Verify once. Then every site gets just its answer.

Your pass and your passkey

Your pass is a vault that holds your credentials. You create it with a passkey: a key your device keeps and unlocks with Face ID, a fingerprint or your device PIN. There's no password to set or forget.

• Your vault is encrypted with a key derived from your passkey, so only your passkey can open it. FFN stores the encrypted vault and can't read it.
• If a passkey can't derive that key (some older security keys can't), FFN keeps the vault key wrapped in its own key service instead. Your pass tells you when this happens, and your credentials say “custodial” so sites can see the weaker binding.
• Passkeys sync through iCloud Keychain and Google Password Manager, so your pass opens on any device your passkey reaches.
• While your pass is open, the vault key lives only in that browser tab's memory. It locks when you reload, after 15 quiet minutes, or when you tap Lock.

Getting verified

You choose how to verify. None of the ways needs a face match, and a check that doesn't complete is never stored as a failure or shown to anyone. You're simply offered the next way.

When the check passes, FFN signs an FFN Identity credential into your pass. It can hold: that you're a verified person, over 18, over 21, your date of birth, your legal name, and that you hold a valid license with its issuing state. Each one is shared separately, only when you choose.

What FFN keeps: the credential's ID, type and status, the evidence entries, and the ID partner's reference for the check. Not your photos, not your address. The partner's copy of your scan is deleted after your credential is issued.

Evidence and assurance

Every claim carries a short evidence record, so a site knows how far to trust it and you can see what's behind each badge:

{
  "claim": "ageOver21",
  "method": "vendor-document",
  "source": "Didit",
  "checkedAt": "2026-11-12T18:04:00Z",
  "assurance": "substantial"
}

Your credential also lists what was not checked. “Not checked” means FFN doesn't know. It is never shown as false.

Linking accounts

You can add accounts you already have to your pass. Each becomes its own small credential that shows you control it.

• Email today, with a one-time code.
• Phone, GitHub, Google and LinkedIn are built and switch on as each provider is set up. Accounts use the provider's own sign-in with the smallest permission that returns an ID and profile name.

FFN records facts only: the handle, when the account was made if the provider says, and whether its name matches your verified legal name (“matches”, “partly matches” or “doesn't match”). It never reads posts, connections or messages, and doesn't keep the provider's access token.

Sharing with a site

A site that uses FFN shows a Verify with FFN button. On the same device it opens your pass; on a computer it shows a QR code for your phone.

1. You unlock your pass with your passkey.
2. You see the site's verified name and why it's asking, then each requested claim. Required ones are locked on; optional ones have a switch.
3. Anything the site asked for that your pass doesn't hold is listed under “FFN can't vouch for” and isn't sent.
4. You tap Share. Your pass reveals only the selected claims, signed for this one request so nobody can replay it elsewhere.
5. The site checks FFN's signature, that FFN is allowed to issue the claim, that it hasn't expired or been revoked, and that it came from your pass.

Choose Remember for this site and the same request skips the consent screen next time. That list lives in your encrypted vault, not with FFN. Each site gets its own identifier for you, so two sites can't match you up by it.

Credentials from sites

Sites can issue credentials about things only they know, like “video call completed” or “trip completed”. You add one with a tap, and it always shows who issued it, so it never reads like an FFN identity check. FFN's trust registry limits each site to the kinds it's allowed to issue.

Sites can also ask you to sign a vouch for someone you traveled with. Your pass shows exactly what it will sign. Vouches you receive start hidden, and you choose which ones sites may see.

Expiry, revocation and re-checks

• Identity credentials last 12 months, or until your license expires if sooner.
• Every issuer can switch a credential off, and sites check that switch each time they rely on it.
• If FFN can't be reached, sites carry on with what they stored and when it was checked. FFN never blocks a site.

Lost device and recovery

Passkey syncs (most people): open your pass on your new device with the same passkey. Everything is still there.

Passkey doesn't sync: recover with the email you confirmed, make a new passkey, then verify again. FFN revokes what it issued to your old key and issues to the new one. Credentials from sites need to be issued again by each site.

Deleting your pass

In Settings, choose Delete your pass. FFN revokes every credential it issued to you, then deletes your passkey records, your vault and your email. Credentials that sites gave you are in the vault, so they go with it.