What is a zero-knowledge proof? How it works, and where you'll meet one in 2026

The Morse teamPublished November 6, 202610 min read

A zero-knowledge proof is a way to convince someone that a statement is true, such as "I'm over 18," without showing them anything else, including the evidence that makes it true. As of November 2026, most people meet one in an age check: Google Wallet can answer a website's "are you over 18?" with a zero-knowledge proof, and the European Union's age verification app is built around one, though the EU app is still in pilots.

We read the ZKProof Community Reference, NIST's zero-knowledge page, Google's Wallet announcements, developer documentation, and open-source code, the European Commission's age verification blueprint and its zero-knowledge annex, the EU digital identity regulation, Apple's Wallet ID pages, OpenAI's and Anthropic's age check pages, and critiques from the Electronic Frontier Foundation and Brave Research, all on November 6, 2026. Most of the top results for this question come from crypto companies and describe blockchains, and few say what separates an age check that uses a real zero-knowledge proof from one that only shares a single field.

How does a zero-knowledge proof work?

The prover answers challenges that only someone holding the secret could pass every time, and the verifier checks the answers without ever seeing the secret. A cheater might get lucky once, but the odds of fooling the verifier shrink with each round, which is why MIT describes these proofs as establishing a fact "via a statistical argument" (MIT News, March 13, 2013). The idea comes from Goldwasser, Micali, and Rackoff's 1985 paper, "The Knowledge Complexity of Interactive Proof Systems," and Goldwasser and Micali won the Turing Award for work including it.

The ZKProof Community Reference, a standards effort NIST worked with from 2019 to 2024 (NIST), names the three properties every such proof needs (ZKProof, version 0.3, July 2022):

• Completeness. If the statement is true and both sides follow the protocol, "the verifier is convinced of this fact."
• Soundness. "Not even a malicious prover can convince the verifier of a false statement."
• Zero knowledge. "Even a malicious verifier cannot extract from the proof process any information beyond the truthfulness of the given statement."

The 1985 version was a conversation. The proofs in phones today are a single message the prover computes alone, and the EU's age app produces "a succinct proof" that "can be verified by any third party using the public inputs" (European Commission). NIST hasn't standardized zero-knowledge proofs, though its threshold cryptography call has a category for them.

How does a zero-knowledge proof verify your age?

It proves you hold an ID that a real issuer signed and that says you're over the age asked, without sending the ID. The Commission's annex spells out the statement the phone proves. The secret input is your proof-of-age credential. The public inputs are the issuer's public key, the attribute being checked (over 18, say), and a random challenge from the website. The proof shows four things at once: the issuer's signature on the credential is valid, the attribute is set to true, the app can sign the website's challenge with the key bound into the credential, and the credential hasn't expired (European Commission).

The website learns yes, and nothing else. Issuers change nothing, since the annex says the issuing authority "remains unaware of the use of this scheme," so existing ID credentials work as they are. The math behind it comes from Google's Matteo Frigo and abhi shelat, whose paper, peer-reviewed and published in May 2026, reports that its proofs rely only on SHA-256 as their security assumption (IACR).

Isn't sharing only "over 18" private already?

Only partly, because a field shared on its own can still be linked to you. Mobile IDs built on ISO 18013-5 can already share one field and hide the rest, which is called selective disclosure. Apple's Verify with Wallet lets an app ask for an "Age Over N" flag and tells developers an age threshold "is the most privacy preserving approach," and Apple says "neither the issuing authority nor Apple can see when and where a user shares their license or ID" (Apple). Neither of the two Apple pages we read mentions zero-knowledge proofs.

A selectively disclosed field still arrives inside a signed credential, and if the same credential is shown twice, sites that compare notes can link the two visits. The EU's specification handles this two ways. A plain credential is single-use: the app gets a batch, 30 is the recommended size, and "SHALL use a Proof of Age attestation only once." A credential shown as a zero-knowledge proof "is not consumed and MAY be reused within its validity period," because "the proof does not permit linkage across presentations" (European Commission). Google's developer page makes the same promise for Wallet: a ZKP "ensures that presentations are not identifiable or trackable by the issuer, the relying party, or Google" (Google).

EU law asks for this property without requiring the method. The 2024 digital identity regulation says Member States "should integrate different privacy-preserving technologies, such as zero knowledge proof" into their wallets, and Article 5a requires wallets to "enable privacy preserving techniques which ensure unlikeability," a typo for unlinkability that is in the official text (EUR-Lex). Spain's data protection authority wrote in June 2025 that "the lack of a comprehensive approach to unlinkability" in the wallet's architecture framework "is concerning" (AEPD). This isn't legal advice.

Where will you meet a zero-knowledge proof in 2026?

Mostly in Google Wallet and in the EU's pilots. Here's every age check and digital ID we checked on November 6, 2026, with what its own pages say:

Google open-sourced its proof code as longfellow-zk in July 2025, under the Apache 2.0 license, and tied the release to the EU's wallets and its partnership with Sparkasse on EU age checks (Google, July 3, 2025). The EU app uses the same scheme. Our survey of what 9 AI apps collect for age verification covers the selfie and ID checks in the ChatGPT and Claude rows in depth.

What can't a zero-knowledge proof protect?

Everything outside the statement it proves. Four gaps come up in the critics' posts and in the Commission's own annex:

• The code can be wrong when the math is right. Trail of Bits, in August 2025, and the Internet Security Research Group, in October 2025, reviewed Google's scheme and found "under-constrained witness variables affecting soundness" in the mobile ID circuit, now fixed, the Commission's July 2026 update says. It adds that the scheme's standardization expectation "is accordingly not yet met" (European Commission). Google's README says its formal proofs "do not constitute source-level verification of the Rust or C++ implementation" (Google on GitHub).
• The answer can say more than yes. Brave Research points out that "a proof that a user's age lies in the range 20–21 may inadvertently disclose that the user is indeed 21," and that the combination of issuer, age range, and location "can uniquely identify individuals" (Brave, November 5, 2025).
• The issuer may still see you. The Electronic Frontier Foundation warns that "the issuer of the tokens these AV schemes rely on could track every time that credential is used" (EFF, August 18, 2026).
• The fallback may be what you get. The same EFF post reported that the EU mini-wallet's ZKP features "aren't yet turned on except for the closed demo/prototype build." The Commission's annex now says phones on iOS 27 and Android 10 or later can make the proofs, and keeps plain mobile ID presentation "as a fallback for User devices that do not support it."

A zero-knowledge proof also proves a credential is on the phone, not who is holding it. The EU specification says the app "SHOULD incorporate further authentication factors as needed."

Can a zero-knowledge proof keep your AI chats private?

No, not the chat itself. A zero-knowledge proof convinces someone of a fact about data the prover holds. A model has to read your prompt to answer it, so whoever runs the model holds your prompt, and no proof changes that.

Research on AI turns the roles around. zkLLM, presented at ACM CCS 2024, lets the company running a model prove that an answer came from a particular 13-billion-parameter model, in under 15 minutes per proof, while keeping "the privacy of the model parameters" (arXiv). That protects the company's weights from you. The prover still sees your input.

So a ZKP can help an AI chat at the edges: proving your age to an AI app without an ID upload, or proving which model answered. Neither OpenAI's nor Anthropic's age check page names one as of November 6, 2026. To keep a prompt from the people running the server, the tools are different. One computes on encrypted data, as homomorphic encryption does. One splits the data across servers that mustn't collude, as secure multiparty computation does. The third runs the model inside a trusted execution environment that proves what software it's running before you send anything. That proof, attestation, isn't zero-knowledge. It's a report signed by the chip, meant to reveal exactly what's running, and verifying AI enclave attestation walks through checking one.

How Morse checks where your prompt goes before you send it

A zero-knowledge proof limits what a website learns about you. In an AI chat, the exposure is the prompt itself, the account it's filed under, and the copy kept afterward, and a proof about your age touches none of them. Morse deals with the prompt using the other kind of proof, an enclave's attestation checked in your browser, and with the account by sending your messages to model makers under its own.

• E2EE, for prompts no server operator should read. Your browser checks the enclave's cryptographic proof itself before anything leaves your device, comparing what's running against versions pinned in the app, so an OS image hash that differs from the pinned one fails the check. Then it encrypts the message so only that enclave can read it. Our servers relay ciphertext they can't read, and the reply is decrypted only in your browser. Each reply has a lock you can open to see every check that passed, and a full report you can download. The enclaves are run by third-party providers, not by Morse, and the guarantee rests on the enclave hardware and attestation working as designed. E2EE runs open-weight models like GLM, Kimi, and DeepSeek, without web search or image generation, and comes with Pro, at $19 a month.
• Anonymous, for GPT, Claude, and Gemini without an account of yours at OpenAI, Anthropic, or Google. Our proxy removes your account, email, and IP address and sends the message under Morse's own account, so the provider sees the message without knowing it's you. It may keep the message for a limited time to check for abuse, under its own policy, so keep your name and birth date out of what you type.
• Private, for open-weight models and Grok where nothing is kept. Morse has zero data retention agreements with its inference, search, and other providers, so they've agreed to keep nothing. Where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't.

In every mode, your chat history is stored only in your browser, encrypted, and our servers don't keep or log your messages. Your account holds your sign-in details, plan, balance, and a usage ledger with no chat content, and you sign in with a code emailed to you or with Google. Morse is for adults only, and you confirm you're 18 or older. We don't train AI on your chats, sell your data, or show ads (Morse privacy policy). Clearing your browser or deleting your account deletes your chats, and we can't recover them, so keep a copy of anything you need.

Send a first message from the Morse home page without an account, or start free with no card, and open the lock on your first E2EE reply once you're on Pro.