What proof of personhood is actually trying to solve
Most blockchains have no idea who you are. Every address looks the same, and one person can spin up thousands of wallets in minutes. That is fine for some use cases and a disaster for others. Airdrops get farmed by bots. Quadratic funding gets drained by Sybil clusters, meaning groups of fake identities that coordinate to amplify one vote. Governance votes get captured by single whales. Even simple rate limits get gamed by anyone patient enough to script a signup farm.
Proof of personhood is the umbrella term for systems that try to answer one narrow question: is there a real, unique human behind this account, right now, alive and not a bot pretending to be ten humans? That is it. It is not identity verification. It does not confirm your legal name, your country, your age, or your credit history. Anyone who tells you a proof-of-personhood credential is a digital ID is selling you something.
The catch is that even that narrow question is hard. Anything you can prove online can be spoofed at scale. Phone numbers get burned through SIM farms. Government IDs get bought on darknet markets. CAPTCHAs get solved for fractions of a cent. So the field has split into two camps: hardware-rooted proofs that bind personhood to a body, and software-rooted proofs that bind personhood to a graph of trust. Worldcoin lives in the first camp. Civic, BrightID, and Gitcoin Passport live in the second.
Worldcoin's approach: the iris orb and what it really collects
Worldcoin, the project co-founded by Sam Altman, built a custom hardware device called the orb. You stand in front of it, it shines near-infrared light at your eyes, and it produces a short numeric code called an iris code. In theory, no two irises produce the same code, so the device can later confirm that a returning user is the same human, without storing the raw image. After verification you receive a World ID, and an allocation of WLD tokens.
The marketing message is that the iris code is the only thing stored, that it is encrypted, that you can delete your data, and that the system cannot re-identify you from the code alone. Tools for Humanity, the company behind Worldcoin, also rolled out a "Personal Custody" option where the iris code is stored on the user's own device rather than in a central database. That change came partly because early users had no choice but to trust a third party with their biometric template.
The uncomfortable part is what an iris code still is: a biometric. Even if the raw image is destroyed, a stable hash of a unique body part is forever. You can rotate a password. You can issue yourself a new private key. You cannot rotate your iris. If a future breach or a court order exposes that hash, the consequences do not expire when you change your credentials. That is the core reason regulators in multiple jurisdictions have already pushed back, and it is why the iris-scan design is not just a feature preference but a legal regime choice.
Why the iris scan is also the moat
The flip side of the risk is the upside that proponents point to. Hardware-bound proofs are dramatically harder to spoof than social-graph proofs. A bot cannot present a real iris in front of a physical device unless it has a working prosthetic and a way to visit every orb in the chain. That asymmetry is what makes Worldcoin attractive to airdrops and governance experiments that want to filter humans from Sybil farms, even if those projects would never touch the WLD token itself.
Where the regulatory friction has actually landed
Worldcoin has run into real legal trouble in places where the data-protection regime is strict and where biometric collection of minors was documented. Kenya suspended Worldcoin's operations in 2023 after complaints about how minors were scanned, and investigations followed in Germany, Argentina, and elsewhere. Spain's data-protection authority (AEPD) ordered Worldcoin to stop collecting data in the country and to delete existing records, citing concerns over the legal basis for processing sensitive biometric data of minors. Hong Kong and South Korea have also opened reviews.
None of these actions mean Worldcoin is illegal everywhere. They do mean the model travels poorly across borders. A proof-of-personhood system that depends on a single hardware vendor scanning real eyes will always run into laws written for medical, law-enforcement, and identity-document contexts. By contrast, Civic, BrightID, and Gitcoin Passport do not collect biometric data at all, which puts them in a different regulatory bucket in most places, though their own data-protection stories are not automatically clean either.
The practical takeaway is that Worldcoin's addressable market is gated by where the orb can legally operate. If the project cannot verify users in the European Union, parts of Africa, and parts of Asia, the network effect of "one verified human per planet" gets fragmented by jurisdiction. WLD holders are betting, in part, that those gates reopen. There is no way to underwrite that bet from a chart.
How Civic, BrightID, and Gitcoin Passport try to do it without biometrics
Civic is the oldest of the three. It started as a document-verification service, where users upload a government ID, Civic confirms it, and the user gets a verifiable credential they can present to other apps without re-sharing the document. Civic Pass and Civic ID are the modern form of that. The trade-off is straightforward: you get strong identity assurance in exchange for sharing personal data with a verifier, and you have to trust Civic (or a third-party verifier) to handle it correctly. It is closer to a KYC layer than a pure personhood primitive, and it is not designed to be anonymous.
BrightID is closer to the pure proof-of-personhood ideal. It uses a social graph: you connect to other real humans through video calls or in-person meetings, and the network ranks how "human-like" your connections look. The downside is well known. The graph can be attacked by Sybil clusters that meet each other on purpose, and being "BrightID-verified" mostly proves you were willing to show up to a few calls. It is lightweight, it is pseudonymous, and it works without any hardware. That is also why airdrops have moved away from pure BrightID for high-value distributions.
Gitcoin Passport is the youngest and, in practice, the most widely used. It is not a single system. It is an aggregator that scores you based on stamps from multiple verifications: a Twitter account, a Discord, a Google account, ENS ownership, BrightID, Civic, and so on. Your score is the sum of weighted stamps. The model is flexible, easy to integrate, and tunable per project. The risk is that stamps are often siloed web2 signals: a real Twitter account is not the same as a real human, and the market for aged Twitter handles has been documented for years. Gitcoin Passport is the most pragmatic of the three, which is also why it is the least "pure."
What each one actually proves
It is worth being precise. Civic proves "this person provided documents that match a real identity." BrightID proves "this account is connected to a human who showed up for a meeting." Gitcoin Passport proves "this account owns several web2 and crypto credentials that correlate with being a person." Worldcoin proves "this account is bound to a unique human body, as far as the orb can tell." Each of these is useful in different settings. None of them is a substitute for the others, and none of them replaces a passport.
Sybil resistance in the wild: claims versus reality
Sybil resistance is the marketing word for "stopping fake accounts." Every proof-of-personhood project claims it. The reality is more uneven. Worldcoin's orb gives strong resistance against software-only attacks, but it does not protect against a determined attacker who farms multiple real humans in low-cost jurisdictions, or against insiders who create fake orb scans. Civic's document flow is only as strong as its verifier network and its anti-fraud team; document fraud is a real industry, and Civic is not the only buyer of detection tools. BrightID's graph attacks have been demonstrated repeatedly in academic work, including the so-called "Brianskull" attack where one attacker created thousands of believable identities.
Gitcoin Passport's score-based model is tunable, which is both its strength and its weakness. A project can require a high score, but a determined attacker can farm stamps, especially paid web2 verifications that are priced low enough to be profitable. The honest read is that all four systems raise the cost of Sybil attacks without making them impossible. The right question for a builder is not "is this Sybil-proof" but "how much does it cost to beat, and is that cost high enough to protect what I am doing?"
For an investor comparing these tokens, the same logic applies. The market often prices proof-of-personhood as if the credential itself is the moat. It usually is not. The moat, if there is one, is the network of integrators who actually use the credential to gate airdrops, governance, or rate limits. WLD's value is therefore downstream of how many applications choose to gate on World ID, not on whether World ID is technically the most Sybil-resistant option.
Token unlock schedules and what circulating supply actually means
WLD launched with a fixed maximum supply of 10 billion tokens and an initial circulating supply that was a small fraction of that. The gap between circulating and maximum supply is the unlock schedule, and it is the single most important number on the WLD tokenomics page for anyone thinking about position sizing. As of late 2024, circulating supply was still under 20% of the maximum, with the remainder scheduled to release over multiple years to the team, to early investors, and to the user-incentive reserve that funded the airdrops.
The user-incentive allocation is interesting because it is what funded the free WLD tokens that early orb users received. That part of the supply was meant to bootstrap adoption, and it has. The team and investor allocations, however, are large, and their vesting cliffs are what gate future dilution. When an unlock passes without a market-shaking drop, that is information. When an unlock is delayed or restructured, that is also information. Either way, the schedule is public and should be read directly rather than summarized from headlines.
By contrast, Civic's CVC token, BrightID (which has no widely traded token), and Gitcoin's GTC token have very different supply profiles. GTC has a treasury-heavy structure where most tokens sit in a DAO-controlled wallet and are distributed through grants, meaning dilution comes from governance decisions rather than from a fixed vesting curve. CVC has had multiple supply dynamics over its history, including burns and migrations. The investment case for each proof-of-personhood token is therefore not just "does the technology work" but "how does the supply change over the next two to four years, and who controls that change."
Practical implications if you are evaluating these tokens
The first thing to accept is that you are not buying infrastructure. You are buying a claim on a narrative plus a small slice of a treasury or a fee flow, depending on the token. WLD does not earn yield. CVC is not used to pay for Civic verifications. GTC is a governance token over a grants treasury. None of these is analogous to holding ETH or a stablecoin. Treat any price model as a narrative model, because that is what it is.
Second, pay attention to where the credential is actually used. World ID is integrated into several airdrops and into a few consumer apps. Civic Pass shows up in token-gated access for DeFi front-ends. Gitcoin Passport is widely used to gate quadratic funding rounds on the Gitcoin Grants platform. BrightID is used in smaller airdrops and a handful of DAOs. Usage is the real tell of whether a personhood primitive has product-market fit. Press releases are not.
Third, read the data policy yourself. For WLD, that means understanding Personal Custody, the deletion flow, and which jurisdictions the orb operates in. For Civic, that means knowing which verifier handles your document and whether your data is stored or zero-knowledge-proven. For Gitcoin Passport, that means knowing which stamps you connected and whether disconnecting them actually removes the data. Privacy is not a single checkbox; it is a stack of small decisions that compound.
Finally, accept that "proof of personhood" is not a category that just competes on Sybil resistance. It also competes on regulatory exposure, on integration friction, on cost to the verifier, and on the social trust users extend to the issuer. Worldcoin's hardware gives it a strong technical story and a weak regulatory story. BrightID has a weak technical story and a strong openness story. Gitcoin Passport has a flexible story and a stamp-farm problem. Civic has a strong identity story and a privacy trade-off. None of them is best at everything, which is why the category has not converged.
How to follow proof-of-personhood tokens without getting blindsided
Proof-of-personhood moves fast and so does the news around it. Tracking regulatory rulings, integration announcements, unlock events, and Sybil-attack disclosures across Worldcoin, Civic, BrightID, and Gitcoin Passport manually is a losing game. Zippfeed surfaces crypto headlines with sentiment scoring (bullish, neutral, or bearish) and an importance rating, so you can see which stories actually move the narrative and which are noise. Use it to read each development critically, then decide what the news means for the tokens you hold or are watching.
CryptoSlate
