Decentralized identity is a model of digital identity in which individuals and organizations control their own identifiers and credentials, store them in a wallet they hold, and present cryptographically verifiable proofs directly to the parties that need them, without a central identity provider brokering every interaction. It is also called self-sovereign identity when the emphasis is on user control.
In digital identity and privacy, the model matters because it changes the data flow. Instead of a login provider observing every site a person visits, the issuer signs a credential once, the holder keeps it, and the verifier checks the signature independently, which reduces tracking and allows people to disclose only what a transaction requires.
How decentralized identity works
The model rests on the trust triangle of issuer, holder and verifier. A university, government agency or bank issues a verifiable credential, a digitally signed set of claims about the holder. The holder stores it in a digital wallet and later presents it, or a proof derived from it, to a verifier.
The verifier checks three things: that the issuer’s signature is valid, that the credential has not been revoked or expired, and that the presenter is the legitimate holder, usually through a key held in the wallet. The issuer does not need to be online and does not learn where the credential is used.
| Element | Function | Typical implementation |
|---|---|---|
| Issuer | Signs claims about a subject | Government, university, employer, bank |
| Holder | Stores credentials and creates presentations | Mobile identity wallet |
| Verifier | Checks proofs and decides | Website, border control, employer |
| Decentralized identifier (DID) | Resolvable identifier linked to public keys | W3C DID methods |
| Verifiable data registry | Publishes keys, schemas and revocation status | Ledger, web domain or trusted list |
Standards and credential formats
Interoperability depends on shared standards. The W3C Verifiable Credentials Data Model defines the structure of credentials, and W3C Decentralized Identifiers define identifiers that resolve to key material without a central registry. Exchange protocols such as OpenID for Verifiable Credentials connect wallets to issuers and verifiers.
| Format | Selective disclosure method | Typical context |
|---|---|---|
| SD-JWT VC | Salted hashes of individual claims | European digital identity wallet ecosystem |
| ISO mDL (ISO/IEC 18013-5) | Per-element digests in a signed object | Mobile driving licenses |
| JSON-LD with BBS signatures | Zero-knowledge derived proofs | Research and advanced deployments |
| JWT VC | None; whole credential disclosed | Simple early implementations |
In Europe, the revised eIDAS regulation requires member states to offer a European Digital Identity Wallet, which has made decentralized identity a regulatory infrastructure topic rather than only a research field.
Decentralized identity compared with federated and centralized models
Digital identity has evolved through three architectures. The key differences are who stores the identity data, who is involved in each authentication, and how much the intermediaries can observe.
| Model | Data location | Intermediary sees each login | Main privacy risk |
|---|---|---|---|
| Centralized | Each service keeps its own accounts | Not applicable | Many password databases to breach |
| Federated | Identity provider | Yes | Provider can profile usage across services |
| Decentralized | Holder’s wallet | No, in the basic flow | Correlation by verifiers if identifiers are reused |
Selective disclosure is the privacy feature that most clearly separates the decentralized model. A holder can prove “over 18” or a nationality without revealing the full birth date, name or address, which applies the data minimization principle at the moment of collection.
Design choices for privacy-preserving deployments
Decentralization alone does not guarantee privacy. The deployment must avoid correlation handles, values that appear unchanged in every presentation and let verifiers link a person’s activity.
| Design decision | Privacy-preserving choice | Reason |
|---|---|---|
| Holder identifiers | Pairwise or ephemeral identifiers per verifier | Prevents cross-verifier linking |
| Signatures | Batch-issued or unlinkable credentials | A reused signature is itself an identifier |
| Revocation | Status lists covering many credentials | Issuer does not learn which one was checked |
| Personal data on ledgers | Never write it to a public ledger | Ledger entries cannot be erased |
| Verifier requests | Registered, purpose-bound attribute requests | Limits over-asking |
Limitations and open risks
The model shifts responsibility to the holder and introduces risks that centralized systems handle differently. Practitioners should weigh these before treating decentralization as an automatic privacy gain.
- Key loss and recovery: losing the wallet device can mean losing credentials unless secure recovery exists.
- Over-identification: easy, high-assurance credentials may encourage services to ask for identity where none is needed.
- Wallet trust: the wallet application becomes a powerful component that must be certified and secured.
- Governance complexity: trust frameworks must define which issuers are accepted and for what.
- Exclusion: people without suitable phones need equivalent alternatives.
Explained without jargon
Decentralized identity puts your digital ID cards in your own wallet on your phone, instead of having a big company log you in everywhere. A trusted organization, such as a university, gives you a digital certificate once, and you show it whenever you choose.
It is like showing a bouncer a card that says only “over 18” instead of handing over your whole driver’s license. The bouncer can check the card is genuine, and the issuer never finds out which bar you visited. The key takeaway is more control and less sharing by default.
A typical use case
A graduate applies for a job abroad. Traditionally, the employer would email the university, wait days for confirmation and receive a full transcript containing more data than necessary.
With decentralized identity, the university has already issued a signed diploma credential to the graduate’s wallet. During the online application, the employer’s system requests proof of the degree title and graduation year. The graduate approves the request, the wallet sends only those two claims with a proof of holder binding, and the employer verifies the university’s signature against a trusted issuer list in seconds.
The employer gets reliable verification without contacting the university, and the university never learns which employer checked the diploma.