Skip to content
Start with Identity
Join free
Fundamentals · Beginner

What Is Self-Sovereign Identity (SSI)?

By SWI Community Team · Updated 2026-11-05 · 11 min

Self-sovereign identity (SSI) is a model in which individuals and organizations hold and control their own digital identity and credentials directly, rather than renting that control from platforms, identity providers, or governments. You keep signed credentials in a wallet you control and present them straight to whoever needs to check them, without a central provider in the middle of each transaction. It is the guiding principle behind decentralized identity, and in 2026 it is moving from pilots to population-scale deployment through government wallet programs.

The problem SSI answers

Most digital identity today lives in accounts you do not control. A provider can lock you out, change its terms, see every service you log into, or shut down. Each new service asks you to prove the same facts again, and each copy of your data is another breach waiting to happen. SSI flips the model: an issuer signs a claim about you once, you hold it, and you choose when and to whom to present it. The verifier checks the issuer's signature without contacting the issuer, so the issuer does not learn where you used it.

Where the idea came from

The modern framing comes from Christopher Allen's essay The Path to Self-Sovereign Identity, published on 26 April 2016. Allen describes four stages of online identity:

  1. Centralized: a single authority issues and verifies identity.
  2. Federated: several authorities share identity across sites, but each still holds control. This is the world of SAML and OIDC.
  3. User-centric: the user is at the center, with consent and interoperability, but the registering entities still own the identity.
  4. Self-sovereign: individuals control their own identities across any number of authorities.

The ten principles

Principle What it asks for How current systems deliver it
Existence A person exists independently of their digital identity A design stance, not a feature
Control The user is the final authority over their identity Keys held in the user's wallet
Access Users can retrieve all their own data Credentials stored by the holder
Transparency Systems and algorithms are open Open W3C, OpenID, and IETF standards
Persistence Identity lasts as long as the user wishes Long-lived DIDs; weak in practice if keys are lost
Portability No single party holds the identity Standard formats across wallets
Interoperability Identity works across services and borders OpenID4VC protocols, EU-wide wallet acceptance
Consent Sharing requires deliberate agreement Wallet prompts before each presentation
Minimalization Disclose only what is needed Selective disclosure, zero-knowledge proofs
Protection Individual rights win when they conflict with the network Governance and regulation, the least mature area

In practice these reduce to three demands: the user controls the identity, the identity is portable across providers, and disclosure is minimized to what a transaction needs.

How SSI works in practice

SSI is built from the same components as decentralized identity:

A worked example: proving age without sharing a birth date

  1. A government issuer gives you a person identification credential in your wallet, signed with its key.
  2. A website asks for proof you are over 18 using an OpenID4VP request.
  3. Your wallet shows you exactly what is requested; you consent.
  4. The wallet presents only the "age over 18" claim, using selective disclosure, with a proof that it came from the issuer's credential.
  5. The website verifies the issuer's signature and checks that the credential is not revoked. It never learns your name or birth date, and the issuer never learns which site you visited.

That last property is the practical difference from federated login, where the identity provider is involved in every sign-in. See decentralized vs federated identity and age verification.

Where SSI meets the real world in 2026

Track national schemes in the digital IDs directory.

Is a government wallet self-sovereign?

This is the live debate. State wallets adopt the SSI mechanics (holder-held credentials, direct presentation, selective disclosure), which is a large privacy gain over federated login. But the state certifies the wallet and defines the trust framework, so the individual does not decide which identities exist or which issuers count. A fair summary is that 2026 deployments deliver Allen's control, consent, and minimalization principles much better than his protection and persistence principles. Practitioners should describe them accurately rather than claim full sovereignty.

The honest tradeoffs

  • Recovery. If the keys live on a lost phone, what then? Even large vendors are still working this out: Microsoft's Entra Verified ID FAQ says it is "currently evaluating options" for recovery.
  • Revocation without tracking. Checking whether a credential is revoked can reveal its use. The W3C Bitstring Status List addresses this by hiding each credential among at least 131,072 entries.
  • Verifier adoption. A credential is only useful where it is accepted. Regulation is now forcing that in the EU; elsewhere it depends on network effects.
  • Governance. Someone still decides which issuers are trusted. SSI moves that decision, it does not remove it.

For most enterprises the near-term reality is hybrid: federated identity for existing SSO, verifiable credentials for reusable verification and portable proofs, stitched together by an identity fabric.

Where to start

Read what is decentralized identity for the architecture, the Verifiable Credentials standard for the data model, and the verifiable credentials implementation guide to build. Listen to the verifiable credentials podcast path, and browse the decentralized identity vendor directory to see who is building it.

Frequently asked questions

What is self-sovereign identity?
Self-sovereign identity (SSI) is a model in which individuals own and control their own digital credentials directly, storing them in a wallet and presenting them without asking permission from a central provider or platform.
What is the difference between self-sovereign and decentralized identity?
The terms are used almost interchangeably. Decentralized identity describes the architecture (DIDs, verifiable credentials, no central broker), while self-sovereign identity emphasizes the principle that the individual, not a platform, is in control.
Who invented self-sovereign identity?
The term was popularized by Christopher Allen in his essay The Path to Self-Sovereign Identity, published on 26 April 2016, which set out ten guiding principles that still shape the field.
Does self-sovereign identity require blockchain?
No. Early SSI systems often used a ledger to anchor identifiers, but the core W3C standards do not require one, and many current deployments use ledgerless DID methods such as did:web and did:key.
Is the EU Digital Identity Wallet self-sovereign identity?
Partly. It uses the SSI pattern: the citizen holds credentials in a wallet and presents them directly, with selective disclosure. But the wallet is issued or certified by a member state, and the trust framework is set by regulation, so the state, not the individual, defines which identities exist. It is more accurate to call it user-centric, state-anchored identity than SSI in Allen's full sense.
What standards does SSI use?
The W3C Verifiable Credentials Data Model 2.0 (a Recommendation since 15 May 2025) for credentials, W3C Decentralized Identifiers for identifiers, OpenID for Verifiable Credential Issuance 1.0 and OpenID for Verifiable Presentations 1.0 (both final in 2025) for issuance and presentation, plus formats such as SD-JWT VC and ISO mdoc.
Last reviewed By SWI Community TeamSuggest a correctionHow we research