Decentralized Identifier (DID)

A decentralized identifier (DID) is a globally unique identifier that a person, organization, device or software agent can create and control on its own, using cryptographic keys rather than an account issued by a company or government. A DID is a text string such as did:example:123456 that points to a small DID document listing the public keys and service addresses associated with it. Whoever holds the matching private key can prove control of the identifier. The format is defined by the World Wide Web Consortium (W3C), whose Decentralized Identifiers specification became an official recommendation in July 2022.

DIDs are a building block of what is often called self-sovereign identity, in which people hold their own credentials in a wallet and share them selectively. They are usually paired with verifiable credentials, digitally signed statements such as "this person is over 18" or "this company passed identity checks". DIDs can be recorded on a blockchain, but they do not have to be: the standard allows many storage methods. They sit within the wider field of digital identity and differ from federated identity management, where a large provider vouches for users at each login.

Today most online identities are borrowed. An email address belongs to an email company, a social login belongs to a social network, and a bank login belongs to the bank. If the company closes the account, the identity disappears with it. A DID is more like owning a padlock and the only key: anyone can see the padlock and check that the person in front of them holds the key, but no outside company issued it or can take it away.

On its own a DID says nothing about who someone is. It becomes useful when trusted parties attach signed statements to it, the way a passport office stamps a passport. The owner keeps those statements in a digital wallet and shows only what is needed, for example proof of age without a full date of birth.

A DID has three parts: the prefix did, a method name and a method-specific identifier. The method defines how the identifier is created, where its document is stored and how it can be updated or deactivated. When a verifier encounters a DID, software called a resolver uses the method's rules to fetch the DID document. The verifier then checks a signature made with a key listed in that document. Because the keys can be rotated and the document updated, the owner can recover from a lost or compromised key without changing the identifier itself, a practice related to cryptographic key rotation.

• Ledger-based methods. Some methods anchor DIDs on a public blockchain, such as Ethereum or Bitcoin, so that changes to the DID document are recorded in a tamper-resistant public ledger.
• Web-based methods. The did:web method stores the document on an ordinary website controlled by the owner, trading some decentralization for simplicity.
• Key-based methods. The did:key method derives the identifier directly from a public key and needs no registry at all, though it cannot be updated.
• Peer methods. Some methods create identifiers shared only between two parties, which limits tracking across different relationships.

Dozens of methods have been registered with the W3C community, and they vary widely in maturity and adoption.

In financial services, DIDs and verifiable credentials are being explored as a way to make know-your-customer checks reusable: a customer verified by one regulated firm could present a signed credential to another firm instead of repeating the whole process, reducing cost and duplicated data. Credentials can also carry business attributes, linking to work on the Legal Entity Identifier for companies. In crypto, DIDs are used to tie wallets to reputations or attestations, and they are often discussed alongside zero-knowledge proofs, which let a holder prove a fact about a credential without revealing the underlying data. Outside finance, governments, universities and supply-chain projects have piloted DIDs for diplomas, licences and product records. Readable blockchain names such as those from the Ethereum Name Service are related but are naming systems rather than DIDs in the W3C sense.

DIDs solve the question of who controls an identifier, but not whether the information attached to it is true; that still depends on trusted issuers. Losing a private key without a recovery plan can mean losing control of the identity, which is a heavy burden for ordinary users. The large number of methods hampers interoperability, and some methods depend on a single website or company, undermining the decentralized label. Writing personal data to a blockchain would conflict with privacy rules such as the General Data Protection Regulation, so well-designed systems keep personal data off-chain. Adoption by regulated institutions has been slow, and identity fraud risks such as synthetic identity fraud do not disappear simply because credentials are digital.

• W3C: Decentralized Identifiers (DIDs) v1.0