How it works

What is this?

Blind-ID is a way to sign in to a website with the government ID in your phone's wallet: a mobile driver's license, a state ID, or a passport-based digital ID. The site learns that a real person with a real ID is behind the account. It does not learn who you are, and neither do we.

When you sign in, your wallet shows you which site is asking and exactly what it will share, and asks you to approve with your phone's unlock. We check that the ID is genuine and turn it into a one-way code that means something to that one site and nothing anywhere else. The site uses that code to recognize you next time. The ID itself is never written down.

What a site learns, and what it does not

It learns one thing: the same real ID is behind this account every time, so one person cannot open a pile of accounts there. That is what makes a site resistant to bots and fake accounts without making it a collector of identity documents.

It does not learn your name, your date of birth, your address, your document number or your photo, because none of that leaves our server's memory, and it never reaches the site. It does not learn which other sites you use, because the code it receives is made for it alone: two sites comparing their users find nothing in common, and neither would we, if we compared them, which we cannot, because we keep neither.

A site that is registered to check age receives one more thing: your ID's own yes-or-no answer to "over 18". Never a birth date, never an age in years.

What we ask your wallet for

An ID in a wallet carries all of this, and a verifier could ask for any of it. We ask for three things that together make your document unique, use them to make the site's code, and discard them: the document number, the country that issued it, and the state or province where there is one. A site that checks age adds the over-18 answer. Your wallet shows you the exact list before you approve, every time.

What a verifier could ask an mDL for, and what a site actually receives MOBILE DRIVER'S LICENSE SAMPLE SPECIMEN Portrait Given names Family name Date of birth Residential address License number Vehicle classes Date of issue Date of expiry Over 18: yes or no Sex · height · eyes What the site receives: a one-way code made for it alone, and for an age check, "over 18: yes or no" The code is a keyed one-way hash of the license number, where it was issued, and the site. It is not a field on the card, it cannot be turned back into your name, number or face, and a different site gets a different code. IRLProof keeps none of it. The over-18 answer is one bit, true of every adult. Everything else on the card above is discarded before anything is written down.

Nothing about you is stored here

There is no account at Blind-ID. We do not keep the code a site receives, we do not keep the values it was made from, and we keep nothing that connects one site's code to another's. Present the same ID at the same site and the same code comes out, which is how the site knows it is you; that is a calculation, not a lookup.

The consequence is worth being blunt about: we cannot tell anyone which ID is behind an account, because we do not know. Not for a court, not for the site, not for ourselves. And a new ID with a new document number is a new person to every site, because there is nothing on our side that could say otherwise. If a site wants you to be able to recover an account after your ID changes, it keeps its own way of doing that, the way it would for any other sign-in.

For the technically minded

The gist, not the full protocol.

  1. Standard OpenID Connect. A site adds Blind-ID the way it would add any other provider: discovery document, authorization code flow with a proof key, the openid scope. No SDK. The developer documentation is at /developers/sign-in.
  2. Presentation. The wallet presents the credential over the browser's Digital Credentials API, from a page on this site, signed for the site that is asking. IRLProof does not implement the ISO 18013-5 or OpenID4VP protocols itself; a dedicated verifier checks the credential's signature and confirms it chains to a trusted issuer, a state DMV or a national authority.
  3. The code, not the identity. The site's identifier is a keyed HMAC (SHA-256) over the issuing country, the issuing state, the document number and the site, under a key held in a separate key store. It is computed while the presentation is in memory and written into the site's token. The inputs are discarded when the request ends.
  4. What the token says. A sub that is stable at that site and meaningless elsewhere, when the ID was presented, and for a site that checks age, the over-18 boolean and a signed record of the check. Nothing else.
  5. Receipts. When a site asks you for something of its own during sign-in, or checks your age, it is given a signed receipt naming what was agreed and when. Receipts are ES256 tokens signed with the keys published at /.well-known/irlproof/jwks.json, and anyone can check one at /receipts.

This deployment's issuer is https://sandbox.irlproof.me and is a test environment: sign-ins here carry no assurance.

Do you track me? Do you make money from this?

Both fair questions, and the honest answer is easier to give than a vague one.

Regular website analytics and cookies are fair game. This site counts visitors, sees which pages get read, and uses cookies like almost every site on the internet. It may carry advertising on its own pages. Sites pay for the sign-in and for age checks; that is the business, and we would rather say so than pretend otherwise.

The information shared from your ID is not part of that, and cannot be. It is never stored, so it is not reachable by an analytics tool, an advertiser, a court order, or us. The one place anything from an ID is written down is a site's own age-check record, which says what kind of document was checked and which country and state issued it, so that the site can answer for the check later. It holds nothing that says who you are.

If you would rather we did not know your IP address or which pages you read, use a VPN or Tor. That is entirely your business and it changes nothing about the guarantee above, which was never about your browsing in the first place.

How it compares · Can I use it? · Privacy policy