OpenTrust: Open-source SDK brings privacy-first browser trust signals

OpenTrust is an open-source TypeScript SDK released to help developers collect privacy-preserving browser trust signals. The core insight is that trustworthiness estimation should rely on multiple layers—browser-side signals combined with server-side verification and authentication—rather than a single decision point.

The SDK provides four categories of browser signals. Browser automation detection identifies webdriver flags, headless browsers, and abnormal properties that suggest script-driven access rather than a real user. Webcam integrity checks detect virtual cameras and analyze video feeds for signs of static or replayed content. Passive liveness analysis looks for face presence, motion, and blink patterns without requiring active user gestures. Microphone integrity checks identify virtual microphones and analyze audio signal quality. All processing occurs on the client device; raw frames and audio never leave the browser.

Developers integrate OpenTrust through a simple TypeScript API. The verify() method accepts options to enable camera and microphone checks, with a configurable timeout (default 15 seconds). The method returns a trustScore ranging from 0.0 to 1.0 and a signals object containing individual readings: faceDetected, livenessScore, virtualCameraDetected, browserAutomationDetected, replayRisk, audioScore, and virtualMicDetected. A quick-start example shows a trustScore of 0.85 with liveness at 0.72 and no virtual camera or browser automation detected.

The SDK is distributed via npm (opentrust-sdk for the core library, opentrust-react for a React hook), a CDN at https://cdn.jsdelivr.net/npm/opentrust-sdk@0.1.0/dist-browser/opentrust.umd.js, and a live demo at https://open--trust.vercel.app. The project is MIT-licensed and hosted on GitHub, welcoming contributions. OpenTrust explicitly documents what it is not intended to replace—KYC, identity verification, enterprise liveness detection, device attestation, and server-side fraud detection—positioning itself as a complementary signal source rather than a standalone security solution.

OpenTrust addresses a growing need for lightweight, privacy-respecting fraud and bot detection in web applications. Rather than replacing comprehensive identity verification or server-side security systems, it is positioned as one layer in a multi-layered trust architecture. The SDK returns confidence scores (0.0–1.0) and individual signal readings—such as livenessScore, replayRisk, and virtualCameraDetected—rather than binary classifications, giving developers flexibility to combine the signals with their own authentication and backend verification logic.

The emphasis on client-side processing aligns with modern privacy expectations: developers can offer trust checks without collecting or transmitting raw biometric data. By publishing the tool as open-source under an MIT license and offering multiple distribution channels (npm, React hook, CDN), the project lowers the barrier to adoption for developers building fraud prevention and bot mitigation workflows. The live demo and straightforward API are designed to make experimentation accessible.

No comments yet. Be the first to share your thoughts!