What is a verifiable credential?
- Author
- CRYPTO PORT Editorial
- Published
- Updated
- Reading time
- 5 min
In short
A verifiable credential is a digitally signed statement whose authenticity a recipient can check without contacting the issuer — think diplomas or professional licences. The signature proves only that the issuer really issued it; whether the contents are true still rests on the issuer's reliability.
Key points
- Signed by the issuer and checkable without contacting them
- Held by the subject, who chooses where to present it
- Selective disclosure can reveal only the needed fields
- Truth of the contents still depends on the issuer
Definition
A credential whose contents are digitally signed by the issuer. A recipient verifies the signature with the issuer's public key to confirm both the origin and that nothing was altered. The format is specified by the W3C.
A paper certificate signalled authenticity with a seal or a watermark. A digital credential is signed by the issuer instead. The recipient simply verifies the signature with the issuer's public key — no callback to the issuer, and no dependency on the issuer being online.
Because the subject holds it, they choose who sees it. Some schemes support selective disclosure, proving a fact such as 'over eighteen' without revealing the date of birth itself. Minimising what is handed over is the point of the design.
Revocation is where implementations diverge. Verifiers need to learn when a licence is withdrawn or an expiry changes, so some publish revocation lists while others issue short-lived credentials that are reissued often. Each trades operational burden against how quickly revocation takes effect.
Watch out for
- · A valid signature says nothing about whether the claim itself is true
- · Without a revocation channel, a withdrawn credential can still look valid
- · Putting the credential itself on-chain leaves personal data that cannot be erased