Digital identity and verifiable credentials: what a ledger can and cannot do

Three roles: issuer, holder and verifier

Most proposals for digital identity share a simple model. An issuer — a government, a university, an employer — makes a statement about a person, such as "this person holds a driving licence" or "this person completed a degree". The holder keeps that statement, usually in an app on their phone. A verifier — a car rental desk, an employer, a website — asks for proof and checks it.

Today this often means showing a plastic card or uploading a scan of a document. The verifier sees everything printed on it, may keep a copy, and has few practical ways to check that it is genuine. The aim of digital credentials is to make the check reliable and to share only what is needed.

The standards behind the idea

The World Wide Web Consortium (W3C) publishes two relevant standards. The Verifiable Credentials Data Model describes how a credential is structured and digitally signed by its issuer, so that any tampering breaks the signature. Decentralized Identifiers (DIDs), a W3C Recommendation since 2022, describe identifiers that can be resolved to public keys without a single central registry.

A DID can be anchored in different places. Some DID methods use a ledger; others use an ordinary web domain or simply derive the identifier from a key. The standard deliberately leaves this choice open, which is one reason why "blockchain identity" and "verifiable credentials" are not the same thing.

What goes on the ledger — and what must not

When a ledger is used, it typically holds:

• the public keys or identifiers of issuers, so verifiers can check signatures;
• descriptions of credential formats (schemas);
• revocation information, so a verifier can see whether a credential has been withdrawn, ideally without learning anything about the holder.

It should not hold names, dates of birth, document numbers or even hashes of individual credentials. Data written to a widely replicated ledger cannot practically be deleted, which conflicts with the right to erasure under the EU General Data Protection Regulation. Even a hashed or pseudonymous identifier can become a tracking key if the same value is used across many verifications. Most current designs therefore keep individuals entirely off the ledger.

Selective disclosure and privacy

One of the most useful features of modern credentials has nothing to do with ledgers. With selective disclosure, a holder can prove one attribute — for example, being over 18 — without revealing the full date of birth or the document number. Some schemes use zero-knowledge proofs for this; others use signed lists of individually hashed attributes. Either way, the privacy gain comes from cryptography in the credential itself.

The EU approach

The revised EU framework for electronic identification and trust services, Regulation (EU) 2024/1183 (often called eIDAS 2.0), requires member states to offer European Digital Identity Wallets. The wallets are meant to hold identity data and other attested attributes, such as diplomas or driving licences, and to let people share them selectively.

The framework is technology-neutral. Trust in issuers is managed through trusted lists maintained by member states and through certification of wallets, rather than through a blockchain. In parallel, the European Blockchain Services Infrastructure (EBSI) — a network run by public authorities — has explored how verifiable credentials and registries of trusted issuers can work on a ledger.

Recovery and inclusion

Identity systems must work for people who lose their phone, share a device with relatives, or do not own a smartphone at all. A credential that depends on keys stored on one device needs a recovery route that does not rely on the holder remembering long secrets. For this reason, many schemes keep in-person registration offices and paper alternatives, at least during a long transition, and policy makers stress that digital credentials should remain optional for people who cannot or do not want to use them.

This explainer describes how a technology is used outside finance, for general education. It is not a recommendation to acquire, sell or hold any crypto-asset and is not financial or legal advice.