zkPass.org: a technical deep dive

zkPass allows to unlock web2 data for web3 appli­ca­tions, with pri­va­cy. Scroll down to get the full tech­ni­cal deep dive.

What is zkPass?

zkPass is a pro­to­col that uses Zero-Knowl­edge proofs to let you prove facts about your pri­vate Web2 data (from any HTTPS web­site) to Web3 appli­ca­tions. You can ver­i­fy your iden­ti­ty, rep­u­ta­tion, or oth­er attrib­ut­es with­out reveal­ing the actu­al data, keep­ing your pri­va­cy intact. It acts as a pri­va­cy-pre­serv­ing bridge between the walled gar­dens of Web2 and the open world of Web3.

How It Works: The 3‑Party TLS Protocol

1. Prover (You)

The ‘Trans­Gate‘ brows­er exten­sion, act­ing on your behalf to ini­ti­ate the data request.

2. Verifier (Notary)

A zkPass node that par­tic­i­pates in the TLS ses­sion to attest to the valid­i­ty of the data.

3. Server (Website)

The Web2 data source (e.g., your bank, social media) that requires no modification.

The Prover and Ver­i­fi­er col­lab­o­rate to gen­er­ate a VOLEi­tH zk-Proof of the ses­sion, which can be ver­i­fied by a smart con­tract or oth­er party.

Two Modes of Operation

Proxy Mode

The Ver­i­fi­er acts as a proxy between you and the serv­er. It’s fast and efficient.

Pro: Effi­cient Con: Cen­sorable

MPC Mode

You and the Ver­i­fi­er use Mul­ti-Par­ty Com­pu­ta­tion (MPC) to joint­ly access the serv­er. It’s slow­er but can­not be blocked.

Pro: Cen­sor­ship-Resis­tant Con: High Overhead

zkPass uses a Hybrid Mod­el: it defaults to fast Proxy Mode and auto­mat­i­cal­ly switch­es to MPC Mode if cen­sor­ship is detected.

Key Use Cases

Private KYC for DeFi

Vampire Attacks

Data Markets

Gaming Achievements

Limitations & Trust Issues

  • Cen­tral­iza­tion: The Ver­i­fi­er node is oper­at­ed sole­ly by zkPass. You must trust them not to cen­sor you or col­lude with the prover.
  • Pri­va­cy: The ‘Trans­Gate‘ brows­er exten­sion is closed-source. You must trust it not to log or mis­use your pri­vate ses­sion data.
  • Trust Assump­tion: The ZK-Proof only proves that the Ver­i­fi­er cor­rect­ly checked the data, not that the data itself is true. Pub­lic ver­i­fiers must trust the Ver­i­fier’s integrity.

Get the full PDF report deliv­ered to your inbox:



You can view our pri­va­cy pol­i­cy here