did:ethr vs did:key: On-Chain vs Off-Chain DIDs

did:ethr excels at providing globally verifiable, censorship-resistant identity anchored to a public blockchain like Ethereum or Polygon. Its on-chain registry of public keys and service endpoints ensures any entity can resolve a DID without relying on a centralized service. For example, the Ethereum Name Service (ENS) leverages this model, enabling over 2.2 million .eth names to serve as human-readable DIDs with cryptographic proofs recorded on-chain, though this incurs gas fees for registration and updates.

did:key takes a fundamentally different approach by generating DIDs entirely off-chain. The DID and its associated public key material are derived from a single cryptographic key pair, requiring no registry or blockchain transaction. This results in a critical trade-off: while it offers zero-cost, instant creation and is perfect for ephemeral or private interactions (e.g., within the W3C Verifiable Credentials ecosystem), a did:key cannot be updated or revoked once shared, limiting its long-term utility for persistent identities.

The key trade-off: If your priority is permanent, globally resolvable identity with lifecycle management (revocation, key rotation) for users or assets, choose did:ethr. If you prioritize cost-free, immediate issuance for short-lived credentials or peer-to-peer sessions where the issuer and verifier are known, choose did:key.

did:ethr excels at providing a globally verifiable, censorship-resistant identity anchored to a public blockchain. Because its DID Document is stored on-chain (e.g., Ethereum, Polygon, or other EVM chains), any verifier can independently resolve and verify credentials without relying on the issuer's server. This is critical for high-stakes, long-lived credentials like academic degrees or professional licenses. For example, leveraging Ethereum's ~99.9% uptime and the security of its ~1 million validators provides a robust, decentralized root of trust, though this comes with variable gas fees for document updates.

did:key takes a fundamentally different approach by embedding the cryptographic key material directly into the DID identifier itself. This results in a completely off-chain, self-contained, and portable identity. The key trade-off is that while it offers zero operational costs, instant creation, and perfect privacy (no public registry), it lacks a discoverable public record and requires direct, point-to-point exchange of the DID string. It is ideal for ephemeral sessions, peer-to-peer messaging in apps like WalletConnect, or as a lightweight component within a larger did:ethr or W3C Verifiable Credentials ecosystem.

The key architectural choice hinges on your need for a persistent public registry versus operational simplicity and cost. Choose did:ethr if your priority is sovereign, globally-resolvable identity for applications like decentralized finance (DeFi) KYC, NFT-gated communities, or enterprise supply chain credentials where public verifiability and non-repudiation are paramount. Opt for did:key when you prioritize speed, zero cost, and maximum privacy for temporary interactions, device pairing, or as a secondary authentication factor within a user-controlled wallet.