seconds on a typical phone and under thirty seconds on low-end devices, all while operating with limited memory and supporting offline use.

The toolkit uses 128-bit post-quantum security and requires no trusted setup, utilizing the WHIR hash-based commitment scheme. ProveKit ships with bindings for Swift, Kotlin, JavaScript, and Rust, making it accessible to developers building in various programming languages.