What Is Decentralized Identity?

Decentralized identity is a model where individuals and organizations hold their own verifiable credentials in a digital wallet and present them directly to whoever needs to check them, without a central identity provider brokering every interaction. It is often called self-sovereign identity (SSI) because the holder, not a platform, controls the credential.

Where it stands as of November 2026: the core standards are finished (OpenID4VCI 1.0, OpenID4VP 1.0 and HAIP 1.0 are Final, W3C VC 2.0 is a Recommendation, SD-JWT is RFC 9901), and EU member states must offer a digital identity wallet by the end of 2026. Decentralized identity is production-ready for government ID, mobile driver's licenses and reusable KYC; it is not a replacement for enterprise SSO.

This is a shift away from the federated model most workforce and consumer login runs on today, where an identity provider authenticates you and vouches for you to each application.

The three roles: issuer, holder, verifier

Every decentralized identity interaction has the same three parties, known as the trust triangle:

• Issuer signs and gives out a credential (a university issues a degree, a government issues an ID, an employer issues a proof of employment).
• Holder stores the credential in a wallet and decides when and to whom to present it.
• Verifier receives a presentation and checks the signature, the issuer, and the status, without needing to call the issuer in real time.

Because the credential is cryptographically signed, the verifier trusts the math and the issuer's public key rather than a live connection to the issuer. See issuer, holder, verifier for the model in detail.

The building blocks and their status

Each row links to a standards page with the primary sources. In short: Decentralized Identifiers are identifiers the subject controls, resolvable to a DID document of public keys. Verifiable Credentials are tamper-evident signed claims. OpenID for Verifiable Credentials moves credentials between issuers, wallets and verifiers over OAuth 2.0, and HAIP narrows it to one interoperable set of choices: SD-JWT VC or mdoc, ES256 signatures and DCQL queries.

One practical consequence: the two largest deployments, the EU wallet and US mobile driver's licenses, anchor trust in X.509 certificate chains and trusted lists, not DIDs. If you need EU interoperability, plan for X.509 alongside DIDs.

Privacy: selective disclosure and zero-knowledge proofs

Holders can reveal the minimum needed. With selective disclosure and SD-JWT, the issuer signs digests of each claim and the holder reveals only the claims a verifier asks for, so you can prove you are over 18 without showing your birth date. Zero-knowledge proofs and BBS signatures go further and make repeated presentations unlinkable; the W3C BBS cryptosuite is still a Candidate Recommendation. The EU framework handles unlinkability differently, by issuing batches of single-use credentials.

Is decentralized identity blockchain-based?

Not necessarily. "Blockchain-based identity" is one branch of the field, not its definition.

• Ledger-anchored: Hyperledger Indy runs a ledger for DIDs and pioneered AnonCreds zero-knowledge credentials. Dock anchors credentials to a blockchain and in 2025 merged its token and network into cheqd. cheqd adds payment rails and trust registries on its network. Privado ID (formerly Polygon ID) and Civic serve Web3 and on-chain apps.
• Ledger-free: did:web uses ordinary domains and TLS, and the EUDI Wallet and mDL use certificate chains. DID methods compared covers the trade-offs.

For regulated enterprise buyers, a token or ledger dependency is a procurement question in its own right; most production deployments in 2026 do not need one.

Where it is being used

• Government and cross-border ID: under eIDAS 2.0 (Regulation (EU) 2024/1183), every member state must offer an EUDI Wallet by the end of 2026, and public authorities must accept it. The technical framework is the Architecture and Reference Framework, at v3.0.0 since 23 July 2026. Regulated private relying parties such as banks must accept the wallet on user request within 36 months of the December 2024 implementing acts.
• Mobile driver's licenses: mDLs (ISO/IEC 18013-5) are issued by individual US states, and Google's developer documentation says Google Wallet accepts mdoc IDs online over OpenID4VP 1.0. See digital IDs by country.
• Reusable identity verification and KYC: verify once, reuse the credential, instead of repeating document checks. See reusable identity and KYC and the identity verification market.
• Workforce: Microsoft Entra Verified ID made Entra account recovery with Verified ID generally available in May 2026, replacing helpdesk identity checks with a credential presentation.

Decentralized vs federated identity

The two will coexist: expect identity fabrics to bridge federated and decentralized credentials. See decentralized vs federated identity.

Where to start

Read what is self-sovereign identity for the philosophy and history and decentralized identity explained for formats, trust and a pilot plan. Compare tools in top decentralized identity platforms and the decentralized identity vendor directory. When you are ready to choose, see best decentralized identity platforms, decentralized identity for enterprises or decentralized identity for KYC.