Prove age,
not identity.

Pick a date of birth for a stand-in holder. The demo mints a credential for that holder and runs a real Groth16/BN254 proof against the live verifier — no mock, which is why it takes about 10–15 seconds. In this demo the stand-in wallet and issuer run co-located on the demo server, so the date you type goes to the demo wallet to mint the credential; the verification transcript itself reveals no date of birth.

The public POST /verify/age endpoint mints and verifies a real Groth16/BN254 zero-knowledge proof end to end: the holder proves age_over_18 (and a per-relying-party scoped nullifier) in zero knowledge against a trusted issuer accumulator (a fixed shared set of K = 6,000,000 members folded into a depth-23 Poseidon-Merkle root), revealing no date of birth — the holder's secret is CSPRNG-random, not derived from the birthdate, so the DOB is not recoverable from the public transcript or the published root. It is reference-grade: the proving system uses a single-party deterministic trusted setup — not a multi-party ceremony — so it is not production-secure against a determined forger, and an over-18 proof is unlinkable among ~4,920,000 adults (the over-18 members of that 6,000,000-member set), a reference scale, not internet-scale. A real proof takes about 10–15 seconds — the honest cost of real ZK. [AGE-ZK-1]

Same stand-in holder, same birthdate, two different relying parties. Both accept — and each receives a different per-site nullifier over a freshly re-randomized proof. Run it and compare the values yourself.

The same holder presenting an age proof to two different relying parties (POST /verify/age, same date of birth, different relying_party_id) is accepted at both, yet produces two different per-relying-party nullifiers, and each show is a freshly re-randomized proof (byte-different every time) — so two colluding sites have nothing stable to correlate on. Every holder shares one published issuer accumulator root (a fixed set of K = 6,000,000 CSPRNG-seeded members folded into a depth-23 Poseidon-Merkle root): the root is an issuer-level constant identical for everyone, not a per-person handle, and the date of birth is not recoverable from the root or transcript. Each proof reveals only {shared issuer root, site-scoped nullifier, age ≥ 18}; a fail-closed replay guard rejects a captured transcript. Each is a real Groth16/BN254 zero-knowledge proof (~10–15 s per site). Reference-grade, honest residuals stated: unlinkable among ~4,920,000 adults (the over-18 members of a 6,000,000-member set; a reference scale, not internet-scale); a single-party deterministic trusted setup — not a multi-party ceremony; the replay guard and issuer/wallet co-location are demo-grade (in-memory); the self-contained demo maps an adult birthdate to one cached member; and two distinct same-age members share a nullifier with residual ~1/60,000 (about 0.0017%, which never de-anonymizes). The unlinkability property itself is modeled and machine-checked but partial overall — never "unlinkability-certified". [UNLINK-1]

Designed and machine-checked for unlinkability properties: identifier-hiding (T10a), audit/verifier-split (T10d) and nullifier-unlinkability / private-presentation theorems are discharged; verifier-view unlinkability, issuer hiding and selective-disclosure privacy are modeled with machine-verified observational-equivalence lemmas but remain partial overall. [FV-3] Theorem status →