identity.org.au

identity.org.au is not an Australian Government service. It is an open-source community service stewarded by the not-for-profit DETIO Foundation, currently in the process of applying for accreditation under the Digital ID Act 2024. How this service is different

The service

Credentials and proofs

The wallet holds credentials; services receive proofs. This is the full catalogue — and for each entry, exactly what it proves and what it never reveals.

A credential is a verified fact held in your wallet — established once, during verification. A proof is what a service actually receives when you share: the smallest possible answer to its question, often a zero-knowledge proof that reveals nothing beyond a yes. The catalogue below is the complete set — and the “never reveals” column is the point.

Catalogue of wallet credentials and proofs: what each proves and what it never reveals
Credential or proof What it proves What it never reveals
Verification level (tier) That your identity has been verified to Basic, Standard or Trusted — a summary of all the evidence behind that level. The evidence itself: no documents, no biometrics, no score history, no personal details.
Age-over proof That your verified date of birth puts you at or above a threshold — over 18, over 21 — as a cryptographic yes. Your date of birth, your age, or anything else from your document.
Residency proof That your verified address is in a given country. Your address, suburb, or anything more precise than the country the service asked about.
Score-range proof That your verification score is at or above the threshold a service requires. Your exact score, or the signals and history that produced it.
Verified claim (consented) A specific fact read from your evidence — for example your verified name — shared deliberately, claim by claim. Any claim you did not explicitly approve for that specific request. Sharing one claim reveals nothing else.
Consent receipt That a specific consent was granted (or revoked) at a specific time, for a specific scope and purpose — an auditable record both sides can rely on. The content of the data the consent covered. Receipts record decisions, not data.

How a share actually happens

Every presentation follows the same shape. A service requests a specific proof with a stated purpose. Your wallet shows you the request in plain language — who is asking, what would be proven, what stays private — and you approve or decline. On approval, the proof is generated and the decision lands in your consent history with a timestamp and, where you chose one, an expiry.

The walkthrough lives in presenting proofs to a service; the revocation side is covered in revoking consent.

Why the catalogue is small

Six entries is not a limitation — it is the design. Each proof answers one class of question a service can legitimately need, and nothing in the system lets a service free-form collect around them. When services need more, they must ask claim by claim, and you see every ask. Data minimisation only works when the minimal path is also the easy path — the argument in full is in verification tiers and proportionality.

Share only what's needed Zero-knowledge proof Prove the answer — keep the data STAYS ON YOUR DEVICE — ENCRYPTED Full name Date of birth Address Document number SHARED WITH THE SERVICE Over 18 — yes One answer. Nothing else leaves. The service can verify the proof is genuine without ever seeing your information. Share proof

One rule to remember

If a service asks you to email or upload your documents directly, that is outside the wallet and outside these guarantees — the wallet never needs you to hand over documents to prove something it can prove for you. See recognising scams.