Identity, authentication, eligibility, and registration

In plain words

Logging in to a website proves one small thing: you control the account. It does not prove who you are, and it certainly does not prove you are allowed to vote.

Voting needs four separate answers:

1. Can you sign in? (authentication)
2. Are you really the person you say you are? (identity proofing)
3. Does the law let you vote in this election? (eligibility)
4. Does the official list say you are registered here? (registration)

Only the government body that runs the election can answer the last two. A website, including this one and the demo, cannot. If someone is wrongly left off a list, there must be a fair way to fix it. And if a person can vote in more than one way, such as by mail and in person, the system must make sure only one vote counts.

Defined terms

• Authentication. Confirming that the person signing in controls a credential bound to an account. NIST defines three authentication assurance levels; at AAL1 there is "basic confidence that the claimant controls an authenticator that is bound to the subscriber account" ².
• Identity proofing. NIST describes identity proofing as establishing a relationship between a subject and a claimed identity, so that the applicant "is who they claim to be to a stated level of confidence" ³. NIST sets three identity assurance levels (IAL1 to IAL3) of increasing rigor ³.
• Eligibility. The legal right to vote in a particular election, set by law (age, citizenship, residence, and other criteria that vary by jurisdiction). General Comment 25 says the right to vote "must be established by law and may be subject only to reasonable restrictions" ⁷.
• Registration. Entry on an official list maintained by the responsible authority. In the United States, federal law requires each state to maintain "a single, uniform, official, centralized, interactive computerized statewide voter registration list" ⁶.
• Channel. A way of voting: in person on election day, early in person, by mail, or by any electronic method a jurisdiction authorizes.
• Passkey. A credential based on FIDO standards and unlocked the way a person unlocks their device ⁵. See the glossary and hardware.

Evidence

NIST separates proofing, authentication, and eligibility

NIST's Digital Identity Guidelines, SP 800-63-4, released in final form in July 2025, are organized as separate volumes for "Identity Proofing & Enrollment" (63A), "Authentication & Authenticator Management" (63B), and "Federation & Assertions" (63C) ¹. The separation is the point: a strong login (high AAL) can sit on a weakly proofed identity (low IAL), and the reverse. NIST also states that decisions about benefits or services that identity proofing may inform are "outside of the scope of these guidelines" ³. Identity guidance does not decide eligibility for anything, including voting.

NIST's authentication volume requires that verifiers "SHALL offer at least one phishing-resistant authentication option at AAL2," notes that "passwords are not phishing-resistant," and states that "biometrics SHALL only be used as part of multi-factor authentication with a physical authenticator" because "biometric characteristics do not constitute secrets" and "biometric comparison is probabilistic" ². The revision "integrates syncable authenticators (e.g., synced passkeys)" ¹, but syncable authenticators, whose keys are exportable, "SHALL NOT be used at AAL3" ².

Passkeys are scoped to one site

The W3C Web Authentication specification describes public key credentials "each scoped to a given WebAuthn Relying Party," accessible only to origins belonging to that party ⁴. The FIDO Alliance states that with passkeys, "biometric information and processing continues to stay on the device and is never sent to any remote server" ⁵. Two consequences follow. A passkey created for one website does not sign a person in to another domain. And a fingerprint used to unlock a passkey is never received by the website, so the website learns nothing from it about who the person is.

Registration and duplicates are an authority's job

U.S. federal law (the Help America Vote Act, codified at 52 U.S.C. 21083) requires the statewide list to be maintained so that "duplicate names are eliminated," and requires registration applications for federal elections to include a driver's license number or "the last 4 digits of the applicant's social security number," with a state-assigned number for applicants who have neither ⁶. It also sets identification requirements for certain first-time voters who registered by mail, with a provisional ballot available to those who cannot meet them at the polls ⁶. The Constitution assigns "the times, places and manner of holding elections for Senators and Representatives" to each state's legislature ⁸. Other countries assign these duties differently; see jurisdictions.

Estonia offers an example of cross-channel coordination. Internet voters identify with "an ID-card, Mobile-ID, Smart-ID, or digital identity document with valid certificates and PIN codes," only the last electronic vote counts, and a paper ballot cast at a polling place takes precedence over any i-vote ⁹. Coordinating channels requires a single authoritative record of who has voted where, managed by the election authority.

Registration must be facilitated, and errors must be appealable

General Comment 25 says that "where registration of voters is required, it should be facilitated and obstacles to such registration should not be imposed," and that it is unreasonable to impose "literacy, educational or property requirements" ⁷. The Venice Commission's Code calls for "an effective system of appeal" in electoral matters in which "final appeal to a court must be possible" and the procedure is "simple and devoid of formalism" ¹⁰. The history of registration used as a barrier is covered in access and exclusion.

Remote identity checks carry their own privacy risk

The 2020 federal assessment of electronic ballot delivery notes that some systems verify identity using personal information "or biometrics," and that when improperly configured they "can present additional privacy risks," including "the loss or theft of the voter's personal and/or biometric identity information" ¹¹. Collecting more identity evidence is not automatically safer.

Competing interpretations

Stronger identity checks versus access. One view holds that stronger proofing reduces impersonation. Another holds that every additional requirement excludes some eligible people, and that the documented history of registration barriers shows the cost ⁷. Both concerns appear in law: HAVA adds identification requirements and also provides provisional ballots ⁶.

Biometrics as proof versus biometrics as a key. Some proposals treat a fingerprint or face scan as proof of identity. NIST treats biometrics as one factor that unlocks a physical authenticator, never a standalone authenticator or a secret ². The framework follows NIST's position.

Interpretation, this site's reading. Most confusion here comes from collapsing four facts into one. "Verified" should always be followed by "verified what, by whom, to what level."

Application to this framework

1. This website requires no account to read. It collects no identity, eligibility, or registration information.
2. The demo authenticates accounts, nothing more. It uses passkeys where supported, with recovery codes. An email-verified or passkey-protected demo account is not a verified voter, does not prove residence, and does not transfer sign-in between myvoteforward.org and the demo domain ⁴. The demo collects no birth date, home address, government ID, biometric sample, citizenship document, or video proof.
3. Registration stays with the authority. The demo can explain and link to official registration processes. It does not mark anyone registered, submit applications, collect proof documents, or share opinion data with any registration provider. It never invents a registration or voting URL.
4. Future official layer, not built. A future system would need jurisdiction-specific identity proofing at an assurance level the authority sets, eligibility determined by the authority, an authoritative record to prevent duplicate counting across every channel, and an appeals path that ends in independent review ¹⁰. Identity data must stay separate from ballot data; see privacy and security.
5. No device requirement. No one should need a particular expensive device to participate. See hardware.

Unresolved questions

• What identity assurance level would a remote official channel require, and how many eligible people would that exclude? No figure is offered here because none has been measured for this framework.
• How can cross-channel duplicate prevention work in near real time without creating a central record that links identity to ballot timing?
• How should a remote system handle a voter whose credential was taken by someone else, given the coercion risks discussed in intimidation?
• Who decides appeals when a person's eligibility is disputed late in a voting window?