Verifiable credentials: practical uses

A paper diploma can be forged, and checking whether it is genuine usually takes an email or a phone call to the institution. A verifiable credential solves this problem differently: it is a set of claims about someone, digitally signed by whoever made them, that anyone can check with cryptography.

This article covers the practical use of these credentials: the roles involved, what verification guarantees, how revocation and selective disclosure work and where they already exist. The basic concepts (decentralized identifiers, wallets and control) are in decentralized identity: concepts and applications.

Three roles: issuer, holder and verifier

The reference standard is the verifiable credentials data model from the W3C, the consortium that standardizes the web, in version 2.0, an official recommendation since May 2025 (W3C, VC Data Model 2.0). It defines a verifiable credential as a “tamper-evident” credential whose authorship can be cryptographically verified. The roles are:

• Issuer: who makes the claims and signs the credential. A university, a motor vehicle agency, an employer.
• Holder: who keeps the credential, usually in a digital wallet, and presents it when needed.
• Verifier: who receives the credential and checks the signature before accepting it.
• Subject: the person or thing the claims are about.

The holder is usually the subject, but not always. The standard allows someone to carry a credential about another person. There is also the verifiable data registry, where public keys, schemas and revocation lists are kept.

When the holder hands one or more credentials to a verifier, the package is called a verifiable presentation. The practical point is that the verifier does not need to call the issuer: it simply checks the signature against the issuer’s public key.

What verification proves and what it does not

Here lies the most common misunderstanding. The W3C itself warns that the verifiability of a credential “does not imply the truth” of the claims it contains (W3C, VC Data Model 2.0).

Verification proves two things:

• who signed the credential;
• that it was not altered after being signed.

It does not prove that the issuer checked the facts properly, that the issuer is trustworthy or that the credential is suitable for your case. Those decisions belong to the verifier, according to its own business rules. It is the same limit as any digital record: wrong data that is properly signed is still wrong, as discussed in blockchain against record fraud.

Validity, revocation and suspension

Credentials change status: a driver’s license is suspended, an employment relationship ends. The model handles this in two layers.

Validity over time. The validFrom and validUntil properties indicate from when and until when the credential is valid. Without them, it is assumed to be valid from issuance.

Current status. To revoke or suspend, the W3C published the Bitstring Status List standard in May 2025 (W3C). It works like this:

• the issuer publishes a long sequence of bits, and each credential points to a position in it;
• bit 0 means no restriction; bit 1 means the status (revoked or suspended) applies;
• revocation is permanent; suspension can be undone;
• the verifier downloads the whole list and reads only that credential’s position.

The design protects privacy. Because the verifier downloads the whole list, the issuer does not know which credential is being checked. That is why the standard sets a minimum size of 131,072 positions: small lists make it easier to identify someone. The data model goes further and prohibits status mechanisms that make the verifier “phone home”, notifying the issuer each time the credential is used (W3C, VC Data Model 2.0).

Another strategy is to use short-lived credentials, reissued frequently. The technical framework for the European wallet provides for this kind of “typically very short” validity for some credentials (EUDI Wallet, ARF).

Selective disclosure: showing only what is needed

To enter an 18+ event, you do not need to show your name, address and document number. Selective disclosure is the holder’s ability to choose exactly which data to share.

One standardized technique is SD-JWT, published by the IETF as RFC 9901 in November 2025 (RFC 9901). Broadly speaking:

• the issuer replaces each piece of data with a cryptographic digest (hash) mixed with a random value and signs the set;
• the holder receives the plain data separately;
• when presenting, the holder sends only the data they want to reveal, and the verifier checks that it matches the signed digests.

The technique has a limit, and the RFC itself describes it. Because the same issuer signature appears in every presentation, verifiers who combine information with one another, or with the issuer, may notice it is the same credential, whatever data is revealed. One mitigation is to issue a batch of identical credentials, each used once, which makes linking across verifiers harder, but not between verifier and issuer. Zero-knowledge proof techniques, which prove a fact without revealing the data, are provided for in the W3C standard as a way to go further.

Selective disclosure ties in with the LGPD (Brazil’s General Data Protection Law), which has necessity as a principle: process only the minimum needed for the purpose (Law 13,709/2018). A verifier that asks for everything when it needs only one piece of data is still subject to that rule.

Documented real-world cases

European identity wallet. eIDAS 2 (EU Regulation 2024/1183) requires European Union countries to offer wallets that allow selective disclosure and requires public services to accept these wallets when they ask for electronic identification. Private companies required to use strong authentication, except micro and small enterprises, and very large online platforms will also have to accept them at the user’s request (EUR-Lex). The technical framework defines the formats: wallets must support the ISO/IEC 18013-5 standard (the one for mobile driving licenses) and SD-JWT VC; the W3C model is optional and limited to some types of attestation (EUDI Wallet, ARF).

Learning certificates in Europe. Europass’s European Digital Credentials are diplomas, micro-credentials and certificates of participation issued with a mandatory electronic seal and checked automatically every time they are viewed. The data model aligns with the W3C verifiable credentials standards (Europass).

Digital diploma in Brazil. MEC (Ministry of Education) Ordinance 554/2019 defined the digital undergraduate diploma as an XML file signed with an ICP-Brasil certificate (Brazil’s public key infrastructure) and a timestamp, accessible through a validation code and a QR code. The image of the diploma “does not replace” the signed XML (MEC Ordinance 554/2019). It does not follow the W3C standard, but it has the same logic: an issuer that signs, a holder that keeps, a verifier that checks.

National Identity Card. Decree 10,977/2022 provides for the digital version of Brazil’s identity card and a QR code for querying and verifying the data (Decree 10,977/2022).

Signature validation. Validar, a service of the ITI (Brazil’s National Institute of Information Technology), checks ICP-Brasil and gov.br signatures and reports who signed and whether the document was altered, without storing the uploaded file (ITI). It is not a verifiable credential in the W3C sense, but it plays the role of verifier for signed documents.

Before adopting: practical questions

If you are considering issuing or accepting verifiable credentials, in the newsroom’s assessment it is worth answering:

• Which issuers to trust? The signature only matters if you know whose key it is and whether that issuer is reputable.
• How do you know whether it was revoked? Define the status mechanism and what to do when the list is unavailable.
• Which format? Choose based on the partners you need to exchange data with; in Europe, the mandatory formats are already defined.
• What do you really need to know? Ask only for the necessary data and prefer presentations with selective disclosure.
• What if the holder loses the wallet? Plan for reissuance and revocation of the old credentials.

Key takeaways

• A verifiable credential is a signed claim: anyone can check who issued it and whether it was altered.
• Verifying is not the same as trusting the content; the final decision belongs to the verifier.
• Well-designed revocation does not notify the issuer on every use, and selective disclosure limits what you hand over.
• Europe has already set formats and acceptance obligations; in Brazil, the digital diploma and digital identity use the same logic with ICP-Brasil signatures and QR codes.