hackpass

Demo

About

HackPass proves that a real, unique human attended a hackathon event — without relying on shareable QR codes or self-reported names that anyone can duplicate. Participants verify with World ID's Selfie Check, a live facial liveness scan completed through World App. This produces a cryptographic proof containing a unique identifier tied to that person and that specific event, without ever revealing who they are — no name, no email, no photo is stored by HackPass. If the same verified human tries to check in twice, HackPass recognizes it immediately and blocks the duplicate, since the protection is tied to their real, verified identity rather than something they type in. This stops the common hackathon problem of the same person claiming swag, prizes, or workshop credit multiple times through shared links or fake sign-ups — while keeping every participant's actual identity completely private.

How it's made

HackPass is built with a plain Node.js/Express backend and a vanilla HTML/JS frontend — no framework overhead. The core integration uses World ID's IDKit v4 SDK (@worldcoin/idkit-core) with the selfieCheckLegacy preset, requesting a real-time facial liveness scan through World App rather than a mocked or simulated flow. The backend signs each verification request server-side with an RP signing key, then independently verifies the returned proof against World's v4 verify endpoint before creating a check-in record — ensuring the proof can't be forged or replayed client-side. Each event's attendance is keyed by the proof's nullifier, giving deterministic, privacy-preserving duplicate detection with zero personal data stored. Getting the real Selfie Check flow working involved genuinely deep debugging — tracing SDK-level request/response cycles, fixing an internal double-fetch bug that was silently sending duplicate signed requests, and correcting the verification API integration to match World's actual response shape once the proof succeeded.