Anti-doble-voto y tokens de un solo uso, explicado simple

"How do I know people won't vote twice?" It's the first question we receive in any demo. Short answer: single-use tokens. Long answer right here, without unnecessary technical jargon.

The core problem

In in-person voting, the problem was solved centuries ago: you approach the polling station, your name is checked off the electoral roll, and you are handed a ballot. You cannot come back for another. The system works because there is a physical checkmark on the roll and a single ballot issued.

Online, we must replicate both elements using bits. If you simply send a "vote here" link to everyone, anyone can refresh the page and vote again. If you rely on cookies or IP addresses, cookies get cleared and IP addresses change.

What a single-use token is

A token is a long, random, and unique string, similar to this:

vt_8f3ka9pq72hd_xn94mz1bv0c6

Each voter on your electoral roll receives their own distinct token when the call to vote is sent out. The token meets three conditions:

• Unique: one for each pair (voter, vote). If you participate in 5 votes, you receive 5 distinct tokens.
• Cryptographically random: it is not predictable. You cannot "guess" other users' tokens.
• Single-use: the moment it is used to cast a vote, it is marked as redeemed.

How it is distributed and redeemed

The full step-by-step workflow:

1. The administrator imports the electoral roll (CSV with email or phone).
2. When voting opens, demokratian generates a unique token for each voter and sends it via a personalized link: https://tuespacio.demokratian.org/votar/vt_8f3ka9pq72hd_…
3. The voter opens the link, views the ballot, and casts their vote.
4. At the moment of casting, the system executes three actions in a single atomic transaction: marks the token as redeemed, records the vote in a separate table, and chains the vote's hash to the previous one.
5. If the voter reloads the link, "you have already voted" is displayed. The token is no longer valid.

Why double voting is impossible

Three independent safeguards:

• Redeemed token: the most obvious. Once used, it is no longer valid.
• SELECT FOR UPDATE: database locking guarantees that even if you send 50 simultaneous requests, only one enters the system.
• Hash chain: each vote chains the previous 5 votes. If someone attempted to manually inject a vote into the database, the chain would break and be detected by election monitors.

And yet, you remain anonymous

The natural question: "If the token identifies me and is linked to my vote, how is it secret?" The answer lies in how data is stored.

The token serves two roles in the system, residing in separate tables:

• Table A — Anti-double-voting: stores the token and a "redeemed/unredeemed" status flag. It does not store the vote contents.
• Table B — Votes: stores the vote contents and a random internal identifier. It does not store the token or voter identity.

The two tables do not share a foreign key. Once the vote is cast, not even system administrators can reconstruct how a specific token voted.

Edge cases we cover

• Lost email: the administrator can regenerate a token (invalidates the previous one, sends a new one, logged in the audit trail).
• Mid-voting electoral roll modifications: blocked by default. If authorized, it is logged and election monitors receive a notification.
• Hybrid in-person voting: an election monitor can redeem the token of a voter physically present, leaving an audit record.

One-sentence summary

A single-use token acts as a digital ballot: unique, non-transferable, and destroyed upon use. The difference with a paper ballot is that ours is cryptographically chained to previous ones, so not even the administrator can forge one unnoticed.