World released ProveKit as open-source code on September 2, 2026, a zero-knowledge toolkit that generates identity proofs on a user’s own phone. Nothing about the underlying document reaches a verifier or an external server.
The Big Picture
- World, the identity network formerly called Worldcoin, released ProveKit under an MIT license and already runs it inside World ID.
- ProveKit proves SHA-256 in 0.37 seconds on a MacBook Air, ahead of Barretenberg at 0.39 seconds and Circom at 0.40 seconds.
- Least Authority finished its security review of the mobile prover on May 11, 2026, and published the result.
- Developers write circuits in Noir, the language Aztec built, then ship new provable claims without a fresh app release.
- World Foundation plans a ProveKit v2 with smaller proofs, faster proving and cheaper on-chain verification.
World puts the proving step on the handset
The toolkit compiles Noir circuits into R1CS constraints and produces proofs with WHIR, a hash-based commitment scheme that needs no trusted setup. World targets 128-bit post-quantum security for the system. A verifier receives confirmation of one claim, such as an age threshold or a nationality, and learns nothing else.
Where the proof gets built matters more here than the cryptography behind it. Most production zero-knowledge stacks delegate proving to a server, sending the sensitive input off the device before any proof exists. ProveKit keeps that input local, shrinking the exposure to the handset itself. World ID Credentials hold data read from NFC chip-enabled identity documents on the device, and World Foundation, Tools for Humanity and outside parties cannot reach it.
Proud to announce ProveKit v1! Devs can build authentication with ZK privacy, running on all user devices.
— Remco (@recmo) September 2, 2026
2 years ago I started this project to show that every users’ phone is capable of ZK proving a passport document, under a minute, no trusted setup, 128bit post quantum…
Desktop-class timings on consumer hardware
The benchmarks carry most of the weight here. World’s published figures put a SHA-256 proof at 0.37 seconds on a MacBook Air, with peak memory at 118.9 MiB resident. Key material a device has to download stays under 1 MiB, against a 128 MiB CRS for Barretenberg and a 50.9 MiB zkey for Circom.
Those download figures decide whether client-side proving ships at all. A 128 MiB artifact is a non-starter on a mid-range Android handset in a metered-data market. World says proofs finish in seconds on a typical phone and in under 30 seconds on the low-end device it tested, running with limited memory and supporting offline use.
What the audit and the benchmarks do not settle?
The Least Authority review covered the prover as it stood in May 2026, and the v2 work now in progress falls outside it. The sub-30-second number comes from World’s own testing, and World has not named the handset. The comparison against Barretenberg and Circom is World’s own single-workload result, and no independent benchmark of it has been published.
Four questions stay open:
- Which low-end handset produced the sub-30-second measurement, and at what memory ceiling?
- Whether the 128-bit post-quantum target holds through the on-chain verification path planned for v2?
- How many World ID claims currently run through local proving?
- What the audit found in detail, since the published summary points readers to the full report?
Developers already building on the repository should pin the v1 branch. The maintainers flag `main` as carrying breaking changes while proof and key formats move. Anyone using World ID today can check whether an app asks for a locally generated proof or a delegated one, because only the local path keeps document data on the phone.
Implications for identity checks in crypto and payments
Client-side proving arrives in a market that spent years building the opposite habit. Exchanges, payment firms and lenders wrote their compliance stacks around collecting and storing documents, and eKYC adoption trends show that model expanding across banking, fintech and insurance. Every stored passport scan is a breach liability, and regulators keep raising the cost of holding one.
ProveKit removes none of that obligation. A licensed firm still owes record-keeping duties that a bare attribute proof will not satisfy. The opening sits in the wide band of checks below full KYC: age gates, residency confirmation, nationality screening for sanctions purposes. Those flows collect entire documents today because the tooling to prove one attribute did not fit on consumer hardware.
World has already built the consumer half. Its World App identity and payments update shipped age verification alongside encrypted chat and merchant payments, giving ProveKit a distribution channel most zero-knowledge tooling never gets.
CoinLaw’s Takeaway
The advantage here is distribution. WHIR and Noir are public research any competent team can build on, and the hard part has always been fitting a prover inside a phone’s memory budget. Sub-second desktop proofs and key downloads under 1 MiB are the numbers that decide whether a private age check reaches a real checkout flow. World has those numbers, plus an app already sitting on the phones that would run it.
The open-source release also shifts who carries the risk. Code audited by Least Authority and published under MIT terms can be read by the exchanges and payment firms that would otherwise take World’s word for what happens on the handset. That inspection is the price of entry for regulated use, and it is also where the current version’s limits will show, because the audit covers one snapshot of a codebase whose proof formats are still moving. The engineering question looks settled enough to test. The compliance question, whether a bare attribute proof satisfies a regulator’s record-keeping rule, is not.
