Notifications You must be signed in to change notification settings
Fork 0
Star 1
BranchesTags
Open more actions menu
Folders and files
NameName
Last commit message
Last commit date
Latest commit
History
10 Commits
10 Commits
.github/workflows
.github/workflows
docs
docs
examples/react-app
examples/react-app
packages
packages
.dockerignore
.dockerignore
.editorconfig
.editorconfig
.gitignore
.gitignore
.npmrc
.npmrc
.nvmrc
.nvmrc
CODE_OF_CONDUCT.md
CODE_OF_CONDUCT.md
CONTRIBUTING.md
CONTRIBUTING.md
Dockerfile
Dockerfile
LICENSE
LICENSE
README.md
README.md
SECURITY.md
SECURITY.md
docker-compose.yml
docker-compose.yml
package-lock.json
package-lock.json
package.json
package.json
tsconfig.base.json
tsconfig.base.json
vercel.json
vercel.json
Repository files navigation
Privacy-first browser trust signals for modern web applications.
OpenTrust is an open-source SDK that collects privacy-preserving browser signals to help developers estimate the trustworthiness of a browser interaction. It provides signals — not decisions — designed to be combined with authentication, device reputation, and server-side verification systems.
Overview
OpenTrust exposes browser-side trust signals through a clean TypeScript API:
Browser automation detection — webdriver flags, headless browsers, abnormal properties
Webcam integrity checks — virtual camera detection, static/replayed video analysis
Passive liveness analysis — face presence, motion, blink detection
Microphone integrity — virtual mic detection, audio signal analysis
All processing is client-side. Raw frames never leave the device.
When to use OpenTrust
OpenTrust is designed to provide additional signals for:
Fraud prevention workflows
Risk scoring and trust estimation
Bot mitigation systems
Browser integrity checks
Research and experimentation
Developer tooling and prototypes
When not to use OpenTrust
OpenTrust is not a replacement for:
KYC (Know Your Customer)
Identity verification
Enterprise liveness detection
Device attestation
Server-side fraud detection
Philosophy
Security is built from multiple layers. OpenTrust intentionally focuses on browser-side trust signals and should be combined with server-side verification and authentication systems. The SDK returns confidence signals — not binary "human/bot" judgments.
Installation
npm install opentrust-sdk
Quick Start
import { OpenTrust } from 'opentrust-sdk';
const result = await OpenTrust.verify({ camera: true, });
console.log(result.trustScore); // 0.85 console.log(result.signals); // { // faceDetected: true, // livenessScore: 0.72, // virtualCameraDetected: false, // browserAutomationDetected: false, // replayRisk: 0.12, // audioScore: 0.0, // virtualMicDetected: false // }
API
OpenTrust.verify(options?)
Option Type Default Description
camera boolean false Enable webcam checks
microphone boolean false Enable microphone checks
timeout number 15000 Max time in ms
Returns
{ trustScore: number, // 0.0 - 1.0 signals: { faceDetected: boolean, livenessScore: number, virtualCameraDetected: boolean, browserAutomationDetected: boolean, replayRisk: number, audioScore: number, virtualMicDetected: boolean, }, timestamp: number }
React Hook
npm install opentrust-react
import { useOpenTrust } from 'opentrust-react';
function VerificationButton() { const { result, loading, verify } = useOpenTrust();
return (
); }
CDN
Demo
git clone https://github.com/rafaelEt/opentrust.git cd opentrust npm install npm run dev
Or with Docker:
docker compose up
Visit http://localhost:3000.
Or try the live demo: https://open--trust.vercel.app
Privacy
OpenTrust never uploads raw camera frames or microphone audio. All processing is client-side. See docs/privacy.md.
License
MIT — see LICENSE.
Contributing
Contributions welcome. GitHub · Live Demo
Topics
Resources
Readme
MIT license
Code of conduct
Code of conduct
Contributing
Contributing
Security policy
Security policy
Activity
Stars
1 star
Watchers
0 watching
Forks
0 forks
Report repository