Proof of Personhood Without Biometrics: Eight Approaches Compared

Proof of personhood is any method that lets a platform establish that an account belongs to one real, unique human, and it can be done without collecting biometrics by accepting a "unique person" credential from a trusted issuer that has already checked that person, confirmed through a zero-knowledge proof.

The methods on the market differ more than their names suggest. Some only show that a device is genuine. Some show that a live person is present, but not that the same person has not opened fifty other accounts. This guide compares eight approaches and sets out the no-biometrics path in steps.

Key takeaways

• Bots made up more than 53% of web traffic in 2025, and 40% of all traffic was classified as malicious, according to the 2026 Bad Bot Report from Thales (Imperva).
• Liveness asks whether a real person is present now. Uniqueness asks whether this person already has an account. Most bot defences answer only the first question, or neither.
• CAPTCHA, device attestation and phone checks tie an account to a session, device or number, not to a person.
• Iris or palm networks and document-and-selfie KYC give strong uniqueness, but they require biometric capture, which is special category data under GDPR Article 9 when used to identify someone.
• A reusable uniqueness credential lets a platform inherit an issuer's existing check and receive only a yes or no.

Why proof of personhood is a growth question

For most platforms, the cost of bots shows up first in the acquisition budget. Sign-up bonuses, referral rewards, affiliate payouts and trial offers assume each account is a separate person. When one operator controls hundreds of accounts, the budget reaches the operator instead of new customers.

The Thales report, published on 29 April 2026 using full-year 2025 data, found that AI-driven bot attacks grew 12.5 times year on year, and that financial services accounted for 46% of account takeover incidents. It also described AI agents as a third category of traffic alongside good and bad bots, so blocking all automation is no longer a complete strategy. We covered how authentication is adapting to agent traffic in Proof of Human: Bot Detection at the Login Layer.

The underlying problem is old. In 2002, Microsoft Research's John Douceur named it the Sybil attack: one entity presenting many identities. His paper concluded that without a logically centralised authority certifying identities, such attacks remain possible in practice. Each approach below is a different answer to who that certifying party should be.

Uniqueness vs liveness: two different questions

Liveness confirms that a real human is present at the moment of a check, rather than a photo, a replayed video or a deepfake injected into the camera feed. Our guide to synthetic identity and injection attacks covers how liveness checks are attacked and defended.

Uniqueness confirms that this person does not already hold another account in the same system. The US National Institute of Standards and Technology describes this step as identity resolution: determining that a claimed identity corresponds to "a single, unique individual" within the population a service serves (NIST SP 800-63A-4).

A platform fighting multi-accounting needs uniqueness. Liveness alone still lets one real person open account after account.

Best proof-of-personhood solutions compared

The table is our assessment of the eight main approaches. Ratings are relative and reflect typical implementations, not any single product.

Device attestation is useful and privacy-preserving: Apple's Private Access Tokens build on the IETF Privacy Pass standard, so a website learns that a genuine device passed a check without learning who the user is. But Apple presents App Attest as one input to an overall fraud assessment, and Google's Play Integrity documentation says the API should not be a sole anti-abuse mechanism. One person can own several devices, and a device farm can own many. Phone checks have a similar ceiling: a number proves control of a number, and numbers are reassigned and can be bought in bulk.

Alternatives to iris-scan proof of personhood

The main alternatives to iris-scan proof of personhood are government eID, document-and-selfie KYC, social-graph attestation, and reusable uniqueness credentials issued by organisations that have already checked the person.

Iris-scan personhood networks deduplicate people by comparing biometric templates, which gives strong uniqueness. The trade-offs are enrolment hardware users must visit, and the obligations attached to special category data. We looked at that liability in biometric data retention in 2026.

• Government eID offers strong uniqueness within one country, but coverage and cross-border acceptance vary by scheme.
• Document and selfie KYC is familiar to regulators, but repeats a biometric check at each platform and leaves document copies with the business.
• Social graph approaches avoid biometrics but depend on honest vouchers and can expose who knows whom.
• Reusable uniqueness credentials reuse a check that a bank, fintech or licensed KYC provider has already completed, so the verifying platform collects no biometrics of its own.

Biometrics are also not a prerequisite for strong proofing. NIST's latest identity guidelines state that verification at Identity Assurance Level 2 "can be accomplished with or without the use of biometrics" and define a dedicated non-biometric pathway.

How can a platform prove users are unique real humans without collecting biometrics?

A platform can confirm unique real humans without collecting biometrics by accepting a credential from an issuer that already ran a strong check, and verifying it with a zero-knowledge proof that also detects duplicate accounts. The platform receives a yes or no answer, not the person's documents or face data.

The flow works in six steps:

1. An issuer runs a check it already needs. A bank, fintech or licensed KYC provider completes onboarding under its own obligations.
2. The issuer issues a credential. It signs a statement such as "passed KYC" or "unique person" and gives it to the user, following models like the W3C Verifiable Credentials Data Model 2.0, a W3C Recommendation since 15 May 2025.
3. The user holds the credential and presents it to other services only with their consent.
4. The platform requests a proof. At sign-up or before a reward is released, the platform asks only for the fact it needs, for example "is a unique person who has passed KYC".
5. The user generates a zero-knowledge proof that the credential is valid and meets the requirement, without revealing name, document number or any biometric template.
6. The platform checks for duplicates and gets its answer. A platform-specific value derived inside the proof (explained below) shows whether this person has already registered.

The result is only as strong as the original check, so issuer quality matters, and each verifier remains responsible for deciding whether a credential meets its own regulatory requirements.

How one account per person works without a shared ID

The duplicate check in step 6 usually relies on a technique known as a nullifier, used in open zero-knowledge protocols such as Semaphore.

The user's credential contains a secret only the user's wallet can use. When proving to a platform, the wallet combines that secret with a public value naming the platform or campaign (the scope) and outputs a deterministic value, and the proof shows it was computed correctly.

Two properties follow.

• Same person, same platform, same value. If one person tries to register twice, the second proof produces an identical value, and the platform rejects it.
• Same person, different platforms, unlinkable values. Because the scope differs, two platforms see different values and cannot match their user lists against each other.

The platform gets one account per person without a global identifier that could track people across services.

Where AIR Identity fits

AIR Identity, built by Moca Network, applies this credential model with two sides. Trusted issuers, including banks, fintechs, platforms and KYC-licensed partners, issue reusable credentials from checks they have already run, such as KYC status, residency, account tenure or unique person. Issuers earn a network fee each time a partner verifies one of their credentials. Verifiers request proof of just the fact they need, receive a yes or no answer through zero-knowledge proofs with the user's consent, and pay only on receipt of verification.

The commercial point is acquisition. A rewards app or game can require a unique-person proof before a sign-up bonus or referral payout is released, so budget goes to people who qualify rather than to farmed accounts. Through verifier acquisition networks, platforms can also reach users who already hold the credentials a campaign requires. The platform receives an answer rather than a document or face scan, so it operates with minimal data custody, and the design is built to support GDPR, CCPA and India's DPDP Act.

Issuer coverage is growing: zkMe, for example, issues credentials on Moca Chain. Where no issuer covers a user yet, existing checks remain the fallback. Integration details are on the AIR developer page.

Frequently asked questions

What is the best proof-of-personhood solution?

There is no single best method; it depends on whether a platform needs session-level bot filtering or one-person-one-account uniqueness. For uniqueness without collecting biometrics, reusable credentials issued from existing KYC and checked by zero-knowledge proof offer strong Sybil resistance with low friction, with device attestation and CAPTCHA as low-cost filters in front.

What are the alternatives to iris-scan proof of personhood?

The main alternatives are government eID, document-and-selfie KYC, social-graph or web-of-trust attestation, and reusable uniqueness credentials from trusted issuers such as banks and licensed KYC providers. Of these, reusable credentials and social-graph methods avoid biometric collection by the platform entirely.

Can you prove someone is a unique human without biometrics?

Yes. A platform can accept a credential from an issuer that already checked the person and verify it with a zero-knowledge proof carrying a platform-scoped nullifier. The nullifier reveals duplicate registrations on that platform, while the proof reveals no personal data. NIST SP 800-63A-4 also defines a non-biometric pathway for identity verification at IAL2.

What is the difference between liveness and uniqueness?

Liveness confirms a real person is present during a check rather than a photo, replay or deepfake. Uniqueness confirms the person does not already hold another account in the same system, which is what stops multi-accounting and reward abuse.

Does device attestation prove a user is human?

No. Apple App Attest, Private Access Tokens and Google Play Integrity show that a request comes from a genuine device or unmodified app, which filters out many scripts and emulators. They do not show that each account is a different person.

See how AIR Identity confirms a unique person with a single proof, or partner with us to grow your business.

Sources

• Thales: AI-driven bot attacks surged 12.5x, 2026 Bad Bot Report (29 April 2026)
• NIST SP 800-63A-4: Digital Identity Guidelines, Identity Proofing and Enrollment
• Microsoft Research: The Sybil Attack (Douceur, 2002)
• Regulation (EU) 2016/679 (GDPR), Article 9
• IETF RFC 9577: The Privacy Pass HTTP Authentication Scheme
• Apple WWDC21: Mitigate fraud with App Attest and DeviceCheck
• Apple WWDC22: Replace CAPTCHAs with Private Access Tokens
• Android Developers: Play Integrity API overview
• W3C Verifiable Credentials Data Model 2.0
• Semaphore documentation