Prove you’re you.
Reveal nothing else.
Build your first secure application with zero-knowledge proof authentication in minutes.
One principle, three credentials. The server verifies a secret it never receives.
Prove a password without sending it
The password becomes a zero-knowledge proof on the client. The server verifies it with a Groth16 verifier and stores only a commitment.
How the proof worksExchange keys, never the secret
A password-authenticated key exchange. The server holds an opaque credential it can never use to learn the password, even offline.
Read about OPAQUEHardware-backed sign-in
Hardware- and platform-backed passkeys through a backend proxy, so your project key never reaches the browser.
Set up passkeysThe password is proven, never transmitted.
ada@example.com
password
On the device
Argon2id and Poseidon derive a commitment; a Groth16 proof is generated locally.
Over the wire
Only the proof and public signals travel. No secret, no reversible hash.
On the server
The engine verifies the proof, guards against replay, and issues a session.
A real login in a few lines.
Use the zkauth-client SDK, or call the HTTPS API from any language. The proof handshake happens for you.
import { ZKAuthSDK } from 'zkauth-client'
const zkauth = new ZKAuthSDK({ apiKey })
// the proof is generated on the deviceawait zkauth.register({ email, password, deviceInfo })
// the server verifies it, never the passwordawait zkauth.login({ email, password, deviceInfo })Real measurements from the engine and client.
Local benchmark. Hosted calls include serverless cold starts and remote database latency, so budget user-facing timeouts accordingly.
We’d rather be precise than impressive.
Security writing is easy to fake. So here is the exact boundary, in plain language, and endpoints you can call to check it.
- 01No SOC 2, HIPAA, or completed external audit.
- 02No post-quantum security.
- 03No broad WebAuthn authenticator guarantees.
- 04Billing foundation exists; live paid checkout is deferred.