Decentralized identity: concepts and applications

Today, proving who you are on the internet almost always goes through an intermediary. You create an account for each service or sign in with a large platform’s login, and that platform keeps the record, decides whether the account stays active and sees where you use it.

Decentralized identity is a set of standards that tries to reverse this logic: the identifier and the proofs about you stay under your control, in a digital wallet, and you decide what to show each service. This article explains the core concepts (DIDs, documents, wallets), who controls what and where the limits are. The practical use of the proofs themselves, verifiable credentials, is covered in a separate article: verifiable credentials: practical uses.

The problem it tries to solve

The two most common digital identity models are:

• Separate accounts. Each site stores your username and password. You accumulate dozens of accounts, and each one is a potential leak point.
• Federated identity. An identity provider (such as a corporate or government login) confirms who you are to other services. It is more convenient, but the provider sits in the middle of every access.

The digital identity guidelines of NIST, the U.S. standards institute, revised in version SP 800-63-4, published in July 2025 (NIST), already address a third arrangement. In the federation volume, NIST describes the user-controlled wallet, software on the person’s own device, which receives signed “attribute bundles” from the issuer and presents them to services, cites the digital driver’s license as an example and allows the service to accept these proofs even without a direct agreement with the issuer (NIST SP 800-63C-4).

It is this third arrangement that decentralized identity organizes with open standards.

What a DID is

A DID (decentralized identifier) is defined by the W3C, the consortium that develops web standards, as a globally unique, persistent identifier that “does not require a centralized registration authority” (W3C, DID v1.0). It takes the form of an address that starts with did:, followed by the name of a method and a code. The standard’s own examples use did:example:123456789abcdefghi.

Around the identifier there are a few roles and components:

• DID subject: the entity being identified. It can be a person, a company, a device or anything else.
• DID controller: whoever has the ability to change the document associated with the DID. It can be the subject itself or someone else, and there can be more than one.
• DID document: a set of data that describes the subject, mainly the public keys used to prove control of the identifier and, if any, service endpoints.
• DID method: the rule that defines how that type of DID is created, resolved, updated and deactivated.
• Resolver: the software that takes a DID and returns the corresponding document.

In practice, proving that you own a DID means proving that you have the private key corresponding to one of the public keys in the document. It is the same digital signature principle used in cryptocurrency wallets, explained in custodial and non-custodial wallets.

Version 1.0 has been an official W3C recommendation since July 2022. A version 1.1 was at the candidate recommendation stage in March 2026, which means the standard is still being refined (W3C, DID v1.1).

Does it need blockchain?

Not necessarily. The standard expressly says it does not presuppose any specific technology. DID documents are stored in what the W3C calls a verifiable data registry, and the examples cited include distributed ledgers (blockchains), decentralized file systems, databases and peer-to-peer networks. According to the text itself, many methods use blockchain, but not all (W3C, DID v1.0).

The choice of registry changes whom you need to trust. In a public network, no one alone decides who participates; in a private network, a consortium decides. The differences are covered in public versus private blockchain. In every case, someone maintains the software and the rules of the method.

Digital identity wallets

A digital identity wallet is the app that stores your keys and the proofs issued about you, such as an ID card, a diploma or a driver’s license. When you use it, the wallet presents only what the service asks for.

The most advanced regulatory example is the European Union’s. Regulation (EU) 2024/1183, known as eIDAS 2, requires each member state to offer at least one European Digital Identity Wallet. Among the rules in the text (EUR-Lex):

• use is voluntary, and those who do not use it must not be disadvantaged (Art. 5a(15));
• issuance, use and revocation are free of charge for natural persons (Art. 5a(13));
• the wallet must allow selective disclosure of data (Art. 5a(4));
• the source code of the app’s components must be open source, with limited exceptions (recital 33);
• the wallet provider must not see the details of the user’s transactions, except in cases with consent (recital 32).

The legal deadline is 24 months from the Commission’s implementing acts (Art. 5a(1)). According to the European Commission, the wallets are due to launch at the end of 2026 (European Commission). Worth noting: the European model uses user-controlled wallets and credentials, but the underlying identity is still issued by the state.

Who is really in control

“You are in control” is the central promise, and it comes with conditions.

• Whoever holds the key is in control. The W3C standard notes that control of a DID can be transferred simply by handing over the secret key material, and that a compromised key cannot be detected by cryptography alone (W3C, DID v1.0). Losing the key without a recovery plan can mean losing the identifier. The precautions resemble those for protecting your seed phrase.
• Whoever issues the proof decides about it. You hold the credential, but whoever issued it (government, university, bank) can still revoke it. Decentralizing the identifier does not decentralize the authority that attests to the facts.
• Whoever accepts it sets the rules. Each service chooses which issuers and methods it trusts. Without that acceptance, the wallet is useless.
• Whoever maintains the method defines how it works. The creation and update rules for each type of DID are written by someone, and governance varies widely between methods.

Privacy: correlation and personal data

A globally unique identifier is also an excellent tracker. The W3C recognizes this risk and recommends three precautions (W3C, DID v1.0):

• No personal data in the public DID document. This is “critical” when the registry is public and permanent; personal data should travel through credentials or channels controlled by the data subject.
• Pairwise DIDs: a different identifier for each service, which works as a pseudonym and makes cross-referencing harder.
• Avoid reusing keys and service endpoints across DIDs, because that allows linking identifiers that should be separate.

In Brazil, this concern connects with the LGPD (Brazil’s data protection law). The law classifies biometric data linked to a person as sensitive personal data and has necessity as a principle: process only the minimum needed for the purpose (Law 13,709/2018). Recording personal data in a registry that no one can erase clashes directly with the right to request deletion of that data.

And in Brazil

Brazil does not yet have a rule on DIDs, but it already has an official digital identity. Decree 10,977/2022 created the Carteira de Identidade Nacional (National Identity Card), which uses the CPF (Brazil’s individual taxpayer number) as its single number and is also issued in digital format, generated after the physical document is delivered and integrated with the Citizen Identification Service (Decree 10,977/2022). The document has a QR code for checking and verifying its data.

It is a centralized model: the state issues the document, maintains the database and provides verification. It solves part of the same problem (proving identity without paper), but it does not give citizens their own identifier, independent of the issuer. How these models might coexist is an open question; the editorial team did not find any Brazilian rule addressing DIDs.

Applications and limits

The uses most cited in the standards themselves are:

• Signing in to services without a password, by proving control of a DID with a signature.
• Proving an attribute (age, education, professional affiliation) without handing over the entire document, using verifiable credentials (W3C, VC Data Model 2.0).
• Identifying organizations and devices, since the subject of a DID does not need to be a person.

The limits, in the editorial team’s assessment, are as important as the uses:

• Evolving standards. There are many DID methods and competing formats; interoperability depends on common profiles, such as those the European Union is setting.
• Account recovery. Without an intermediary, losing your phone and keys is a serious problem that needs a solution designed from the start.
• Adoption. A wallet only has value if trusted issuers issue credentials and services accept them.
• Scams. An app that poses as an official wallet can steal keys and data, as happens with phishing targeting digital wallets.

Key takeaways

• A DID is an identifier without a central registry; control rests with whoever holds the private key.
• Blockchain is one registry option, not a requirement.
• The wallet stores proofs, but issuers still decide about them, and verifiers choose whom to trust.
• Privacy requires care: no personal data in public registries and different identifiers for each relationship.
• The European Union already requires identity wallets, with launch expected at the end of 2026; Brazil has an official digital identity, but it is centralized.