W3C Decentralized Identifier (DID)

A W3C Decentralized Identifier (DID) is a globally unique, persistent identifier that does not require a centralized registration authority, enabling individuals and organizations to prove control over their digital identity. Defined by the World Wide Web Consortium (W3C), a DID is a URI string composed of three parts: the did: scheme, a method identifier (e.g., ethr, key, ion), and a method-specific identifier. This structure allows DIDs to be resolved to a DID Document, a JSON-LD file containing the cryptographic keys and service endpoints necessary for authentication and interaction.

The core innovation of a DID is its resolution to a verifiable data registry, typically a blockchain or other distributed ledger, which stores the DID Document's current state. This creates a system of self-sovereign identity (SSI) where the subject (the entity identified by the DID) controls their identifier and associated credentials without reliance on a central issuer or provider. Control is proven cryptographically using the public keys listed in the DID Document, enabling secure, peer-to-peer interactions. This is a fundamental shift from traditional, siloed identity models controlled by corporations or governments.

DIDs enable a wide range of verifiable credentials use cases, such as issuing tamper-proof digital driver's licenses, university degrees, or professional certifications. For example, a university could issue a credential to a DID controlled by a graduate, who could then present it to an employer for instant, cryptographically-verified proof of their degree. Other applications include decentralized login systems (DID Auth), secure messaging, and supply chain provenance. The DID method specification defines how a specific blockchain or network creates, resolves, updates, and deactivates DIDs, with popular methods including did:ethr for Ethereum and did:key for simple key pairs.

A W3C Decentralized Identifier (DID) works by separating the identifier itself from the systems that manage and verify it, using a three-part architecture: the DID, the DID Document (DID Doc), and the DID Method. The DID itself is a unique URI (e.g., did:example:123456) that points to its corresponding DID Document. This document, hosted on a verifiable data registry like a blockchain or distributed ledger, contains the cryptographic material (public keys), service endpoints, and verification methods needed to authenticate the DID's controller and interact with them. The DID Method is the technical specification that defines how to create, read, update, and deactivate (CRUD) DIDs and their documents on a specific ledger or network.

The core operational process is DID Resolution. When a relying party (e.g., a website or app) receives a DID, it performs resolution to fetch the current, cryptographically verifiable DID Document. This involves parsing the DID to identify its method (the did:example: part) and using the corresponding method's resolver to query the appropriate verifiable data registry. The resolver retrieves the DID Document, which is typically signed or anchored in the registry, ensuring its integrity. The relying party can then use the public keys and service endpoints in the document to encrypt data for the DID's owner, verify digital signatures, or initiate secure communication channels, all without contacting a central authority.

DID Authentication and Verifiable Credentials are primary use cases enabled by this mechanism. To authenticate, a DID controller signs a challenge with the private key corresponding to a public key listed in their DID Document. The verifier uses the public key from the resolved document to cryptographically verify the signature, proving control of the DID. For Verifiable Credentials, issuers sign credentials with their DID, and holders present proofs derived from those credentials. Verifiers resolve the issuer's DID to obtain their public key and verify the credential's signature, establishing trust based on cryptographic proof rather than a centralized certificate authority.

A DID Document is a JSON-LD or JSON data structure that contains the public keys, authentication protocols, and service endpoints necessary to interact with the entity identified by a Decentralized Identifier (DID). It is the core resource that makes a DID functional, as it provides the mechanism for proving control and enabling trusted interactions. The document is typically resolved by querying the underlying verifiable data registry (like a blockchain) where the DID is anchored, using the DID's unique URI.

The structure of a DID Document is defined by the W3C standard and includes several key sections. The verificationMethod property lists the public keys or other cryptographic material, such as those used for digital signatures. The authentication and assertionMethod properties specify which verification methods are used to prove control of the DID. The service endpoints define how to communicate with the DID subject, enabling connections to decentralized web nodes, credential repositories, or other interactive services.

Control and Updates are fundamental to the DID Document. Only the controller who possesses the corresponding private keys can update the document, for example, to rotate keys or add new services. This update mechanism is governed by the rules of the specific DID method used (e.g., did:ethr, did:key). The document's integrity is protected by the underlying blockchain or decentralized network, ensuring that any changes are verifiable and tamper-evident, which is crucial for maintaining long-term trust.

In practical use, a DID Document enables verifiable credentials and secure interactions. For instance, when a user presents a credential, a verifier resolves the issuer's DID to fetch its DID Document, retrieves the appropriate public key, and cryptographically verifies the signature. This process creates a trust model that does not rely on a central certificate authority. The document's service endpoints can also be used to initiate DIDComm encrypted messaging or discover linked data associated with the identity.