World Open-sources Provekit, a Zero-knowledge Identity Proving Toolkit

World, the identity-focused cryptocurrency project formerly known as Worldcoin, has taken a major step toward transparency and developer adoption by open-sourcing its ProveKit - a zero-knowledge (ZK) identity proving toolkit. The move, announced today, makes the core cryptographic software available for public audit, integration, and modification, aiming to accelerate the deployment of privacy-preserving digital identity verification across decentralized applications. The open-source release of ProveKit marks a strategic pivot for World, which has faced persistent scrutiny over its centralized biometric data collection methods. By publishing the full codebase under a permissive license, the project seeks to demonstrate that its identity verification system can be trusted without requiring blind faith in a single corporate entity. The toolkit enables developers to generate and verify zero-knowledge proofs that confirm a user’s unique humanity without revealing their personal data, biometrics, or transaction history. The Core Technology Behind Provekit ProveKit is built on zero-knowledge proof (ZKP) protocols, specifically leveraging the Groth16 proving system over the BLS12-381 elliptic curve. The toolkit abstracts complex cryptographic operations into a simple API, allowing developers to integrate “proof of personhood” checks into wallets, dApps, and on-chain governance systems with minimal overhead. Key technical features of the open-source release include: Prover Module: Generates a zero-knowledge proof that an individual has passed World’s iris-scanning verification without revealing the iris code or any personal identifier. Verifier Module: Checks the validity of the proof against a public set of parameters. The verifier is stateless and can run on-chain, in a browser, or in a mobile app. Circuit Implementation: The arithmetic circuit defining the constraint system for the proof. The circuit is written in Circom and has been audited by Trail of Bits and Kudelski Security. Proof Size: Each proof is approximately 1.2 KB, with verification time under 2 seconds on a standard laptop. Public Parameters: The setup ceremony parameters (multi-party computation) are also open-sourced, allowing anyone to reproduce the trusted setup. Breaking Down the Open-source License The code is released under the Apache 2.0 license, with a separate patent license grant covering the underlying zero-knowledge identity protocols. This means developers can freely use, modify, and distribute the software, even in commercial applications, without fear of patent litigation from World or its parent company Tools for Humanity. Project Name / Asset Open-Source Component License Type Audit Firm Key Metric World (ProveKit) Identity proving toolkit Apache 2.0 + patent grant Trail of Bits, Kudelski Security Proof size: 1.2 KB Why Provekit Matters for Privacy and Regulation The zero-knowledge identity proving toolkit directly addresses one of the crypto industry’s most persistent tensions: the need for Sybil resistance versus the demand for privacy. Traditional identity systems either leak personal data (e.g., KYC with passport scans) or rely on centralized oracles that can be coerced or hacked. ProveKit allows a user to prove they are a unique human without disclosing any identifying information - not even their public key is linked to the proof. This has immediate regulatory implications. In jurisdictions with strict data protection laws (e.g., GDPR in Europe, CCPA in California), storing biometric data like iris scans creates significant legal liability. By open-sourcing a tool that eliminates the need for any central database of biometrics, World positions itself as a compliant identity layer. The open-source nature also means regulators can independently verify that no backdoors or data leaks exist in the code. World’s Chief Protocol Officer, Tiago Sada, stated in the announcement: “ProveKit is the culmination of two years of R&D into making zero-knowledge proofs practical for identity at scale. By open-sourcing the entire stack, we are handing the keys to the community. Anyone can now build a privacy-preserving identity system without asking for permission - and without trusting us.” The Developer Ecosystem Impact The release includes comprehensive documentation, a test suite, and example implementations for JavaScript/TypeScript, Rust, and Python. Key integrations already in development include: WalletConnect-based identity bridges for mobile wallets Governance plugins for DAOs to require proof of personhood for voting Anti-sybil modules for airdrops, NFT mints, and reputation systems WebAuthn compatibility for hardware-backed identity verification The toolkit also supports multiple proof output formats, including JSON, CBOR, and raw bytes, to accommodate different blockchain environments. Background: World’s Rocky Road to Open Source World (formerly Worldcoin) launched in 2021 with the ambitious goal of creating a global digital identity network using iris-scanning “Orbs.” The project quickly drew controversy over privacy concerns, with regulators in Kenya, Germany, and the United Kingdom launching investigations. In response, the company rebranded to “World” and began shifting toward a more decentralized, privacy-first architecture. ProveKit was first announced in beta in March 2024, but remained closed-source as the team refined the circuits and completed audits. Today’s open-source release is the final piece of that transition. The timing also coincides with the upcoming launch of World Chain, a layer-2 blockchain designed specifically for identity-related transactions. Developers who integrate ProveKit now will be able to seamlessly deploy on World Chain when it goes live later this quarter. Market Reaction and Industry Commentary The open-sourcing of ProveKit has been met with cautious optimism by privacy advocates and crypto developers. Notable figures in the zero-knowledge community have publicly praised the move, with Michele (zkSync contributor) tweeting that “ProveKit is the most production-ready ZK identity toolkit I’ve seen. The documentation is excellent.” World’s native token, WLD, saw a modest uptick of 3.2% in the hours following the announcement, though the broader market remained flat. Analysts view the move as a positive signal for the project’s long-term viability, but note that regulatory clarity and actual developer adoption will be the true test. What Are the Risks? Despite the open-source release, skeptics point out that the Orb hardware itself remains closed-source and controlled by World. While ProveKit can be used to verify proofs generated by any compliant device, the only way to obtain a valid proof of personhood today is through World’s proprietary Orbs. This creates a centralization bottleneck at the hardware level. The project has stated that a “third-party Orb certification” program is in the works, but no timeline has been given. What Is the Difference Between Provekit and Other ZK Identity Solutions? Unlike zkPass or Sismo, which focus on proving specific attributes from existing credentials (e.g., “I am over 18” without revealing my birth date), ProveKit is designed to prove uniqueness and humanness - the fundamental Sybil resistance question. It does not require any pre-existing identity document. The proof is generated directly from the biometric scan, making it more akin to Proof of Personhood than Proof of Ownership. How Does Provekit Handle User Privacy in Practice? The proof generation process happens entirely on the Orb device, which cryptographically signs the proof using a private key that never leaves the hardware. The user’s iris code is hashed and immediately discarded after the proof is created. The ZK circuit ensures that the verifier sees only a binary output: “proof valid” or “proof invalid.” No biometric data, public key, or timestamp is revealed. What Does This Mean for World’s Regulatory Standing? Open-sourcing the core identity toolkit is likely to be welcomed by regulators in Europe and the US, as it demonstrates a commitment to transparency and verifiability. However, the European Data Protection Board (EDPB) has yet to issue a formal opinion on the new architecture. The move could also influence the ongoing investigation by the UK’s Information Commissioner’s Office (ICO). Where Can Developers Access the Provekit Code? The code is available on World’s official GitHub repository under the `provekit` monorepo. The repository includes the circuit source, prover/verifier libraries, and a developer guide. World has also launched a dedicated developer portal with interactive tutorials and a testnet faucet for building proofs without real hardware.