Self-sovereign identitySSI

A model where people, not companies, hold their own identity data.

Instead of every service keeping its own copy of a person's details, the person keeps their verified credentials in a wallet on their own device and chooses what to share, and with whom.

Decentralized identity architecture in which subjects control their identifiers and credentials without a central registry. An identifier is a name or ID that points to a person, and a decentralized identifier (DID) is a format for identifiers, standardized by the World Wide Web Consortium (W3C), that a person controls without relying on one central authority.

Self-sovereign identity rests on a few ideas:

• User control, meaning the person holds their credentials and decides when to present them.
• Portability, meaning the same credentials work across many services.
• Minimal disclosure, meaning the person shares only the detail a service needs, such as proof of age instead of a birth date.
• Verifiable trust, meaning each credential carries an issuer's cryptographic signature that a verifier can check.

The model uses three roles: an issuer creates and signs a credential, a holder stores it and chooses when to share it, and a verifier checks the signature.

Self-sovereign identity sits next to terms that are easy to mix up:

• Digital identity wallet is the app that holds credentials, while self-sovereign identity is the model behind it.
• Verifiable credential (VC) is the signed digital document, and it is one building block of the model.
• Federated login, such as signing in with an existing account from a large company, keeps the identity with that company, while self-sovereign identity keeps it with the person.