Self-Sovereign Identity (SSI)

What Is Self-Sovereign Identity?

Self-sovereign identity (SSI) is a model for managing digital identities in which individuals have sole ownership over their personal data and full control over how it is shared. Rather than depending on a government database, a corporation, or a social media platform to store and validate identity, users hold cryptographically signed credentials in a digital wallet on their own device. They can present these credentials to any verifier without an intermediary being involved.

The concept was formalized by Christopher Allen in his April 2016 essay "The Path to Self-Sovereign Identity," which defined ten guiding principles: existence, control, access, transparency, persistence, portability, interoperability, consent, minimization, and protection. These principles parallel the ethos of self-custody in cryptocurrency: just as Bitcoin lets you hold your own money without a bank, SSI lets you hold your own identity without a central authority.

SSI represents an evolution in how digital identity works. Earlier models placed all control in the hands of institutions (centralized identity) or a small set of tech companies (federated identity). SSI shifts that power to the individual, aligning identity management with the broader movement toward decentralized systems.

How It Works

SSI operates through a trust triangle involving three distinct roles: issuers, holders, and verifiers. A decentralized data registry (often a blockchain) serves as the shared trust anchor where identifiers and credential metadata are recorded.

The Trust Triangle

1. Issuer: an authority that creates and signs a verifiable credential. This could be a university issuing a diploma, a government issuing a driver's license, or a bank issuing a KYC attestation.
2. Holder: the individual who receives the credential, stores it in their identity wallet, and decides when and with whom to share it.
3. Verifier: any party that needs to confirm a claim. The verifier checks the credential's digital signature against the issuer's public DID without contacting the issuer directly.

The Three Pillars

Three technical components make this trust triangle function:

• Decentralized Identifiers (DIDs): globally unique identifiers that the user creates and controls. Unlike an email address issued by Gmail or a username assigned by a platform, a DID is anchored to a decentralized network and does not depend on any single organization. The W3C DID Core specification defines the syntax, data model, and resolution process.
• Verifiable Credentials (VCs): digital equivalents of physical documents like passports, diplomas, or professional licenses. Each credential is cryptographically signed by its issuer, making it tamper-evident and independently verifiable. The W3C Verifiable Credentials Data Model 2.0 standardizes their format and verification process.
• Credential Wallets: software applications where users store and manage their credentials. When a service requests proof of identity, the wallet lets the user select which credentials to present and what specific data to disclose.

A Typical SSI Flow

1. The user creates a DID using their wallet software
2. An issuer (university, employer, government) verifies the user's identity through existing processes
3. The issuer creates a verifiable credential, signs it with their own DID, and sends it to the user's wallet
4. The user stores the credential locally on their device
5. When a verifier requests proof (age, qualification, KYC status), the user presents the relevant credential from their wallet
6. The verifier checks the credential's signature against the issuer's DID on the registry, confirming authenticity without contacting the issuer

Selective Disclosure

One of SSI's most powerful features is selective disclosure. Using techniques like zero-knowledge proofs, a user can prove a specific claim without revealing the underlying data. For example, you can prove you are over 21 without disclosing your actual date of birth, or prove you hold a valid professional license without revealing your home address listed on that license.

SSI vs. Other Identity Models

Digital identity has evolved through three major paradigms, each shifting who controls the identity data:

Federated identity solved the problem of managing dozens of passwords but introduced new ones: Google knows every service you use, and if Google disables your account, you lose access to everything. SSI eliminates both the password problem and the surveillance problem by removing the intermediary entirely.

Use Cases

KYC Portability

Financial institutions spend heavily on KYC (Know Your Customer) verification, and customers repeat the same identity checks for every new service. With SSI, a user completes KYC once, receives a verifiable credential from the verifying institution, and presents that credential to new services instantly. The new service can verify the credential's authenticity without repeating the full verification process.

Age Verification

Current age verification methods require revealing excessive personal information: uploading a full ID scan or sharing a birthdate. SSI enables privacy-preserving age checks where users prove they meet an age threshold without disclosing their exact date of birth or any other personal details.

Professional and Academic Credentials

Universities can issue diplomas as verifiable credentials that employers verify cryptographically in seconds. This eliminates the days-long process of contacting institutions for background checks and removes the risk of fraudulent credentials.

EU Digital Identity Wallet

The EU's eIDAS 2.0 regulation (entered into force May 2024) requires all 27 member states to provide citizens with digital identity wallets by December 2026. These European Digital Identity (EUDI) Wallets will let over 450 million Europeans store government-verified credentials and present them to services across borders, representing one of the largest SSI deployments in the world.

SSI and Blockchain

Blockchain technology serves as a natural trust anchor for SSI systems. A decentralized, tamper-resistant ledger can store DIDs and credential metadata (schemas, revocation lists) without any single entity controlling the registry. Several DID methods anchor directly to public blockchains:

• did:btcr: the Bitcoin Reference DID method generates identifiers from Bitcoin key pairs, using TxRef encoding (BIP-0136) to reference on-chain transaction positions. It is fully open-source and vendor-agnostic.
• ION: a Layer 2 DID network built on Bitcoin using the Sidetree protocol. Launched in March 2021, ION enables high-throughput DID operations while inheriting Bitcoin's security.
• Ethereum-based methods: projects like Veramo (formerly uPort) and various EVM-based DID methods use Ethereum smart contracts as their trust registry.

The philosophical connection between SSI and cryptocurrency is fundamental: self-custody of money and self-sovereignty of identity share the same core principle that individuals should not depend on intermediaries for things as fundamental as their finances or their identity. Platforms like Spark embody this philosophy in the payment layer, giving users direct control over their Bitcoin without relying on custodians.

Standards and Specifications

The W3C has established the core standards that the SSI ecosystem depends on:

• DID Core v1.0: became a W3C Recommendation on July 19, 2022. Defines DID syntax, data model, core properties, and resolution processes. An updated v1.1 reached Candidate Recommendation status in March 2026. Over 100 DID methods have been registered across different blockchain and non-blockchain platforms.
• Verifiable Credentials 2.0: became a W3C Recommendation on May 15, 2025, as a family of seven specifications covering the data model, cryptographic suites (EdDSA, ECDSA), JOSE/COSE securing, and status lists.
• DIDComm: a messaging protocol for secure, private communication between DID-identified parties. Enables the exchange of credentials without a centralized messaging server.

These standards ensure that credentials issued by one system can be verified by another, enabling the interoperability that makes SSI practical across organizations and borders. For more on how decentralized identity protocols work at the technical level, see the related glossary entry.

Risks and Considerations

Key Management Complexity

SSI shifts responsibility for key management from institutions to individuals. If a user loses the private keys associated with their DID, they may permanently lose access to their identity and all associated credentials. Unlike a "forgot password" flow, there is no central authority to reset access. Solutions like social recovery and passkey-based authentication are being explored to reduce this burden, but the challenge remains a significant barrier to mainstream adoption.

Ecosystem Fragmentation

Despite W3C standardization, the SSI ecosystem remains fragmented. Over 100 DID methods exist with different trust models and security properties, and credentials issued in one SSI system often cannot be verified in another. The dissolution of the Sovrin Foundation in May 2025 (one of the earliest SSI networks) highlighted the sustainability challenges facing decentralized identity infrastructure.

Adoption Chicken-and-Egg Problem

SSI requires a critical mass of issuers, holders, and verifiers to be useful. Users have little reason to adopt a credential wallet if no services accept credentials, and services have little reason to accept credentials if no users present them. Government mandates like eIDAS 2.0 may help overcome this by requiring acceptance within regulated sectors.

Revocation and Credential Freshness

When an issuer needs to revoke a credential (an employee leaves a company, a license expires), the revocation must propagate to verifiers. Centralized systems handle this trivially, but decentralized revocation requires additional infrastructure like on-chain status registries or Bitstring Status Lists (part of the VC 2.0 specification family).

Privacy Paradoxes

While SSI enhances privacy through selective disclosure, the use of a public blockchain as a trust registry can introduce new privacy concerns. If DID operations are recorded on a public ledger, correlation attacks may link a user's activities across services. Layer 2 solutions and privacy-preserving DID methods attempt to mitigate this, but the tradeoff between verifiability and privacy requires careful design.

For a deeper look at how decentralized identity intersects with authentication technology, see the research on passkey-based wallet authentication and Nostr-based identity and payments.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.