How it compares
There are other ways for a site to know a human is behind an account. Most of them ask for more than Blind-ID does. This page is about what we gave up to ask for less, and what that costs you.
The bouncer standard
A bouncer checks your ID at the door. A clerk checks it at the register. Everyone involved knows this is imperfect: a younger sibling borrows an older one's license, a passable fake gets through, someone is waved past on a busy night. We know, and we keep doing it anyway, in every state, for decades.
That is not carelessness. It is a judgment that the check is good enough for what is at stake, and that the alternatives cost more than they are worth. Nobody proposes an iris scan to buy a beer. If they did, most people would object, and they would be right to: the intrusion would be wildly out of proportion to the problem.
Blind-ID is built to the bouncer standard, deliberately. We check that a real, government-issued ID was presented by the phone it lives on, unlocked by its owner. We do not check that the person holding the phone is the person on the ID. That is the same gap the bouncer has, and we are making the same trade for the same reason.
What that means a site cannot catch
Stated plainly, because you should not have to work it out:
- Someone using an ID that is not theirs.
- Someone who handed their account to another person after signing up.
- Someone acting on instructions from somebody else.
- Someone with two IDs, a passport and a license, opening two accounts.
What it does do is make operating at scale expensive. Every account needs a distinct, real, government-issued ID behind it. A script can invent a million usernames. It cannot invent a million driver's licenses.
That is the actual claim: not "this specific person is who they say", but "this is not a bot farm". Those are different, and conflating them would be dishonest.
How this compares
| Approach | What it asks of you | What you end up with |
|---|---|---|
| Iris or face scanning | A biometric scan, sometimes at dedicated hardware you travel to | Strong uniqueness. A permanent biometric record held by someone. |
| Document upload | Photos of your ID and usually your face | A company holding images of your identity documents, indefinitely. |
| Sign in with a big platform | An account there, and that company watching where you sign in | A login that can be fake, that can be many, and that one company can see across every site. |
| Phone number or CAPTCHA | A number that farms sell by the thousand, or a puzzle software now solves | Not much. |
| Blind-ID | One tap in your phone's wallet. No photos, no scans, no documents, no account anywhere. | An account at that site that is yours and that nobody can match to you anywhere else. |
Three things that make this different
1. Nothing about you is stored, anywhere, by us
Every other approach answers a question a website asked about you and leaves a record somewhere: a scan, an image, a profile, a login history. Blind-ID leaves none with us. The site gets a code made for it alone; we keep neither the code nor what it was made from. There is no account at Blind-ID to breach, subpoena or sell.
2. Your ID is structurally out of reach
We do not store your name, date of birth, address, document number, or photo. They pass through memory for the moment it takes to make the site's code, and then they are gone.
The consequence is worth being blunt about: we cannot tell anyone which ID belongs to which account, because we do not know. Not for a court, not for the site, not for ourselves.
Be clear about what that is and is not. The rest of this site is an ordinary website. It uses cookies, it counts visitors, it may carry advertising, and sites pay for the sign-in. None of that reaches your ID, and the reason is structural rather than a rule we follow: the data is not there. The full detail is in the privacy policy.
3. No two sites can compare notes
The code a site receives is made from your ID and that site. A different site gets a different code, with no arithmetic that connects the two. Somebody who breaches both sites learns that each has a real person behind an account, not that it is the same person. "Sign in with" buttons from the big platforms are the opposite: one identity, visible to that platform across every site that uses it.
Being precise about the boundary, because the difference is real: this is a fact about what we and the sites hold. It is not a claim that no one anywhere could ever infer a connection by other means, such as watching the same browser visit two sites. We would rather draw that line ourselves than have it pointed out.
Where this does not fit
If you need certainty that a specific individual is present, this is the wrong tool and you should use something stronger. Banks and border control should not be using the bouncer standard, and we are not suggesting they do.
Blind-ID is for the enormous middle ground where a site wants to know it is dealing with people rather than automation, or needs to know someone is an adult, and where demanding biometrics from everybody would be a cure worse than the disease.