Show HN: Anonymous age verification with passkey-powered encryption

Hacker News Top Products

Summary

ONE is a privacy-focused identity infrastructure that uses passkey-powered encryption for anonymous age verification and proof of personhood, allowing users to control their data without exposing personal identifiable information.

This project has been kicking around in my head since I first heard about the webauthn PRF extension in early 2024. I&#x27;ve slowly chipped away at it since, and finally got things to a shareable state over the summer thanks to a very fun parental leave. Headed back to work tomorrow, so I figure there&#x27;s no time like the present.<p>tldr: A client-held encryption key derived during passkey authentication encrypts all sensitive user data prior to persistence so that only the user is able to decrypt and reuse that data on their device. This allows short-lived, privacy-preserving age proofs to be issued to requesting applications (18+, no PII shared) without requiring users to re-upload their documents. The SSO user experience is built on top of the OAuth 2.0 Authorization Code Flow.<p><a href="https:&#x2F;&#x2F;loginwithone.com" rel="nofollow">https:&#x2F;&#x2F;loginwithone.com</a> - demo video + high-level architecture + FAQ<p>I also made the parody demo apps from the video public if anyone wants to play around with the user experience:<p><a href="https:&#x2F;&#x2F;demo.brainrot.loginwithone.com" rel="nofollow">https:&#x2F;&#x2F;demo.brainrot.loginwithone.com</a> <a href="https:&#x2F;&#x2F;demo.dgnrt.loginwithone.com" rel="nofollow">https:&#x2F;&#x2F;demo.dgnrt.loginwithone.com</a> <a href="https:&#x2F;&#x2F;demo.kirby.loginwithone.com" rel="nofollow">https:&#x2F;&#x2F;demo.kirby.loginwithone.com</a><p>I suspect most will choose to pass on the ID stage for now (no offense taken, doing so is low reward in this context) but if you navigate to <a href="https:&#x2F;&#x2F;app.loginwithone.com" rel="nofollow">https:&#x2F;&#x2F;app.loginwithone.com</a> after onboarding you can demonstrate the passkey-powered encryption on your email via the lock&#x2F;unlock button.<p>Very open to feedback and happy to answer any questions! I plan to pull the client-side encryption functionality into an open-source typescript library for general use, so any thoughts or suggestions on what you’d like to see out of that interface would be supremely useful. Thanks all,<p>Michael
Original Article
View Cached Full Text

Cached at: 08/22/26, 07:42 PM

# ONE - Anonymous Identity Infrastructure Source: [https://loginwithone.com/](https://loginwithone.com/) Login With One ## Privacy, rebuilt for a strange new world\. Passkey\-first authentication\. Universal Identity\. Private by design\. Private by design ## Only you hold the keys to your data\. Sensitive data stays encrypted at rest\. No readable Personal Identifiable Information \(PII\) is stored\. 01**User device**holds key 02**Encrypted data**protected at rest 03**ONE**cannot decrypt it Anonymous age verification ## Verify once\. Prove your age anywhere\. User\-held encryption keys unlock reusable, one\-tap age verification without exposing sensitive data\. Verified once Age 18\+YesName—Birth date—Government ID— Proof of personhood ## Know there's a human behind the account\. One\-tap, anonymous confirmation that an account belongs to a verified person\. Designed for AI platforms working to limit bot accounts and prevent automated model distillation, but useful anywhere an application needs frictionless proof of personhood\. Verified once Verified personYesName—Birth date—Government ID— Passkey first ## Skip the password\. Skip the inbox\. Passwords can be guessed or phished\. Email login flows are slow and vulnerable to phishing\. Passkeys are fast and phishing\-resistant\. Password**Phishable** Email login**Slow \+ phishable** Passkey**Fast \+ phishing\-resistant** FAQ ## Frequently asked questions\. ### WhyOnefor businesses? Some applications need to know that a user is old enough to use their product\. Others want confirmation that there is a verified person behind an account\.Onereturns the required identity proof in one tap, helping businesses meet their requirements without collecting personal data or putting users through a long and invasive verification flow\. ### WhyOnefor users? Users verify their identity once, then reuse it across any application that usesOne\. No repeated ID uploads, and no new processor to trust with sensitive data\. Applications receive only the proof a user approves, not their PII\. Their data stays encrypted with a key only they hold, so even a breach ofOnewould not expose readable identity data\. ### IsOneonly for age verification? No\. Age verification is simply the first privacy challenge thatOnewas built around\. The same infrastructure can confirm that an account belongs to a verified person without revealing who they are\. At its core,Oneis a new primitive for persisting sensitive data under user\-held encryption\. It can power reusable identity presentation for KYC, private AI chat transcripts, and other applications that require persistence of sensitive data without surrendering custody to the platform\. ### How doesOnestore personal data? Onestores ciphertext: encrypted blobs created with a key held by the user\. Never the underlying identity data\. This includes government ID data, as well as the verified email associated with the account\. ### What does my application receive? Only the requested proof and an audit record\. For example, that a user is a verified person or is at least 18 years of age, and when the check was completed\. No name, birth date, address, selfie, or ID image\. ### Why wasOnecreated? Applications increasingly need to verify aspects of their users’ identities, but traditional verification methods create a new privacy problem\. Users upload IDs, selfies, and other PII to providers that can read and retain it, then repeat the process across multiple applications\. That creates friction and spreads sensitive data across more databases and attack vectors\.Onewas built around a new primitive to resolve that conflict: reusable identity data encrypted with keys only the user holds\. Businesses get the proof they require, while users maintain their privacy and custody of their data\.Read more:[The Internet Should Be More Like a Liquor Store](https://loginwithone.com/blog/the-internet-should-be-more-like-a-liquor-store/) ### How can I find out more? Email[\[email protected\]](https://loginwithone.com/cdn-cgi/l/email-protection#4b22252d240b27242c22253c223f2324252e6528242674383e29212e283f76192e3a3e2e383f6e797b2a28282e38386e797b3f246e797b04050e)to ask a question, discuss an integration, or request access\.

Similar Articles

Anonymous credentials: an illustrated primer (Part 2)

Hacker News Top

Second part of an illustrated primer explaining real-world anonymous credential systems like Privacy Pass and Google's age-verification proposal, focusing on preventing credential cloning and enabling expressive proofs without sacrificing user privacy.

Opaque, Interoperable Passkey Records

Lobsters Hottest

This article proposes an opaque, interoperable passkey record format based on PHC strings and describes a Go API for handling them, aiming to simplify server-side passkey storage and library interoperability.