For sites and platforms
One real person per account.
No identity to look after.
Human Pass tells your site that each account belongs to a different, ID-verified person, without you ever collecting, seeing or storing who they are.
- verified_human
- true
- sub
- "1.k3Fq9vT2xLm…"
- scope
- "your site only"
- Legal name
- Date of birth
- Home address
- Government ID number
- Document images
- Email address
The problem
The Internet can't tell people from accounts.
One person can run a hundred accounts. A script can run a hundred thousand. Sites are left choosing between abuse and intrusion.
Multi-account abuse is everywhere
- Bots flooding sign-ups, reviews, and replies
- Sock puppets manufacturing consensus
- Ban evasion — a new account minutes after the last one
- Promotion and referral farming — one person, many sign-up bonuses
- Coordinated manipulation of votes, polls, and rankings
Collecting IDs creates a new problem
Requiring a government ID can stop some of this, but it makes your site a custodian of passports, licences and home addresses.
That's a breach liability, a compliance burden, and a reason for honest users to walk away.
Human Pass separates proving someone is a unique person from revealing who that person is.
How it works
Your users verify once. You get a yes and an ID, nothing else.
-
1
Your user
Clicks "Continue with Human Pass" on your sign-up or sign-in page.
-
2
Verification provider
The first time only: checks their ID and a live selfie, then deletes them. It's never told your site sent them.
-
3
Human Pass
Keeps only a one-way fingerprint of the document, so one ID can only ever be one Human Pass.
-
4
Signed token
verified_human: trueplus an ID for that person on your site only. -
5
Your site
Allows one account per ID, and makes bans stick, without holding anyone's identity.
Privacy architecture
Same person. Unlinkable IDs.
Your site gets its own ID for each verified person. It's stable on your site, so returning users are recognised and duplicates are caught, but it means nothing anywhere else.
-
Nothing to breach
You receive a yes and an opaque ID. No names, documents or emails reach your systems.
-
Per-site IDs
IDs are derived per site with keys held in a hardware security service, so they can't be joined into a cross-site tracking ID.
-
Minimal collection
We keep a one-way fingerprint of the document and an encrypted email for security notices. No document scans, no profiles, no list of the sites a person uses.
-
Identity is not for sale
We don't sell people's information. You pay for assurance, not data.
1.k3Fq…. No two sites can compare notes to find the same person.
What you get
Know they're a real person. Don't need to know who they are.
One person, one account
Limit accounts per person with a stable ID, and make bans stick when someone comes back with a new email.
No identity data to guard
You never receive names or documents, so there's nothing sensitive to breach, retain, or explain.
Told when things change
A status check tells you when a Human Pass is suspended, deleted, or turns out to be a duplicate of another of your accounts.
Less friction for real users
People are far more willing to prove they're human when they aren't asked to hand you who they are. They verify once, for every site.
Built for services where unique humans matter
- Forums & communities
- Social networks
- Marketplaces
- Giveaways & referral programs
- Dating
- Voting, polls & petitions
- Reviews & ratings
- Free tiers of AI products
Developers Sandbox
If you've added "Sign in with…", you already know how.
Human Pass is a standard OpenID Connect provider. Redirect the user, receive a signed token, read two claims.
- 01
Send the user to Human Pass with the
openid personhoodscope. - 02
They sign in, verifying their ID the first time only.
- 03
You get back a token with
verified_humanand an ID for your site,sub. - 04
Check the status of the IDs you hold now and then, to hear about suspensions, deletions and duplicates.
The sandbox is open to design partners. Interfaces may still change as we work with them. For your security review, see the security and privacy overview.
// Decoded token payload
{
"aud": "your-client-id",
"sub": "1.k3Fq9vT2xLm…", // this site only
"verified_human": true,
"acr": "urn:humanpass:acr:id-verified-dedup",
"iat": 1790467200
}
// No name. No birthdate. No document. No email.// After the OIDC callback
const claims = await humanPass.verify(idToken);
if (!claims.verified_human) {
return reject("verification_required");
}
// Same person → same sub, every time, on your site
const account = await accounts.findBySub(claims.sub);
if (account?.banned) {
return reject("banned"); // a new email won't help
}
return account ?? accounts.create({ sub: claims.sub });Where it's going
A personhood layer for the Internet — built on privacy, not surveillance.
Many ways to verify, one integration
Human Pass is built to sit in front of several verification providers, and later digital ID wallets and mobile licences, so you get broad coverage without changing your integration.
Free for people
Your users never pay to prove they're human. Sites pay for the service, so nobody pays with their data.
Portable, not trackable
People verify once and use it on every participating site, which keeps sign-up friction low, while every site sees a different ID.
Get in touch
Help build proof of personhood the right way.
Human Pass is early. We're looking for design partners who want to shape it with us.
Sites & platforms
Integrate on the sandbox as an early adopter and help define the API, pricing, and policies around your real abuse problems.
Identity-verification providers
Reach new sites through a privacy-first channel that never resells your users' data.
Thanks — message received.
We'll be in touch soon.