Can Online Voting Be Secret and Verifiable at Once?

The most common objection to online voting is that you have to choose: either the ballot is secret, so nobody can prove the count, or the count is provable, so nobody has secrecy. This is a myth. End-to-end verifiable voting gives you both at the same time. A voter can confirm their own ballot was counted, anyone can confirm the published tally matches the ballots cast, and no one can tell how any individual voted. Cryptographers solved this. The reason people still believe the tradeoff is real is that most voting tools do not implement the solution, so most people have never seen it work.

Where the myth comes from

It comes from paper. With a physical secret ballot, the whole point is that once your paper goes in the box, it cannot be traced to you. That anonymity is also why you cannot personally verify it was counted correctly. You trust the process, the observers, and the chain of custody. So people generalize: secrecy and personal verification are opposites. On paper, roughly, they are.

Software does not have to inherit that limitation, but a lot of software pretends the limitation is a law of nature. A basic survey tool either stores "Sevak voted yes," which kills secrecy, or shows you a final number you cannot check, which kills verifiability. Both are lazy. Neither is the state of the art.

How you actually get both

The mechanism is separating identity from ballot content, then using cryptography to make the tally checkable without decrypting individual votes.

• Identity gates entry, not the ballot. The system confirms you are eligible and have not voted, then accepts an encrypted ballot that carries no link to your name.
• Encrypted ballots are published. Everyone can see the box of encrypted votes. Nobody can read them.
• You get a receipt. You can confirm your specific encrypted ballot is in the published box. That is the personal verification paper cannot give you.
• The tally is proven, not asserted. The votes are counted using techniques that let anyone verify the result matches the encrypted ballots, without ever revealing what any single ballot said.

That is end-to-end verifiability. I walk through it more slowly in end-to-end verifiable voting explained and in what makes an online vote verifiable. The short version: your name lets you in the door and never touches your ballot, and math replaces trust for the count.

Why most tools do not do this

Because it is harder to build than a form, and most vendors are selling a form. If your voting tool cannot explain how a voter checks their own ballot without revealing it, it is not doing end-to-end verification. It is doing "trust our database." That is fine for picking a lunch spot and disqualifying for a board seat, a union contract, or anything someone might contest. This is the actual dividing line between voting platforms, and it is why MintVote exists: to run votes where the secret-and-verifiable property is the product, not a checkbox.

What this changes for you

Stop accepting "you can't have both" as a reason to run important votes on a spreadsheet or a paper box. You can have both. When someone tells you online voting is inherently a tradeoff between secrecy and proof, they are describing paper, or bad software, not the current technology.

The reason this matters beyond trivia: opacity is the real failure mode of voting, and the myth of the tradeoff is what keeps organizations stuck with opaque tools. Once you know you can prove the count without exposing the voter, "we just trust the tally" stops being acceptable. Demand both. The technology has been ready for years. The only thing missing is people insisting on it.