Digital Identity Without Big Tech

Look at how many apps on your phone ultimately trace your identity back to the same three or four companies. A "Sign in with Google" button, a phone number verified through a carrier that's itself tied to a handful of dominant providers, an account that quietly requires an active Facebook login to function at all — each one is convenient in the moment and each one makes a company that has nothing to do with the app you're actually using into a gatekeeper for whether you can use it at all.

What "dependency" actually costs

The cost of that dependency is invisible until the day it isn't. A suspended Google account can lock you out of apps that have nothing to do with Google. A phone number tied to a carrier you no longer have access to can permanently orphan accounts that used it as the only recovery method. A platform login required to "simplify" onboarding for one app quietly hands that platform visibility into — and control over — your access to a completely unrelated product. None of this requires bad intent from the big-tech company in question; it's simply what happens by default when identity is borrowed instead of owned.

SIM swaps, deactivated numbers, and other quiet failure modes

Phone-number-based identity has a specific, well-documented failure mode worth naming directly: the number itself doesn't belong to you in any permanent sense. Carriers reassign numbers after a period of inactivity. SIM-swap fraud — where an attacker convinces or bribes a carrier into moving your number to their own SIM — has been a known account-takeover vector for years precisely because so many identity and recovery systems still treat "controls this phone number" as equivalent to "is this person." An identity system that leans on a phone number as its anchor inherits every one of those carrier-side risks whether it wants to or not, because the anchor itself was never fully under the app's or the user's control to begin with.

What REAL-ID does differently

REAL-ID, covered in full in REAL-ID Explained, is built specifically to not require any of that. It isn't tied to a phone number — no carrier, anywhere, is a single point of failure for your RealGram account. It doesn't require a Google, Apple, or Facebook login to exist or function. And while RealGram grew out of a Telegram-connected mini-app, linking an existing Telegram account to your REAL-ID is optional, not a requirement — you can create and use a full REAL-ID account without ever touching Telegram at all.

Independent identity, not just an independent app

There's a difference between an app being independent and an app's identity system being independent, and it's worth being precise about which one actually protects you. An app can market itself as independent while still quietly requiring a big-tech login underneath to function — in which case the independence is cosmetic, because the actual gatekeeper hasn't changed. RealGram's independence, discussed more broadly in how RealGram protects your privacy, goes down to the identity layer itself: REAL-ID is RealGram's own account system, verified server-side against RealGram's own records, not a thin wrapper around someone else's login infrastructure.

Why this matters even if you never hit the failure case

Most people who depend on a big-tech identity layer never personally experience the account-lockout horror story — and it's tempting to conclude the risk doesn't apply to you because of that. But the value of not depending on a single point of failure isn't measured by how often it fails; it's measured by what happens on the day it does, for you specifically, with no warning and often no real recourse. A digital identity system is infrastructure you're trusting with continuity, not just convenience — and infrastructure is worth evaluating by its worst day, not its average one.

Where trust actually lives

It's worth being specific about what "not depending on Big Tech" does and doesn't mean in practice. It doesn't mean RealGram operates outside the internet's normal infrastructure — hosting, domain registration, and app distribution all still involve other companies, the same way almost everything online does. What it means specifically is narrower and more important: the thing that decides whether your account exists, what it's allowed to do, and what it holds — your identity, your REAL balance, your Shahnameh progress — is verified against RealGram's own records, not against a login or approval from a company with separate commercial incentives and no stake in RealGram's community at all. That's the layer that actually matters for the failure modes described above, and it's the layer REAL-ID keeps in-house.

The tradeoff, honestly stated

Owning your own identity layer instead of borrowing one has a real cost too: it's more work to build, and "Sign in with Google" really is faster to implement and, for most people on most days, perfectly convenient. We're not claiming REAL-ID is more convenient in every single moment — a one-tap social login is hard to beat for raw friction. The claim is narrower and, we think, more important: REAL-ID doesn't make your ability to use RealGram contingent on a company that has nothing to do with RealGram staying happy with you, on some other unrelated platform, forever.

How verification actually works, at a glance

Without getting into implementation details that don't help anyone but an attacker, the general shape is standard, well-understood security practice rather than anything exotic: identity tokens are signed and independently verifiable, checked against RealGram's own published keys rather than trusted blindly, and short-lived rather than permanent — the same broad family of techniques (signed, expiring, independently-verifiable tokens) that underpins most serious modern authentication systems, applied here to an identity RealGram itself issues and controls rather than one borrowed from somewhere else. The specific point worth taking away isn't the cryptography — it's that "independently verifiable" and "borrowed from a bigger company" are two different design choices, and REAL-ID deliberately picked the first one.

What this looks like day to day

In practice, this means your RealGram account isn't something a Google policy change, a carrier switch, or a Telegram-side decision can take away from you. Your REAL-ID is the same account whether you reach RealGram through the standalone app, through Telegram, or through a browser — different doors, one identity, answerable to RealGram's own verification, not a borrowed one.

Frequently asked questions

More in the FAQ.