Trustless election infrastructure
Fair Elections, Verified by Math.
No human counting. No early results. Every ballot is cryptographically protected, and every outcome can be independently verified.
Voters don't need accounts.
6:14 PM
Voting open
- Ballots cast
- 214
- Partial result
- Does not exist
The organizer sees turnout, never a tally.
7:59 PM
Ballots sealed
- Ballots sealed
- 302
- Decryption key
- Not yet generated
Held by no one, including ZeroVote.
8:00 PM
Results verified
- Ballots verified
- 302 / 302
- Merkle root
- Matches
Recomputable by anyone with the snapshot.
Secured by
These organizations operate drand, the public randomness network that powers ZeroVote elections.
Why ZeroVote
Every election asks you to trust someone.
Someone controls the ballots. Someone counts the votes. Someone sees the result first. And everyone else has to accept their word.
ZeroVote replaces that trust with cryptographic rules an organizer cannot override, and a public record that lets anyone check ours.
No early results
Every ballot is timelock-encrypted. The key does not exist until the scheduled reveal, so nobody gets an advance look.
No human counting
When the reveal key arrives, code decrypts and tallies every ballot using the same public, deterministic process.
No silent changes
Every accepted ballot is recorded in a tamper-evident Merkle tree. Adding, removing, or changing one leaves detectable evidence.
No exposed identities
Blind signatures separate eligibility from ballot content: the server signs a credential it never sees, so a vote can be validated without being linked to its voter.
How it works
From private ballot to public proof.
- 1
Cast
The voter makes a selection in their browser. Their ballot is encrypted for a predetermined reveal time.
- 2
Prove
A blind-signed credential confirms the ballot is eligible without revealing the vote or the voter. The voter receives a cryptographic inclusion receipt.
- 3
Reveal
At the scheduled time, a distributed randomness beacon releases the key. Every ballot unlocks simultaneously and the tally is computed.
- 4
Verify
Anyone can download the public election data, check every ballot, rebuild the ballot record, and independently reproduce the result.
Don't trust us
Verify the result yourself.
Every ZeroVote election publishes the inputs needed to check its outcome. Run the open-source verifier and confirm that:
- Every accepted ballot spent a credential from the public registration log, exactly once
- The ballot record was not altered
- The reveal key came from the real beacon
- The published tally matches the ballots
$ zerovote-verify --slug board-election-2026 "beacon_verified": true, "decrypt_failures": 0, "duplicate_nullifiers": 0, "invalid_registrations": 0, "merkle_root_match": true, "results_match": true, VERIFIED: 302 ballots, root matches, published result matches the recomputed tally.
Built for high-trust decisions
When the outcome matters, trust shouldn't be required.
Boards and associations
Run HOA, condo, nonprofit, and internal board elections without asking members to trust the people administering them.
Shareholder governance
Give shareholders evidence that their ballots were included and the announced result was correctly calculated.
Awards and judging
Keep results sealed until the announcement while making the final outcome independently auditable.
Unions and member organizations
Protect voter privacy while removing committees and administrators from the count.
DAOs and digital governance
Produce deterministic results that software and smart contracts can consume without relying on an opaque tally.
Prediction markets and event settlement
Settle on an outcome no one could see early, revealed at a predetermined moment and verifiable directly from public inputs.
Simple to run
Create the election. Let the protocol handle the count.
- 1Add the choices and eligible voters.
- 2Set voting and reveal times.
- 3Send secure voting invitations.
- 4Watch participation without seeing votes.
- 5Publish a result anyone can verify.
For developers
Build on results you can verify—not merely receive.
Use ZeroVote's public API, election snapshots, and open-source Rust verifier to power governance systems, compliance workflows, dashboards, or automated settlement.
Settle a prediction market the moment ballots unlock, from the same public inputs that verify the count—so no participant could have traded on the outcome first.
zerovote-verify \ --slug board-election-2026 \ --api https://api.zerovote.app
Questions
Can ZeroVote see votes before the reveal?
No. Each ballot is encrypted in the voter's browser to a future drand round, and our server only ever stores the ciphertext. The key that opens it does not exist until the reveal time, so there is nothing for us to read, leak, or be compelled to hand over.
How is voter privacy protected?
Eligibility and ballot content are handled separately. A voter collects one credential, blind-signed so the server never sees it, and spends it when casting. The registration log therefore shows that a voter took part—organizers can see turnout—while nothing links any published ballot to the voter who cast it.
Can an organizer change the result?
Not without it showing. The tally is recomputed from the published ballots by deterministic code, so altering, adding, or dropping a ballot breaks the Merkle root, a voter's receipt, or both. They also never see anyone's voting link—a link is all it takes to cast that ballot, so it goes only to the voter's inbox, and a voter is emailed the moment theirs is opened. An organizer does control who is invited and when the reveal happens: those are their decisions to make, and they are visible in the election record.
What happens if ZeroVote is unavailable?
While voting is open, an outage pauses voting—ballots are cast through our API. Verification does not depend on us: the verifier runs offline against a downloaded snapshot and beacon, so a result that has already been published stays checkable even if ZeroVote disappears.
Run a verifiable election
An outcome no one has to take on faith.
Create the election, invite voters, and set the reveal time. ZeroVote makes the count private, simultaneous, and independently verifiable.