About
Authentication that never holds the secret.
ZKAuth is an authentication platform built on one idea: the safest credential is the one the server never receives.
The idea
Every authentication service carries the same quiet risk: it is a warehouse of other people’s secrets. Passwords are hashed, salted, and guarded, but they are still there, and the worst day of any auth vendor is the day that warehouse leaks.
ZKAuth removes the warehouse. When someone logs in, their password is turned into a zero-knowledge proof on their own device: a few hundred bytes that demonstrate they know the password without revealing it, or even its hash. The server verifies the proof, checks that it is fresh, bound to the right project and email, and never used before, and then issues a session. The password itself never crosses the network.
The second half of the idea is about how a security product should talk. Shipped work, preview work, and future work are different promises. We keep those boundaries visible so a developer can understand exactly what ZKAuth is ready to do today, and what still belongs on the limitations page, out loud, first.
Prove you’re you. Reveal nothing else.
What ZKAuth is
A complete platform around the proof.
Engine
Verifies proofs, issues sessions, and enforces single-use replay protection that fails closed.
SDK and framework packages
zkauth-client runs the cryptography on the device, with packages for Node, Next.js, React, Express, and Hono.
Dashboard
Projects, environment keys, webhooks, logs, audit trails, and per-project security policy.
Hosted pages
Sign-in, sign-up, recovery, and device approval with bounded branding and exact callback allowlists.
CLI and MCP
Scaffolding, doctor checks, generated middleware, and a docs server AI tools can read directly.
Status page
Deployed independently at status.zkauth.dev, out of band from the platform it reports on.
Who builds it
Two people, end to end.
ZKAuth is designed, built, and operated by its authors, from the proving circuit to the pixels on this page.
