identity.org.au

identity.org.au is not an Australian Government service. It is an open-source community service stewarded by the not-for-profit DETIO Foundation, currently in the process of applying for accreditation under the Digital ID Act 2024. How this service is different

The service

Mobile wallet

The capture side of the Identity Wallet: your phone's camera, sensors and secure hardware do the verification work — and encrypt everything before it leaves your hands.

Open-source reference implementation

Verification evidence can only be produced where the person and the device meet — so the mobile wallet is where your identity is actually verified. It is a guided capture app: it walks you through each evidence step, checks quality as you go, lets you review everything, and encrypts the whole payload on your phone before a single byte is transmitted.

The capture pipeline

  • Guided document capture. Front and back of your identity document, framed with on-screen corner guides. The app checks edges, focus and glare in real time, and the document's text is read by OCR so you can correct any misread field before submission.
  • Selfie with active liveness. Short challenges — blink, turn your head, smile — issued unpredictably and verified live. A photo, replayed video or rendered face cannot answer a challenge it has not seen; this is the core defence against deepfake and replay attacks.
  • Biometric hardware capture. For the Trusted level, fingerprint or iris capture runs through your phone's platform-secure APIs — inside secure hardware the operating system cannot read into — with liveness and anti-spoofing signals.
  • Device integrity attestation. Google Play Integrity on Android and Apple App Attest on iOS let your device prove the app is genuine and the system untampered, closing off the emulators and injection tools that industrial fraud relies on.
  • On-device encryption. Templates and payloads are encrypted on your phone with envelope encryption (X25519-XSalsa20-Poly1305) before transmission. The network receives ciphertext it can verify against but never browse.
Scan your document Step 1 of 5 Front of your document Line it up inside the frame — hold still DRIVER LICENCE Edges detected No glare Hold steady… Processed on your device Images are encrypted before anything is sent. Capture front
Liveness check Step 2 of 5 Challenge 2 of 3 Turn your head slowly to the left Blink — passed Head turn — in progress Smile — up next Proves a live person is present — not a photo or replay

What never leaves your phone unprotected

The design rule is simple: raw evidence is processed at the edge, and only encrypted payloads and signed results move. Your document images and biometric templates are encrypted before transmission; verification produces a score and tier recorded on the network; and services that rely on your identity receive answers, never evidence. The full model — keys, revocation, deletion — is on the wallet security page.

After capture: the wallet role

Once verified, the mobile app is also a wallet: your credential card, your shareable proofs and your consent activity live on the device, and requests from services appear there for approval. The same identity is available in the browser at my.identity.org.au — capture is mobile-only, management is everywhere.

No app-store listings

The mobile wallet is an open-source reference implementation — the working blueprint production wallets build on, published in the VirtEngine repository. There are no official app-store listings at this stage. Treat any store listing claiming to be this wallet as suspect and report it.