Privacy Conscious Age Verification - Dissertation

It’s May 2026, and that means only one thing — dissertation time is finally over! 🎉

If you want to get straight into the links, have a look here

For my final year project on BSc Forensic Computing & Security, I set out to tackle a problem that’s become increasingly relevant in the UK: how do you verify someone’s age online, without making them hand over their entire identity?

The UK’s Online Safety Act puts a legal requirement on websites to verify users’ ages — but the Government hasn’t provided a standardised way to actually do it. The result? Websites are offloading the work to third-party services that ask you to upload your passport, driving licence, or submit a face scan. That’s a lot of personal data flying around, and as Discord found out in late 2025 when roughly 70,000 government IDs were potentially leaked, the risks of getting that wrong are very real.

My solution leans into a set of emerging W3C standards: Decentralised Identifiers (DIDs) and Verifiable Credentials (VCs). Rather than handing a website your full ID, the system issues you a signed credential that just says “this person is over 18” — nothing else. No name, no address, no date of birth. Job done.

The system has three components working together: an Issuer (the entity that vouches for your age), a Holder (an iOS app that stores and presents your credential), and a Verifier (the website that wants to check you’re old enough). To top it off, the Holder app generates a fresh, ephemeral identity for every single verification — meaning there’s no way to link two separate verifications back to the same person. That’s the privacy dream right there.

On the security side, the system uses Ed25519 signatures throughout, TLS 1.3 for all communications, and nonce-based session binding to shut down replay attacks. I even put it through a Burp Suite-based replay attack test myself — intercepting a request, swapping the nonce, and watching the verifier reject it outright. Very satisfying.

If you want to have a poke around the demo, all of the details, and account setup information is available here!

This has genuinely been one of the most fun (and stressful!) project I’ve worked on at uni. Huge thanks to Dr Fudong Li for the supervision, everyone who filled in my survey or took part in the user testing, and everyone who kept me going throughout the year.