Verifiable Credentials: digital records under the W3C standard

A paper certificate can be forged, a PDF even more easily. Traditionally, anyone wanting to check authenticity has to ask the issuer — a call to the examinations office, an email to HR. That takes time on both sides and fails if the issuer is no longer reachable.

Verifiable Credentials turn this around: the record carries its proof of authenticity with it. The issuer signs it with a private key; anyone who knows the matching public key can verify that the record comes from that issuer and has not been changed since. This works automatically, in seconds and without a phone call.

The W3C data model describes three roles. The issuer — a university or company, for instance — creates the credential with claims about a person (the credential subject), such as "completed course X with result Y". The holder keeps it, for example in a digital wallet, and presents it when needed. The verifier — an employer, another university — checks signature, validity and status.

What if a credential has to be withdrawn, for instance after an error or detected cheating? Verifiable Credentials refer to a status list for this. The issuer publishes a signed list of bits; each credential knows its position. If the bit is set, the credential is revoked. The W3C has adopted the "Bitstring Status List" standard for this.

The data protection advantage: the list contains no names, only bits. The verifier fetches the whole list and reads the one position — the issuer does not learn whose credential is being checked.

A credential that the holder keeps and presents fits well with GDPR principles: the holder controls who sees which data. Modern methods also allow selective disclosure — for example only "degree held", without grade and date of birth. This reflects the data minimisation principle in Article 5(1)(c) GDPR.

A credential nevertheless remains a bundle of personal data. Issuers must decide which information is really necessary and should not write personal data into public or immutable registers from which it can never be deleted.

In education, several standards build on the data model. Open Badges 3.0 shapes digital badges and certificates as Verifiable Credentials. European digital credentials under the European Learning Model also use the W3C foundation and add a qualified electronic seal under eIDAS. With the European Digital Identity Wallet under Regulation (EU) 2024/1183 it will also become possible to keep such credentials alongside one's ID.

For issuers it pays to run on two tracks: a human-readable document — a PDF with a QR code — and the machine-verifiable credential behind it. The hiring manager can look at the document while the applicant tracking software still checks automatically.

A signature only proves that a certain key signed. The verifier also needs to know that this key really belongs to the university or company named as issuer. There are several ways to establish that. With a decentralised identifier bound to a web address, the issuer publishes its public key under its own domain — whoever trusts the domain trusts the key.

For higher levels of trust, trust lists or qualified electronic seals under the eIDAS Regulation come into play. For most education credentials, binding to the issuer's known domain is enough; for degrees with European reach, the qualified seal is gaining importance.