What Is Decentralized Identity?

Decentralized identity, also written decentralised identity, is an approach to digital identity in which identifiers and the credentials bound to them are controlled by their subject rather than issued, stored, and revoked by a central provider. Instead of authenticating through an account at a platform or a government portal, the subject holds cryptographic key material and a set of signed attestations, and presents proofs of those attestations directly to whoever needs them. The design goal is to remove the identity provider from the middle of every transaction, so that no single operator can correlate a person's activity across services or unilaterally cut off access.

The approach draws on public key cryptography, distributed systems, and the older federated identity work behind SAML and OpenID Connect. It differs from federation in where authority sits: federation moves the account to a shared provider, while decentralized identity moves the account to the subject and reduces the provider to a source of verifiable statements. Standardization has been the main practical constraint, since an identifier is only useful if unrelated parties can resolve and verify it.

Decentralized Identifiers

A decentralized identifier, or DID, is a URI that resolves to a document containing public keys, authentication methods, and service endpoints, without depending on a registry operated by any one party. The W3C Decentralized Identifiers specification became a Recommendation in 2022 and defines the syntax, the data model, the resolution process, and the create, read, update, and deactivate operations. Concrete behavior is delegated to DID methods, each of which specifies how identifiers of a given type are anchored and resolved. Methods vary widely: some anchor to a distributed ledger, some derive the identifier deterministically from a public key with no external registry at all, and some resolve through the DNS and web infrastructure a domain owner already controls. That variety is a source of interoperability friction, since a verifier must implement or delegate resolution for every method it accepts.

Verifiable Credentials

Identifiers alone assert nothing about their subject. Claims are carried in verifiable credentials, a data structure in which an issuer signs a set of statements about a subject, and the holder later presents them to a verifier. The W3C Verifiable Credentials specifications define the data model, the securing mechanisms, and the query protocols that connect the three roles. The important property is that verification is performed against the issuer's public key rather than by calling the issuer, so the issuer does not learn where or when a credential is used. Cryptographic techniques including selective disclosure signatures and zero-knowledge proofs allow a holder to reveal a derived fact, such as being over an age threshold, without disclosing the underlying date of birth.

Assurance, Key Management, and Governance

Decentralization moves risk rather than removing it. If a subject loses their private key, there is no help desk to restore the account, which is why recovery designs use social recovery, threshold schemes, or hardware-backed enclaves. Verifiers still need to decide which issuers to trust, so governance frameworks and trust registries reintroduce a coordination layer, though a narrower one. Identity proofing and authentication assurance remain separate problems, addressed by frameworks such as the NIST Digital Identity Guidelines, whose fourth revision was finalized in 2025 and defines graded assurance levels that a credential ecosystem must map onto regardless of how identifiers are anchored.

Applications

Decentralized identity has applications in a range of fields, including:

• Digital government identity and mobile driver's licenses
• Academic and professional credential verification
• Healthcare records access and patient consent management
• Financial onboarding and reusable know-your-customer checks
• Supply chain attestation for goods and organizations
• Device and machine identity in industrial networks