How the technology behind Sam Altman’s iris scan ID startup Worldcoin works

More than 6 million people worldwide use the technology. Companies including Reddit, Discord and Okta are already working with Worldcoin to help users connect to their platforms securely. However, it has also attracted the attention of authorities in countries such as Germany, France and Kenya, who are concerned about how the company uses the data it collects.

Worldcoin sees its technology — a private, encrypted network that preserves human identity — as critical, especially as rapid advances in AI technology have made it harder to tell the difference between humans and robots.

As part of that mission, the platform announced new “Face Auth” technology on Thursday. It is a 1:1 face comparison which ensures that only the person who has verified their World ID can use it. The technology is similar to Apple’s Face ID, but independent of the mobile platform, given that many Worldcoin users have Android devices.

Damien Kieran, director of privacy at Tools for Humanity, the company responsible for developing the technology behind Worldcoin, oversees it.

The tech industry veteran was previously general counsel at once-featured photo startup BeReal and former deputy general counsel at Twitter, where he reported directly to Elon Musk.

Kieran told Business Insider about how the company handles user data and how it will play a role in the future.

Why are irises a good way to identify people?

They are very stable over time and, based on modern technology, are “counterfeit-proof”. So I can take a picture of your face and through some complicated AI I could fool Face ID, for example. An iris is more resistant to forgery.

Note: A spokesperson for Tools for Humanity also directed BI to a blog post on the irises. Irises are noted to have higher entropy—a degree of randomness or complexity—than fingerprints or faces. Because the irises are protected from the eye, they are also less sensitive to change.

How does Worldcoin translate the complexity of an iris into a unique digital code?

We take a picture of your face and we take a picture of your eyes with the globe.

Orb does some checks, depending on those checks, to see if you’re human and if you’re alive, and then looks at the photo of the eye. What it does on the photo of the eye is create an iris code. It’s not like a dystopian scan – it’s a very advanced camera.

This is where the technical parts come in. An iris code is not something we’ve invented scientifically, but it’s basically a binary of ones and zeroes: 1, 1, 0, 0, 0, 1, 1, 0, 0. So it’s an abstraction, a numerical abstraction of the surface of the eye yours, and everyone’s eye is different.

The goal is a worldwide person ID. So basically we take the ones and zeros that represent someone’s eye and check the backend. If it’s not the first time we’ve seen them, we say “No”, you can’t continue because you already have an account.

If it is the first time, the globe takes the iris code and cryptographically processes the iris code. We take the ones and zeroes and run them through cryptography that tears them into two separate codes that look nothing like ones and zeroes. So it could literally be 5, 6, 7, 8, and the other could be 1, 2, 3, 4. Individually, none of these new codes are anything like the iris code, nor can they be traced back to the iris. code on your own.

Where are these codes stored?

We take those two pieces of code and store them in two different data stores. They are owned by two legally distinct companies and we will be adding a third in the coming months. Our hope is to add many more in the coming months. So we’re going to split the iris codes into 20, 30, 40, 50 pieces – as many as we can do.

It is our goal that Tools for Humanity does not operate any of those databases.

What does this mean for users?

What we do globally is package the photos, a copy of the iris code, and a secure key – a private key, everything is encrypted – and we send it back to the user’s device and it stays on their device.

This is practical for doing a few different things. First, they should have a copy of their data. It’s their data; it is not ours and we do not want it. Second, the private key is how it actually communicates with systems and other systems and services. That private key is their unique code for everything.

Is there any way to access someone else’s code?

To get an iris code, you have to recombine all those pieces. You need to know how to put them back together, and then the important part is that you should have a photo of the original iris to be able to identify the person’s code.

But we never get the photos. We never get a photo of your face. We never get a photo of your eyes. We provide them to the user. The only person who can access this information is the owner of the world ID – the user. If the user were to delete their own key from the phone, which you can back up to Google Cloud or Apple iCloud, I wouldn’t even be able to access the pieces of code in the databases. So at that point, it’s completely anonymized.

How can I redeem my code right now?

I’ll use Twitter as an example because it’s near and dear to my heart. When you sign in to Twitter, you can use your username or password, but you can also use your Google email. Twitter or any other service could also enable authentication with World ID.

So if I want to sign in to my Twitter account and I want to associate my World ID with my Twitter account, I would hit the sign in button. Twitter would send a request to my device that I’m trying to sign in to my World ID.

My device was taking my private key, terminating it with the request from Twitter; they would encrypt it, then they would get a piece of information from a public source, a public blockchain, which is the public key.

Then it would take that information and make another request to our databases, this information destroyed, and the request it makes is, “Is this a unique human?” The answer is yes. It sends a yes back to my device, my device packages it and sends it to Twitter.

What is the purpose of this technology?

Maybe the way to think about what we do is the protocol, which is the term you’ll see in the papers, is basically like a standard. If you have an iPhone, it has a USB-C charger. A bunch of tech companies get together and agree on the standard so it’s interoperable. We want the protocol to be the standard.

Why is this so critical in an AI era?

For World ID, privacy is the product. This extends to the entire project – from vision to principles and more. We are committed to improving people’s privacy in the age of AI by leveraging cutting-edge cryptographic technology and developing new technology like Face Auth to advance this mission. As AI continues to advance and open up incredible new opportunities and challenges, we hope to set a new standard for security, transparency, and give people full control and choice over their data.

How could this technology be used to distribute universal basic income?

Our goal is to build the largest network of trust. When you have a very large network of trust for online digital transactions – and again, I have to emphasize when I think about digital transactions – it’s not just about money; it’s all things—you’ll be able to do other things with that big network.

One of those things could eventually be UBI. Right now, the way it looks, I think it’s too early to tell.

Even Alex, our CEO, and Sam Altman have said different things over the years. It evolves as we learn more about what it might look like. I think building an infrastructure layer to enable that is at least one of the things we think is possible.