World Open-Sources ProveKit. The Hard Question Is Whether It Can Keep the Value

The same week the FBI opened an investigation into a dark-web service selling scans of more than 153 million American and Canadian driver's licenses, the crypto identity project World did something calculated: it open-sourced its identity software. The toolkit, called ProveKit, lets a phone turn a fact about a document into a proof — "this person is over 18," "this person holds a valid ID" — without ever sending the document or the personal details on it to a server.

The timing was not subtle, and it was not wrong. World's argument is that the identity-verification industry's entire business model just failed in public. Traditional verifiers collect your photo ID, store it, and then get breached — IDScan.net, the Louisiana firm at the center of the reported leak, is one of many companies that has accumulated exactly this liability. World's answer is to make collecting the document unnecessary in the first place. ProveKit generates the proof on the user's own device; the verifier learns the answer and never sees the license.

That is a real product wedge. But for an investor, World's move raises a sharper question than whether zero-knowledge identity is a good idea. It is. The question is whether open-sourcing that tool makes World — the company and the WLD token behind it — more valuable, or whether it gives away the one piece of its stack that could have been worth money.

World (formerly Worldcoin, built by Tools for Humanity, chaired by Sam Altman) has always had two different games running under one brand. One is "proof of human": its hardware Orbs scan faces to confirm a person is a real, unique human, and it has verified about 18 million of them across 160 countries. That is the asset analysts talk about, and it is genuinely hard to copy because it requires deploying expensive hardware. The other game is document identity — proving age, citizenship, or ID ownership — which has nothing to do with the Orb, and that is where ProveKit lives. The tool compiles identity checks written in the zero-knowledge language Noir, runs them on a phone in seconds, and targets post-quantum, audited security. It is useful in the way a standard library is useful.

And that is precisely the strategic problem, because the way to win a standards war is to give the library away. ProveKit is released under the permissive MIT license. Any developer — including one building a direct competitor to World — can take it, fork it, and integrate it without touching Orb hardware or paying World ID's fees. The established rival in this exact market, Persona, was valued at roughly $2 billion in 2025 and runs the "textbook centralised" model: it collects and holds copies of your documents. World's whole pitch to businesses is "you don't want that liability, and neither do your customers." Open-sourcing ProveKit makes that pitch credible and cheap to adopt.

World's monetization plan, stated in its own roadmaps, is not to charge users but to charge the applications and credential issuers that sit on top of its rails. The theory is that if ProveKit becomes the standard for privacy-first identity, all that verifying flows back through World ID, and World captures a recurring fee from the volume. That is the same playbook as open-sourcing a programming language to build the network that pays for itself.

The gap in the theory is the one an investor should watch. Nothing in ProveKit requires the user to be a World ID holder, and nothing requires the verifier to pay World anything. The tool is separable from both the hardware moat and the fee-collecting rails that are supposed to make World money. It is entirely possible that ProveKit's open-sourcing turns World into the benevolent author of a well-used open-source project while the revenue from verification flows to whoever owns the customer relationship — which may be a Persona-style incumbent or a new entrant, but not obviously World.

So the honest reading is a boundary rather than a verdict. ProveKit is the strongest version of World's case that identity is becoming a "prove, don't collect" business, and dropping it as open source the week a 153-million-record breach broke is a credible bid to be the default standard. But adopting a standard and capturing its economics are different games, and the MIT license plus the absence of any Orb requirement mean the volume ProveKit creates may never be routed through the toll that would make it World's value. What would change that reading is evidence that doesn't exist yet: verifiers paying World because ProveKit adoption pushed them onto World ID, or proof volume that flows back into a fee. Until that appears, think of the release as a smart bet on becoming infrastructure — not as proof that World owns the economics of the standard it is trying to create.