Imagine an online vote with a million people. Now imagine one person running 400,000 of them. They didn’t hack in or steal any passwords. All it took was a simple script, a few thousand email addresses, and an afternoon. The results would still look like democracy, because the internet has no built-in way to answer the most important question: is there actually a different human behind each of these accounts?
Key Takeaways
- Proof of Personhood answers a question the web never could. Proof of personhood confirms an account belongs to a real, unique human, without necessarily revealing who they are. It enforces one rule: one person, one credential.
- It is not KYC and not a CAPTCHA. KYC asks who you are. A CAPTCHA asks whether you’re probably human. Proof of Personhood asks whether you’re a distinct human who hasn’t registered before.
- The web is now majority machine. Automated traffic reached over 53% of measured web traffic in 2025, and malicious bots made up 37% in 2024. Meanwhile, CAPTCHAs are proving inadequate against sophisticated AI.
- Every method trades one thing for another. Biometrics give strong uniqueness but carry permanent privacy risk. Government IDs carry legal weight but exclude people without documents. Social graphs and puzzles avoid biometrics but can be gamed. Multi-signal scores spread risk but are only as strong as their signals’ independence.
- No single approach is ideal. The strongest designs tend to combine more than one method, a point Vitalik Buterin has made himself.
This gap is why an idea that used to be only discussed in cryptography circles is now a major point of debate in technology. It’s called proof of personhood.
What is proof of personhood?
Proof of personhood, or PoP, is a method to confirm that a digital identity belongs to a real, unique human, without necessarily revealing who that person is. It simultaneously answers two questions: Are you human (not a bot, script, or AI)? And have you already registered (so one person can’t create multiple identities)?
The second question is what makes PoP different. A CAPTCHA can tell you that a human is likely involved, but it can’t stop that same person from solving thousands of them and creating thousands of accounts. PoP is designed to enforce a single rule: one person, one credential.
It’s also not the same as KYC (Know Your Customer). KYC checks ask for your identity, requiring a name, documents, or an address. Proof of personhood only asks, “Are you a distinct human?” In the best systems, it learns nothing else about you.
In the crypto world, PoP is similar to proof of work and proof of stake. Those methods give influence based on computing power or money. PoP, however, gives one equal share to each human.
A web that is now mostly machine
Why is this important now? Because the nature of the internet’s audience is changing. According to data from Thales/Imperva, automated traffic made up over 53% of measured web traffic in 2025, up from 51% in 2024, leaving humans at 47%. This figure includes things like web crawlers and scripts, not just malicious bots, and it comes from vendor network data. However, the trend is clear.
The amount of harmful automated traffic is also increasing. Imperva reported that malicious bots accounted for 37% of internet traffic in 2024, up from 32% the previous year, and they blocked 13 trillion bad bot requests that year.
Then there is the money:
- $84 billion: estimated digital ad fraud in 2023, roughly 22% of ad spend, with Juniper Research forecasting $172 billion by 2028 (a forecast, not an audited loss).
- 80.6 million: fake accounts LinkedIn says it blocked at registration in the second half of 2024.
- 1.4 billion: fake accounts Meta says it took action against in Q4 2024.
- 8 million: estimated deepfake files online in 2025, up from roughly 500,000 in 2023 (an estimate of synthetic-media volume, not of successful fraud).
And the old defenses are wearing out. A 2024 paper by researchers from OpenAI, Microsoft, Harvard, MIT, Oxford and UC Berkeley argued that CAPTCHAs are inadequate against sophisticated AI, while ID-and-selfie checks can be too invasive.
An old problem with a strange name
The attack PoP defends against has a literary name. A Sybil attack is when one actor creates many fake identities to tilt a system. The term traces back to a 2002 Microsoft Research paper by John R. Douceur, which borrowed its name from the 1973 book Sybil, about a woman with multiple identities.
For years the problem lived in peer-to-peer networks. Then crypto made it lucrative. Wherever tokens, votes or rewards are handed out per account, there is an incentive to farm accounts: wallets swarming airdrops, fake contributors inflating quadratic-funding matches, bots draining liquidity-mining rewards.
The timeline of the idea is short:
- 2002: Douceur formalizes the Sybil attack.
- 2014: Vitalik Buterin raises the need for a “unique identity system” giving each human one anti-Sybil token.
- 2017: Borge et al. propose the term “proof of personhood,” built around in-person “pseudonym parties.”
- 2024: A 32-author coalition publishes the Personhood Credentials framework.
- Today: Iris scanners, ZK passports and multi-signal scores compete to become the default.
Five ways to prove you’re you
There is no single correct method. Every approach trades one thing for another.
| Approach | How it works | What it gets right | Where it breaks |
| Biometrics | Scan an iris, face or palm to establish uniqueness | Strong uniqueness, hard to fake at scale | Needs special hardware, and you can’t change your iris if the data leaks |
| Social graph | People vouch for each other; algorithms flag fake clusters | No biometrics, community-driven | Collusion, hard to bootstrap, weak against small attacks |
| Synchronous events | Everyone solves puzzles or meets at the same time | Uniqueness without personal data | Scheduling excludes people; AI keeps getting better at puzzles |
| Government ID + ZK | Use passports or IDs, wrapped in zero-knowledge proofs | Existing infrastructure with legal weight | Excludes anyone without reliable documents |
| Multi-signal aggregation | Score many independent signals together | No single point of failure, no special hardware | Only as strong as the independence of its signals |
The common thread in the research: no single method is ideal. Buterin has said there is no perfect form of proof of personhood, and the strongest designs tend to combine more than one.
The contenders
Worldcoin, formerly known as World, is a prominent player. Their “Orb” scans a person’s iris to create an iris code. This code is then checked against a registry using zero-knowledge proofs through the Semaphore protocol. This allows people to prove they are unique without linking their activity to their biometric data. World reports over 18 million verified humans and more than 450 million uses of World ID, including over 360,000 verifications in Argentina. These numbers are reported by the company and have not been independently checked.
Human Passport, formerly Gitcoin Passport, uses a multi-signal approach. It combines various independent “stamps” like government ID (using ZK), phone verification, biometrics, and on-chain history to generate a Unique Humanity Score. They recommend a score of 20 for general use and 50 for their model-based detection. They report over 2.3 million Passports created and more than $512 million in value protected through distributions and governance. These figures are also self-reported.
Idena takes a different path, avoiding biometrics altogether. Participants solve “flip” puzzles created by humans within a specific, synchronized time window. While it once had about 15,778 participants, it’s now seen as a cautionary example.
Proof of Humanity is an Ethereum registry supported by Kleros. It uses video submissions and peer vouching. In 2022, it had around 17,000 members.
BrightID relies on social connections. Self, zkPassport, and Privado ID use chips in government passports or IDs combined with zero-knowledge proofs. Humanity Protocol uses palm recognition. However, a competitor’s explanation notes that Humanity Protocol’s privacy policy allows data sharing with authorities and for machine learning training, so users should review the terms carefully.
The Kenya chapter: when personhood meets regulators
The situation in Kenya highlights how proof of personhood intersects with regulators.
Proof of personhood isn’t just a technical challenge; it’s also about data protection.
Worldcoin’s iris scanning has attracted attention from regulators in places like Kenya, Spain, Hong Kong, and Brazil. The main concerns are about how biometric data is collected and managed. The fundamental issue is that while a password can be reset, an iris scan cannot. If biometric data is ever compromised, there’s no way to recover it.
This tension is central to the field. The methods that are most effective at verifying uniqueness tend to be the most intrusive, while the least intrusive methods are often easier to exploit.
Here’s a difficult truth: these systems can fail
It would be simple to think that proof of personhood is a solved problem, but it’s not.
Idena’s issues in May 2022 serve as a stark example. Research reviewed by Harvard’s Ash Center suggested that 40% or more of their accounts showed signs of unauthorized access by third parties.
Additionally, pooled accounts accounted for 61% of all accounts while receiving 70% of the rewards. This means that “verified humans” were essentially being rented, grouped together, and exploited. Whenever there’s a reward involved, a market for credentials inevitably emerges.
Three limits are worth keeping in mind:
- PoP does not prove identity. It says nothing about your name, intent or trustworthiness.
- PoP does not prove a human did the thing. A verified person can hand access to an AI agent, share credentials or act maliciously.
- No major PoP system has an independently audited user count. Treat headline numbers accordingly.
Then there is inclusion. About 850 million people lack official ID, according to the World Bank’s ID4D estimate. A system that demands a passport, a smartphone or a trip to a scanning location can lock out the very people the internet has yet to reach.
Personhood credentials: the emerging standard
In 2024, researchers from MIT, OpenAI, Microsoft, Harvard, a16z crypto and the Decentralized Identity Foundation proposed a formal framework called personhood credentials. It rests on three requirements:
- One credential per person per issuer, to prevent duplicate accounts.
- Unlinkable pseudonymity, so use cannot be traced across services, even if issuers and services collude.
- Minimal disclosure, revealing nothing beyond “this holder has a valid credential.”
In plain terms, it is the privacy-maximizing form of PoP: a digital passport that says real person and nothing more. The paper itself credits blockchain communities for the groundwork.
Why the stakes keep rising
Three forces are pushing PoP from crypto niche to mainstream infrastructure:
- AI agents. As software acts on people’s behalf, services will want to know a real human stands behind it. Cloudflare reported that 52% of crawler requests in June 2026 were for AI training, up from 22% in spring 2025.
- Synthetic media. One 2026 detection study found people correctly identified only 52.6% of short deepfake clips, barely better than a coin flip (a small study using five-second, audio-free clips).
- Money. Zero-knowledge proof markets are projected to grow from about $1.28 billion in 2024 to $7.59 billion by 2033, and the biometric-verification market from $8.88 billion in 2025 to $17.81 billion by 2030. These are proxies for demand in verification infrastructure, not for PoP specifically.
What PoP is used for today
- Airdrops and token sales: one human, one allocation.
- DAO governance: one person, one vote, instead of “whales decide everything.”
- Quadratic funding: protecting matching pools from fake contributors (Gitcoin Grants is the classic case).
- AI agent authentication: tying an agent to a real human principal.
- Social platforms and reputation systems: separating human posts from synthetic ones and anchoring reputation to real people.
What the market data can and can’t tell you
Crypto data aggregators track the token side of this story, not personhood itself. For World’s WLD token, a few views are worth adding if you publish this piece:
- Coinglass: WLD futures open interest and funding rates, to show speculative positioning.
- Santiment: social volume and social dominance around “Worldcoin” and “proof of personhood,” to show attention cycles.
- Glassnode: on-chain activity for assets where coverage exists.
These charts are interactive and licensed, so they should be captured directly from each platform with credit, rather than recreated from memory. None of them measures verified humans, so label them as market context, not adoption evidence.
The bottom line
Proof of personhood is not a magic filter for the internet’s problems. It is an attempt to add a layer the web never had: a privacy-respecting way to say there is a real, distinct person here.
The design fight is about trade-offs. Iris scans offer strong uniqueness at a high privacy cost. Government IDs offer legal weight but exclude millions. Social graphs and puzzles avoid biometrics but can be gamed. Multi-signal scores spread the risk but depend on the quality of every signal.
The question is no longer whether the internet needs this layer. It is who builds it, who controls it, and whether it can prove humanity without demanding too much of it.
Frequently asked questions
Is proof of personhood the same as KYC?
No. KYC asks who you are. PoP asks whether you are a unique human.
Does it require scanning my iris or face?
No. That is one implementation. Others use social vouching, puzzles, government credentials with zero-knowledge proofs, or multiple signals combined.
How is it different from a CAPTCHA?
A CAPTCHA checks that something is probably human. PoP also checks that the human hasn’t registered before.
Can AI break it?
AI already defeats older methods like CAPTCHAs. Systems that combine several independent checks are harder to beat, but none are immune.
Dan is a seasoned crypto writer for Blockchaindose who got his start in the space back in 2019. Over the past four years, he’s built a solid grasp of how the industry moves, focusing heavily on DeFi, NFTs, GameFi, and promising new projects.
Off the clock, you’ll usually find him buried in a good book or kicking back with a movie. His blend of hands-on market experience and straightforward commentary makes him a clear, trusted voice across the platform.
