Next-Gen Identity Primitive

Identity
Without
Compromise.

VEID is a cryptographic identity system that lets you prove exactly what you need to — without revealing anything you don't. No email. No password. No persistent ID. Just math.

🌀 Live Demo 📄 Whitepaper
2¹²⁸
Proof security
level
< 1.5s
Full auth
round-trip
0 PII
Stored by
verifier
9/9
Attack classes
mitigated
🟢 Live · Time-keyed · Liveness ✓
Protocol

How VEID Works

Four cryptographic steps, invisible to the user. The entire flow completes in under 1.5 seconds.

01
🌱
Generate Identity
A BIP-39 24-word seed phrase creates your master key on-device. Nothing leaves your phone. You own it absolutely — it can be recovered anywhere.
02
🔑
Derive Org Key
For every service, VEID derives a unique key via HKDF(masterSeed, orgDomain). Your bank key and airline key share zero mathematical relationship. Services cannot cross-correlate.
03
🔐
Prove, Don't Reveal
Need to prove you're 18+? VEID generates a zk-SNARK proof that satisfies the constraint — without revealing your actual age, name, or any raw data. The verifier sees only: true.
04
🌀
Show Your Glyph
An animated, time-keyed geometric pattern unique to your session — replacing QR codes. Each frame is derived from HMAC(orgKey, ⌊t/1s⌋), making screenshots and screenshots useless as attack vectors.
Capabilities

Built for the Way
Privacy Should Work

Every design decision in VEID starts from the same question: what's the minimum the other party needs to know?

🕵️
Anonymous by Default
Your VEID address is unique per organization. No persistent global identifier. Airlines, banks, and hospitals each see a completely different address — they cannot link your activities even if they share databases.
UNLINKABLE
🎛️
Selective Disclosure
You control exactly which fields you share, per request. Each disclosed field is a zero-knowledge proof — the verifier learns only that your claim is true, never the underlying data value.
ZK PROOFS
🚫
No Password. No Email.
Authentication is a cryptographic challenge-response. The server issues a nonce; your device signs it with the org key. No shared secret. No credential to phish. No database of password hashes to breach.
PHISHING-PROOF
🔄
Recoverable Identity
Your 24-word BIP-39 seed is the only thing you need to reconstruct your entire VEID wallet — including every org key — on any new device. No cloud backup required. No central authority to call.
SELF-SOVEREIGN
⛓️‍💥
No Blockchain Required
VEID is pure cryptography. All proofs are self-contained and verifiable offline. No gas fees, no network sync, no infrastructure dependency. Works on airgapped devices and embedded systems.
CHAIN-FREE
📱
Cross-Platform SDK
Native SDKs for Android (Kotlin + JNI), iOS (Swift + Metal), Chrome Extension (TypeScript + WASM), and Windows (C# + P/Invoke). One protocol, four platforms, sub-2-second UX everywhere.
4 PLATFORMS
Visual Identity

The Glyph

A QR code tells the scanner your identity. A Glyph proves your identity — and it can't be copied.

Bank · HkRz…
Airline · QT8n…
Hospital · Mv3p…
🌀
Deterministically Unique
Each Glyph is generated by a seeded pseudo-random algorithm from the user's per-org address. Same address always produces the same visual — instantly recognizable by the user, impossible to fake.
🎬
Time-Keyed Animation
Every frame's rotation and color phase is derived from HMAC(orgKey, ⌊t/1s⌋). The animation is cryptographically keyed to the current second — making screenshots and video replays immediately detectable.
👁️
Liveness Detection
VEID scanners verify both the phase hash and optical flow (pixel movement per second). A static image always fails — even if the attacker has the correct phase, they cannot generate the expected smooth animation.
🔗
Per-Org Unlinkability
Three orgs, three different Glyphs — even for the same user. Each Glyph encodes only the derived org address. An airline and a bank cannot use Glyph visual similarity to correlate that the same person visited both.
Comparison

VEID vs the Field

Every existing solution makes a trade-off VEID refuses to make.

Dimension 🌀 VEID 🔑 Passkey / FIDO2 🪪 SSI / DID 🦊 Web3 Wallet
Anonymous by default ✓ Per-org derived address ✗ Discoverable credential ~ Persistent DID ~ Pseudonymous
Selective disclosure ✓ ZK proof per field ✗ Auth only ✓ W3C VC ✗ Address only
Cross-service unlinkable ✓ Full ✗ Same credential per RP ~ DID rotation needed ✗ On-chain address is public
No blockchain ✓ Pure crypto ✓ W3C standard ~ Some DIDs use ledger ✗ Requires gas + sync
Phishing resistance ✓ Domain-bound key ✓ Origin-bound ~ Wallet UI dependent ✗ Blind signing attacks
Visual identity token ✓ Animated Glyph ✗ None ✗ Static QR at best ✗ Address string
Verifier breach impact ✓ Zero PII exposed ✓ Public key only ~ Issuer-dependent ~ Address exposed
Self-sovereign recovery ✓ BIP-39 seed phrase ~ Platform-dependent ✓ Seed / DID rotation ✓ Seed phrase
Threat Model

Built to Withstand
Real Attacks

VEID has been designed against nine distinct attack classes. Eight are fully mitigated cryptographically. One — seed compromise — requires operational security practices.

🔄
Replay Attack
Single-use nonces with 60s expiry. Captured responses are worthless.
BLOCKED
📸
Glyph Screenshot
Phase hash + optical flow liveness check. Static images fail instantly.
BLOCKED
🎣
Phishing / Relay
Domain-bound key derivation. Credentials for evil.com are invalid at bank.com.
BLOCKED
🔗
Cross-Org Correlation
HKDF is one-way. Colluding orgs cannot link derived addresses to a single identity.
BLOCKED
🧪
ZK Proof Forgery
2¹²⁸ soundness under discrete log. Forging without a valid witness is infeasible.
BLOCKED
💾
Verifier Data Breach
Verifiers store zero raw PII — only per-org pubkey hashes and ZK commitments.
BLOCKED

View all 9 attack simulations in the interactive threat lab →

Cryptographic Foundation

Every Primitive
Has a Reason

No experimental cryptography. Every building block is battle-tested and peer-reviewed.

🔑
Ed25519 Signing
128-bit security, fast verification (<1ms). Used for challenge-response authentication and session signatures. Non-malleable by construction.
RFC 8032
🌳
HD Key Derivation (BIP-32)
HMAC-SHA512 child key derivation. One master seed → infinite unlinkable org keys. No interaction required for derivation — pure deterministic math.
BIP-32 / BIP-39
🔬
Groth16 zk-SNARKs
Constant-size proofs (~200 bytes), sub-5ms verification. Circuits compiled with Circom. Proving key generated via Powers of Tau ceremony.
EUROCRYPT 2016
🧂
HKDF-SHA512
HMAC-based Key Derivation Function. Used to derive per-org keys from the master seed. One-way by design — org keys cannot be used to recover the master seed.
RFC 5869
🏦
Secure Enclave Storage
Master seed encrypted in hardware: Android Keystore (StrongBox), iOS Secure Enclave, Windows TPM 2.0. Keys are non-extractable; biometric auth required per signing operation.
FIDO2 / SE
🎨
Seeded PRNG Glyph
Deterministic geometric pattern generated from a seeded LCG/Mulberry32. HMAC phase token ensures each second's animation is cryptographically unique and liveness-verifiable.
HMAC-SHA256

Experience VEID

Try the live interactive demo, read the full technical whitepaper, or explore the Developer SDK integration guide.

🌀 Interactive Demo 📄 Technical Whitepaper
Threat Lab SDK Docs Crypto Spec Roadmap