The Verifiable Election Guide

Modern elections, paper ones included, share a structural weakness. Often nobody can verify the result for themselves. The individual voter cannot check that their own vote was counted, and independent parties cannot check the result end to end. You mark a ballot, hand it to a process, and trust that process. Observers and recounts help, but they only cover what those particular people witnessed, and they tell you nothing about your ballot specifically. The result rests on trust in officials, procedures, and chains of custody nobody saw in full.

Online voting made this worse rather than better. When a vote becomes a database entry, there is nothing to observe at all. The voter sees a confirmation screen, the administrator sees a result, and the honest answer to “how do you know the count is right” is “because the vendor says so.” For works council elections, shareholder meetings, and municipal votes, elections with legal consequences, that is a serious trust problem.

A verifiable election closes this gap. It publishes mathematical evidence at every stage, checkable by the individual voter and by independent parties who do not trust the system.

We wrote this guide to help voting practitioners understand how to evaluate and implement a verifiable election system, step by step:

1. Understand what verifiability means
2. Give voters a check they can run themselves
3. Publish evidence anyone can check
4. Count the ballots without ever reading them
5. Split the key across independent parties
6. Publish a proof for every step of the count
7. Plan for what happens when a check fails
8. Decide whether to build or integrate the cryptography

1. Understand what verifiability means

Verifiability has two layers.

Individual verifiability means each voter can confirm their own ballot was received and registered as cast. Universal verifiability means anyone can confirm the published result is the correct tally of all registered ballots, with nothing added, dropped, or altered.

A system needs both. The first alone tells voters their ballots arrived but not that they were counted correctly. The second alone proves the count was right on whatever ballots the system happens to hold. Switzerland has written this standard into law. Its Ordinance on Electronic Voting requires complete verifiability, individual plus universal, before any system may be used in federal votes, currently the most demanding regulatory bar in Europe.

Verifiability does not mean nothing can go wrong. It means problems are detected before a result is certified, rather than silently becoming the official outcome. Manipulating a verifiable election is not just difficult. It is difficult to do without getting caught.

2. Give voters a check they can run themselves

Two questions matter to a voter. Did the ballot that left my device contain my choice? And did the system register it unchanged?

Systems answer these differently. Switzerland mails voters a sheet of return codes to compare against codes shown after voting, and only the correct choice can produce the correct code. Other systems issue tracking codes the voter can look up on a public record after the election. In each case, the voter can perform the check themselves without trusting the software, the server, or the election authority.

This is Shutter Governance’s approach. After voting, you receive a pseudonym, a unique code starting with 0x. Open Find my vote on the public voting dashboard, paste it in, and your encrypted ballot appears on the record, confirming your vote was recorded, without revealing to anyone what it contains.

Voters deliberately do not receive a receipt showing how they voted. Such a receipt would be a coercion tool, something a voter could be pressured to show. The voter must be able to convince themselves their vote is registered without being able to prove to anyone else what it was. If voter-side verification feels indirect, the indirection is protecting the voter.

3. Publish evidence anyone can check

This is universal verifiability, the second layer from section one. Anyone can check the count, not just voters or officials, because the election publishes its evidence on a public record.

The public record

In elections supported by Shutter Governance, that record is the public voting dashboard, available online to anyone anywhere in the world. The dashboard shows every encrypted ballot exactly as the system received it, together with proofs for each step taken with those ballots afterwards. None of this shows how anyone voted, because the ballots stay encrypted. What it shows is whether the election was run correctly, so anyone in the world can check the result without seeing a single vote.

From that record, anyone can check that every counted ballot came from an eligible voter who voted at most once, and that every ballot contains a valid vote. They can also check that the counted set exactly matches the recorded set and that the published result is the true tally. The validity checks rely on zero-knowledge proofs, which prove that something is true without revealing the underlying information.

Checking the result yourself

You do not have to trust the software either, because the verification runs on your own machine. In an election supported by Shutter Governance, the public voting dashboard includes a short verification guide. Anyone can download the result data, run a small script, and reproduce the vote counts on their own computer. If the numbers match the published tally, the result is genuine, and no trust in the dashboard was required.

Switzerland comes close but stops short of this. Its verification software and cryptographic evidence are published, yet checking the complete result requires specialist software and technical knowledge, so in practice it is done by cantonal electoral authorities and experts, not ordinary voters. The next step is making this verification accessible to people without specialist technical knowledge, as we argued in our article on Switzerland’s e-voting requirement.

More than a certificate

Verifiability is also not the same as certification. A certificate says an expert inspected the system before the election. Verifiability says the evidence from this election checks out, and you were free to check it yourself. Most people never will, and that is fine. What matters is that anyone can check the result, including the losing side in the election or anyone else with a reason to question it.

4. Count the ballots without ever reading them

The ballot should be encrypted on the voter’s device, before it is ever submitted. This is what Shutter Governance does. The server never receives a readable vote. Instead, only the encrypted ballot appears on the public record. Most platforms encrypt the vote while it is being sent, but the operator can still read it once it arrives. With device-side encryption, the operator never gets access to the readable ballot.

But if ballots are never decrypted, how do you count them? There are two established ways.

Mix networks pass the ballots through independent mixers that shuffle and re-encrypt them, each proving it changed no votes. After enough shuffles the ballots are decrypted and counted individually, unlinkable to voters provided at least one mixer was honest. Switzerland’s federal system works this way.

Homomorphic tallying lets you count votes while the ballots are still encrypted. Ballots are added together while still encrypted, and only the aggregate total is ever decrypted. Individual ballots are never decrypted, during the count or afterwards. Only the aggregate result is revealed. Shutter Governance uses homomorphic tallying with zero-knowledge proofs for this reason.

With device-side encryption and threshold decryption, the operator, election authority, insiders, and anyone who steals the database cannot read individual ballots. The main exceptions are the voter and the voter’s own device, which sees the choice before it is encrypted. This is also why voters should not receive proof of how they voted, since that could be used for coercion.

Could quantum computers expose individual votes?

A sufficiently powerful quantum computer could one day break much of today’s public-key cryptography. In Shutter Governance’s approach, however, published ballots are linked only to the voter’s pseudonym, not their name. The link between the pseudonym and the real-world voter is kept outside the public record and is accessible only to the party that needs it to verify who voted and, where necessary, combine physical and digital votes.

For voting practitioners, this means looking not only at how strong the encryption is today, but at what would actually be exposed if it were broken and whether the system has a path to post-quantum security. We are currently bringing together research on quantum-secure threshold encryption and documenting that work publicly.

5. Split the key across independent parties

The privacy protections in the previous section depend on ensuring that no single person or organization can decrypt the ballots alone, because a single decryption key creates two risks: it can be compromised or it can be lost. If one party holds the key, then anyone who compromises that party, such as a hacker or dishonest insider can read every vote in the election. And the key can be lost, leaving cast ballots permanently uncountable.

Decryption needs operational redundancy. In March 2026, a Swiss canton could not decrypt over two thousand cast votes after a problem with the handling of a USB stick used in the decryption process.

Threshold cryptography avoids relying on a single decryption key. Instead of one key, the system creates key shares held by several independent parties. Shutter Governance calls these parties keypers. A rule like “any three of five shares are required to decrypt” governs them. No single keyper, and no pair, can decrypt alone. Only when enough keypers cooperate can the ballots be decrypted. If one keyper’s hardware fails, the remaining keypers can still reach the required threshold and complete the count.

Two details are important when evaluating a threshold cryptography setup. The full key should never exist anywhere, which modern schemes achieve through distributed key generation, creating the shares jointly so no machine ever briefly holds everything. And the keypers must be genuinely independent. If one vendor controls all five shares, there is still a single organizational point of compromise. The shares should instead be controlled by genuinely independent parties, such as the election authority, platform provider, auditor, staff representative body, or external trustee.

Threshold cryptography only adds resilience if the key shares are also stored and managed independently. Storing all the shares in one building creates another single point of failure. When evaluating a provider, ask how key shares are stored, how keypers are onboarded, and what happens if a share is lost.

6. Publish a proof for every step of the count

When voting closes, no more ballots can be added. The set of encrypted ballots on the public voting dashboard is fixed, the electronic equivalent of sealing the ballot box. Voters can still confirm their own ballot is in the set using their pseudonym.

Counting then happens in two steps, and each step publishes its proof.

First, all the encrypted ballots are added together into a single encrypted tally. No ballot is decrypted for this. It is plain arithmetic on public data, and anyone can redo the calculation from the dashboard and confirm they arrive at the same encrypted tally.

Second, the keypers decrypt that tally. Each keyper publishes a decryption share, together with a zero-knowledge proof that the share is correct, so a dishonest keyper cannot quietly skew the result. Once enough valid shares come together, threshold decryption reveals the final vote counts, and only the counts. No individual ballot is ever opened.

The published result is therefore the end of a chain anyone can check: the valid encrypted ballots, the encrypted tally, and the proof that the final decryption was performed correctly. If every proof checks out, the result is correct without anyone having to trust the platform, the authority, or any single keyper. If any proof fails, the failure is visible, points to a specific step, and is grounds to halt certification. Systems built on mix networks prove their count differently, through shuffle proofs and a proven final decryption, but meet the same standard.

For anyone evaluating a platform, this all comes down to one question. When the result is announced, what evidence is published with it, and can that evidence be checked by software the provider did not write?

7. Plan for what happens when a check fails

A verifiable election also needs a clear process for what happens when a check fails.

Some failures the system catches directly. An altered or dropped ballot fails the voter’s check, giving grounds for a complaint and, where rules allow, a revote. A failed cryptographic proof shows that a specific step was not performed as claimed. The result should not be certified until that failure has been resolved. And a keyper who misbehaves is exposed by their own invalid proof, while the threshold lets the count proceed without them.

Cryptography cannot prevent or detect every kind of election failure. Servers can go down, key material can be lost beyond the threshold, malware on a voter’s device can change a vote before encryption, and an incorrect electoral register will be faithfully confirmed as correct. These failures require operational safeguards.

The difference verifiability makes is what happens next. Without evidence, a dispute becomes a clash of claims: manipulation may never be discovered, while unfounded accusations can be difficult to disprove. With verifiable evidence, complaints can be checked, failures can be traced to a specific step, and a clean verification gives courts, candidates, and other interested parties something they can examine for themselves rather than simply accept.

8. Decide whether to build or integrate the cryptography

Most organizations that run online votes already have a platform, with voter management, workflows, and years of operational experience in place. Building election cryptography in-house requires specialist expertise and ongoing maintenance that most voting platforms do not already have. It is a specialist field where subtle mistakes undermine exactly the guarantees being advertised, and the organizations best at election workflows are rarely the ones best positioned to maintain a cryptographic codebase.

The alternative is integration. The cryptographic core of an election is cleanly separable, so it can be added as a service, the same way nobody builds their own payment processing. The platform keeps the register, authentication, ballot presentation, and support. The encryption layer handles ballot encryption on the voter’s device, the keypers, the tallying, and the public evidence. For the development team, this means integrating through an API and SDKs rather than implementing the cryptography themselves. This is what Shutter Governance provides.

What to get right before the first ballot

Whether you are implementing a verifiable voting system or assessing one, four questions matter:

• Does the voter get a check they can perform themselves, without being able to prove their choice to anyone else?
• Is the evidence public and checkable by software the supplier did not write?
• Are individual ballots ever decrypted, or only the aggregate?
• Who holds the key shares?

Verifiability has to be built into the election from the start, so the right checks, evidence, and key controls are in place before voting begins.

Further resources

• See how Shutter Governance works
• Read our article on Switzerland’s e-voting verifiability requirements

If you are implementing verifiability in an existing voting platform or designing a new election system, get in touch with us.