World (Tools for Humanity) scans irises with its Orb to mint a World ID that proves a person is both human and unique, scaling US retail placements toward thousands of devices in 2026, while Humanity Protocol pitches palm-vein biometrics as a lower-friction alternative. Custom hardware delivers strong uniqueness guarantees, but it forces mass enrollment on a proprietary device and has drawn privacy bans in several jurisdictions — universality is exactly where it struggles.

Persona raised $200M explicitly to verify the identity — person or bot — behind every interaction, and Okta is building agent identity and cross-app access so an AI agent carries an auditable, permissioned identity tied to a human principal. This reframes the problem from 'block bots' to 'attribute every actor,' but it depends on the ecosystem adopting shared agent-identity standards that do not yet exist.

Civic issues reusable verifiable credentials that let a user prove they passed a humanness or identity check once and present it across services. Reuse cuts repeated friction and centralization, but the credential is only as trustworthy as the original issuance — and a compromised or coerced enrollment propagates everywhere the credential is accepted.

Privado ID (formerly Polygon ID) and Dock let a holder prove a credential's claim — age, accreditation, KYC status — with a zero-knowledge proof that discloses nothing else, and World ID uses ZK to prove uniqueness without linking actions to a person. The math is sound, but revocation, credential freshness, and getting relying parties and regulators to accept a cryptographic proof in place of a document remain the adoption bottleneck.

The EU Digital Identity Wallet and vendors like Yoti are built around selective disclosure — sharing only the requested attribute from a government-anchored credential. It has the strongest legal backing of any approach, but wallet interoperability across 27 states and the private sector is still being wired, and 'reveal only what's needed' is only as private as the weakest integration a relying party ships.

Spruce ID builds standards-based decentralized identity and credential tooling so individuals hold and present their own attributes without a central issuer intermediating each check. Self-custody removes the honeypot, but it pushes key management and recovery onto users — and an approach nobody can recover from is one most consumers won't adopt.

iProov projects a randomized sequence of colors onto a user's face and analyzes the reflected light to confirm a real, present human in real time, defending against replays and injected video. Controlled illumination is hard to spoof, but it adds a deliberate user step and, like every liveness scheme, is a moving target as attackers reverse-engineer the challenge.

Incode, Veriff, Sumsub, and Au10tix pair passive liveness with models that hunt for the artifacts of synthetic media, document tampering, and injection attacks across the whole session rather than a single frame. Fighting generative fraud with detection models scales, but it is fundamentally reactive — defenses lag the newest generative techniques by exactly the time it takes to see them in the wild.

Incognia and Fingerprint anchor trust in device integrity, location behavior, and hardware signals so that a spoofed face still fails against an anomalous device or environment. Layering non-biometric context raises the attacker's cost, but it weakens for privacy-hardened or new devices and can penalize legitimate users who look anomalous.

Trulioo and Sumsub abstract away the patchwork by integrating hundreds of national data sources and document types behind one API, so a business can verify a customer in most countries through a single vendor. It solves reach for the relying party, but it re-centralizes trust in the aggregator rather than establishing genuine mutual recognition between schemes.

The EU Digital Identity Wallet, with vendors like IDnow building compliant integrations, aims for a common credential format and certified trust list so any accepted wallet works across all member states. Standardization is the most durable path, but it is bounded by the political perimeter of the scheme — bridging it to non-EU identity systems is still unsolved.

Dock and the broader verifiable-credentials ecosystem let any issuer mint a credential any verifier can check against open standards, decoupling portability from a specific jurisdiction. The model is inherently cross-border, but it only delivers trust once verifiers agree on which issuers to accept — reintroducing the governance problem it was meant to escape.

World's iris-based World ID and Humanity Protocol's palm biometrics both guarantee one-human-one-credential by binding the identity to a physical trait that can't be duplicated at scale. Biometrics deliver the hardest uniqueness guarantee, but they require trusting the enrollment operator and hardware, and mandatory biometric capture is precisely the participation barrier that limits reach.

Reputation-graph approaches — in the mold of Gitcoin Passport and Civic's stacked credentials — combine many weak signals (social accounts, prior verifications, on-chain history) so that faking a convincing unique identity becomes expensive rather than impossible. It preserves openness and privacy, but it is probabilistic: a well-resourced or AI-equipped attacker can still farm identities that clear the threshold.

National ID and EUDI-wallet credentials inherit the state's one-person-one-record guarantee and can be presented with selective disclosure to prove uniqueness in a context. The uniqueness is strong and legally backed, but it ties Sybil resistance to state issuance — excluding the undocumented and importing every limitation of the underlying registry.

Socure and Alloy pool cross-institution signals into machine-learning and graph models that flag identities whose relationships and histories don't cohere the way real people's do. The network effect is the strongest defense — more data reveals more anomalies — but it re-prices with every generative advance, and coverage gaps leave newer or thin-file synthetic identities hardest to catch.

Prove anchors trust in the cryptographic and possession signals of a real phone number and carrier records, and SentiLink specializes in scoring the specific hallmarks of synthetic and manipulated identities. Tying an identity to a hard-to-fabricate authoritative signal raises the bar, but determined fraudsters increasingly acquire aged phone numbers and seasoned data to defeat exactly these checks.

Sardine watches behavior across onboarding and transactions in real time, so a synthetic identity that passed KYC still trips risk models when it acts like a fraud ring rather than a person. Behavior catches what static checks miss, but it detects the fraud closer to the loss event — and bust-out schemes are engineered to behave normally until the moment they don't.

The FIDO passkey model — adopted across Auth0, Descope, Clerk, and the platform vendors — syncs credentials through a cloud keychain so losing one device doesn't lock the user out. Sync solves everyday recovery elegantly, but it shifts the trust boundary to the platform account securing the keychain, which becomes the new thing an attacker phishes.

Beyond Identity and HYPR bind credentials to device hardware and pair them with attested, policy-driven recovery workflows so an enterprise can re-enroll a user without a phishable reset. Hardware binding plus controlled recovery is strong for managed workforces, but the model leans on enterprise administration that doesn't translate cleanly to consumer or self-sovereign contexts.

Self-sovereign approaches from the Spruce ID and decentralized-identity ecosystem explore social recovery — distributing recovery authority across trusted guardians or shards — so no single key loss is fatal and no central party holds a backdoor. It preserves self-custody, but it asks ordinary users to manage guardians and shards correctly, and a poorly chosen guardian set becomes its own attack surface.