Verified.
By anyone.
Building in public · not on Bitcoin mainnet yet
Every vote, draw or study gets a receipt. Anyone can check it. No one can fake it. Not even us.
- PrivateYour choice stays secret
- VerifiableYour receipt proves it counted
- PermanentAnchored on Bitcoin
Why should you believe that? Not because we say so. Because of four pieces of math you can try right here.
1 · The fingerprint
Change one letter, and everything changes.
A hash turns any text into a fixed 64-character fingerprint. The same text always gives the same fingerprint. A different text gives a completely different one. And there is no way back from the fingerprint to the text.
Why it can't be faked. To make a different text with the same fingerprint, you would have to guess. Matching 4 characters takes about 65,000 tries. Matching all 64 takes about 1077. Every computer on Earth, running since the Big Bang, would not get close.
These 64 tiles are the fingerprint of what you typed above. Type one more letter and watch: it's not one tile that changes, it's about half of them, in a pattern nobody can predict.
It's a smoothie. Put a banana and three strawberries in a blender. You always get the same smoothie. Swap one strawberry for a grape, and it tastes totally different. But nobody can look at a smoothie and rebuild the fruit.
For mathematicians
SHA-256: H : {0,1}* → {0,1}²⁵⁶. Preimage resistance ≈ 2²⁵⁶ work, collision resistance ≈ 2¹²⁸ (birthday bound). We use it for the Merkle tree (RFC 6962, with 0x00 / 0x01 domain separation) and the Bitcoin anchor.
2 · The locked box
Lock your vote in a box nobody can open, and you can't swap.
Your vote goes in a mathematical box with a random key. The box is public. It reveals nothing, because every possible vote fits this exact box. Yet once it's locked, you can never claim it held something else.
Toy version, small enough to check by hand (clock with 11 hours)
Why it can't be faked. Both votes fit the box, so looking at it tells you nothing. Ever. But the key that makes "No" fit is hidden behind a problem called the discrete logarithm. On the toy clock you find it in a blink. On the real one, with 2252 hours, even the best known shortcut needs about 2126 steps: at a trillion steps per second, roughly 200 million times the age of the universe.
The box is a spot on a clock. Your vote moves you some steps of one size, your key moves you steps of another size. Watch both paths: the green one (Yes) and the grey one (No) land on the very same spot. That's why the box hides your vote.
It's a magic marble jar. You drop a red or a blue marble in, then shake in a secret handful of sand. The jar always ends up looking the same muddy color, so nobody can tell. But only you remember how much sand you used, and only that amount makes the color match the marble you really dropped.
For mathematicians
Pedersen commitment on ristretto255: C = v·G + r·H, with H derived by hashing so logGH is unknown. Perfectly hiding (C is uniform for any v), computationally binding (two openings yield logGH). Toy above: p = 23, g = 4, h = 8, order 11, exactly the example in Fabio Akita's article.
3 · Proving without showing
Prove you know the secret, without saying it.
Each sealed vote comes with a proof: "this box holds a valid vote, 0 or 1." The proof convinces anyone and reveals nothing about which one. It works like a cave with a locked door.
The cave test. The door in the back opens only with the secret.
Why it can't be faked. A faker survives each round only by luck: half the time. Twenty rounds in a row: one in a million. Our proofs use one round with a challenge drawn from 2252 options, so faking is less likely than winning the lottery eight times in a row. And the transcript carries no secret: anyone could forge one if they got to pick the challenge first. Only the order makes it convincing.
You wait at the entrance. The prover walks in, left or right, out of sight. Then you shout a side. With the secret, they open the door and come out where you asked, every time. Without it, they're stuck on the side they chose. You never see the secret, but after enough rounds you're certain they have it.
Now the real thing, in numbers (Schnorr proof)
It's Where's Waldo. You found Waldo and want to prove it without spoiling the page. Take a huge sheet of cardboard with one tiny hole, and place it so only Waldo shows through. Your friend sees Waldo, so you clearly know where he is. But the cardboard covers the rest, so your friend still has no idea where on the page he was.
For mathematicians
Each ciphertext (A, B) = (r·G, v·G + r·K) carries a Cramer–Damgård–Schoenmakers OR-proof that v ∈ {0, 1}, made non-interactive with Fiat–Shamir (SHA-512 → scalar). A Chaum–Pedersen proof shows the ballot sums to exactly 1. Zero-knowledge follows from the simulator shown above: transcripts are producible without the witness.
4 · The stamp
One fingerprint for the whole list, carved into Bitcoin.
The fingerprints of all receipts are paired and hashed, again and again, until one fingerprint is left: the root. It goes into a Bitcoin block. Your receipt plus a handful of fingerprints rebuilds that root. If any receipt changed, the root would too.
Eight votes. Tap one to tamper with it.
Why it can't be faked. To swap a receipt, you'd need a new list with the same root: the impossible fingerprint match from chapter 1. And the root sits in a Bitcoin block, behind every block mined since. Rewriting it means out-computing the whole Bitcoin network.
Your receipt (dark) climbs to the root using only the highlighted neighbors: 3 for 8 votes, 28 for 150 million. The root then becomes the newest block in a chain that thousands of computers keep identical copies of.
It's a sticker album. Everyone puts a sticker in one album. Then a photo of the album is copied into a million notebooks around the world. If someone sneaks back and swaps one sticker, the album no longer matches the photo in a million notebooks.
All four, together
Run the real thing.
A real 8-person vote with full-size cryptography: fingerprints, locked boxes, zero-knowledge proofs, blind passes and the stamp. Your browser checks every piece, with no server involved.
New use · local AI models
Feedback receipts.
When a model runs on someone's own machine, the lab sees nothing. Local agents could send incident reports that are provably technical and provably received. Read the idea in Why frontier models need a ~30B MoE sibling.
- Stays homePrompts, code and logs never leave; only a salted hash does
- CheckableA closed schema with no free text, so anyone can validate every report
- ReceivedEach reporter keeps a receipt anchored on Bitcoin; nothing gets silently dropped
Status
Where it stands.
- WorkingEngine, signed receipts, Merkle batches and the in-browser verifier, in staging with tests
- In progressPublic verify API, open-sourcing the verifier and core, feedback schema
- Not yetBitcoin mainnet anchoring. It will be announced here.
Built for