Standardised digital claims for trusted, reusable and verifiable data
Verifiable Credentials are a standardised way to express digital claims in a format that can be checked for authenticity and integrity. They make it possible to issue, hold, present and verify trusted information without relying only on PDFs, screenshots, manual checks or direct database lookups.
A Verifiable Credential can represent many types of information: a diploma, licence, membership, certificate, identity attribute, professional qualification, company registration, product claim or compliance statement. The key idea is that the information is issued by a recognisable issuer, held by a person or organisation, and verified by a relying party when needed.
In the W3C model, Verifiable Credentials are part of a three-party ecosystem: issuers, holders and verifiers. The issuer makes claims, the holder receives and presents them, and the verifier checks whether the credential can be trusted.
Sources used are listed here.
Why Verifiable Credentials matter
Many digital processes still depend on documents that were designed for human reading rather than automated verification. A PDF certificate, scanned declaration or uploaded document may contain useful information, but a receiving organisation often still needs to check manually whether the document is authentic, whether it has been altered and whether the issuing organisation is trusted.Verifiable Credentials address this problem by making claims digitally verifiable. A verifier can check the issuer, the integrity of the credential and, depending on the implementation, whether the credential is still valid or has been revoked.
This matters for digital trust ecosystems because trusted data only becomes scalable when it can be reused across organisations and systems. Instead of every relying party performing its own manual checks, a credential can be issued once by a trusted source and reused in multiple contexts.
From static documents to verifiable data
A traditional document usually combines three things: the data itself, the presentation format and the evidence of authenticity. For example, a certificate may show a person’s name, a qualification and a logo or signature from the issuing institution.A Verifiable Credential separates these concerns more clearly. The data becomes machine-readable, the credential can be cryptographically protected, and the presentation can be adapted to the context in which it is used.
This makes credentials more useful for digital services. A relying party can process the data automatically, while still being able to verify where it came from and whether it has been changed.
The basic model: issuer, holder and verifier
The most common way to explain Verifiable Credentials is through three roles.The issuer is the party that creates and signs the credential. This could be a university issuing a diploma, a government register issuing an official attribute, a certification body issuing a compliance certificate or a company issuing product information. For more context, see the FIDES topic on Issuers.
The holder is the person, organisation or system that receives and manages the credential. In many cases, the holder stores the credential in a digital wallet. The holder can later present the credential, or selected data from it, to another party.
The verifier is the party that receives and checks the credential. This could be an employer verifying a diploma, a public authority checking a permit, a marketplace verifying a seller or a regulator checking a sustainability claim. For more context, see the FIDES topic on Relying Parties.
This model is powerful because the verifier does not always need to contact the issuer directly. If the credential can be verified cryptographically and the issuer is trusted for that type of claim, the verifier can rely on the credential in a more scalable way.
What makes a credential verifiable?
A credential becomes verifiable when it contains data and proof mechanisms that allow a verifier to check its authenticity and integrity. In practical terms, this means the verifier can answer questions such as who issued the credential, whether it has been changed, whether it was issued to the right holder or subject, whether it is still valid and whether the issuer is trusted for this type of claim.The exact mechanism depends on the credential format and the trust framework being used. Some credentials use JSON-LD and linked data proofs. Others use JWT-based formats, selective disclosure JWTs or mobile document formats. The important point is that the credential is not just data; it includes a way to verify the data.
Credential types and credential formats
A useful distinction is the difference between a credential type and a credential format.A credential type describes what the credential is about. Examples include a diploma credential, proof of age credential, company registration credential, business permit, product passport or compliance certificate. The credential type defines the meaning of the data. For more context, see the FIDES topic on Credential Types.
A credential format describes how the credential is technically represented and secured. Examples include W3C Verifiable Credentials Data Model, SD-JWT VC and ISO mdoc. The format determines how the credential is encoded, signed, disclosed and verified.
This distinction matters for interoperability. Two organisations may agree on the same credential type but use different credential formats. Or they may use the same format but define different data fields and meanings. Real interoperability requires agreement on both meaning and technical representation.
W3C Verifiable Credentials Data Model 2.0
The W3C Verifiable Credentials Data Model 2.0 is one of the most important standards in this area. It defines an extensible data model for Verifiable Credentials and explains how credentials can be protected against tampering. Version 2.0 became a W3C Recommendation on 15 May 2025.The W3C VC model is intentionally broad. It provides a common structure for expressing claims, but it can be used in different domains and with different securing mechanisms. The W3C describes VC 2.0 as a family of specifications for expressing digital credentials in a cryptographically secure, privacy-respecting and machine-verifiable way.
This flexibility is valuable, but it also means that implementers still need to make additional choices. They must decide which credential types, proof mechanisms, identifiers, status mechanisms, schemas and protocols are used in a specific ecosystem.
Issuance and presentation protocols
Verifiable Credentials need protocols for issuance and presentation.Issuance is the process in which an issuer provides a credential to a holder, often to a wallet. OpenID for Verifiable Credential Issuance, or OpenID4VCI, defines an OAuth-protected API for issuing Verifiable Credentials and can support different credential formats, including SD-JWT VC, ISO mdoc and W3C VCDM. OpenID4VCI 1.0 was published on 16 September 2025.
Presentation is the process in which a holder presents a credential, or selected information from it, to a verifier. OpenID for Verifiable Presentations, or OpenID4VP, defines a protocol for requesting and presenting credentials. OpenID4VP 1.0 was approved as a final specification in July 2025.
These protocols are important because wallets, issuers and relying parties need common ways to interact. Without shared issuance and presentation protocols, each credential ecosystem risks becoming a separate technical silo.
Selective disclosure and data minimisation
One of the most important benefits of Verifiable Credentials is the possibility of Selective Disclosure. Instead of presenting a full document, the holder can share only the attributes needed for a specific transaction.For example, a person may prove that they are over 18 without sharing their full date of birth. A company may prove that it has a valid certification without sharing unrelated business information. A product passport may disclose only the information relevant to a specific compliance check.
Selective disclosure supports data minimisation and privacy. It helps reduce oversharing and makes digital verification more proportional to the actual purpose of a transaction.
Verifiable Credentials and wallets
Wallets are often used to store and present Verifiable Credentials. A personal wallet may hold credentials for an individual, such as identity attributes, diplomas or licences. A business wallet may hold credentials for an organisation, such as company identity, mandates, certificates, permits or product claims.However, a Verifiable Credential is not the same as a wallet. The credential is the trusted data object. The wallet is the tool that helps a holder receive, manage and present credentials.
This distinction is important. The same credential type may be used across multiple wallets. Likewise, a wallet may support multiple credential formats and protocols. For more context, see the FIDES topics on Personal Wallets and Business Wallets.
Verifiable Credentials in the EUDI Wallet ecosystem
The EUDI Wallet ecosystem uses several credential formats and standards. The EUDI Wallet ARF discusses W3C Verifiable Credentials Data Model 2.0 as a general data model, while also noting that additional choices are needed around security mechanisms, signature formats and transport protocols.In practice, the EUDI Wallet ecosystem also uses other credential formats, such as SD-JWT VC and ISO mdoc, depending on the use case and implementing rules. This means that Verifiable Credentials should be understood as a broader concept, not as one single technical format.
For FIDES, this is especially relevant because interoperability depends not only on wallet availability, but also on agreement about credential types, formats, protocols, issuers and relying party requirements.
Verifiable Credentials beyond personal identity
Although Verifiable Credentials are often discussed in the context of digital identity, they are much broader. They can also be used for organisations, products, assets, supply chains, compliance claims and data spaces.In a business context, Verifiable Credentials can support company identity, representation rights, permits, certifications, financial attributes, compliance reporting and machine-readable trust between organisations. This connects directly to the European Business Wallet and broader business wallet use cases.
In a product or supply chain context, they can support Digital Product Passports, sustainability claims, traceability events, conformity statements and responsible sourcing. This is why frameworks such as the UN Transparency Protocol also use Verifiable Credentials as a building block for verifiable supply chain transparency.
Why Verifiable Credentials are not enough on their own
Verifiable Credentials are a powerful building block, but they do not solve trust by themselves. A cryptographic signature can prove who issued a credential and whether the credential was altered. It does not automatically prove that the underlying claim is true or that the issuer is authoritative.Trust also depends on governance. A verifier needs to know whether the issuer is trusted for a specific credential type. It also needs to understand the meaning of the data, the rules behind the credential, the status or revocation mechanism, and the legal or business context in which the credential is used.
This is why catalogs, trust registries, credential schemas, rulebooks and interoperability profiles are essential. They help turn individual credentials into reusable ecosystem infrastructure.
Why this matters
Verifiable Credentials can reduce friction in many digital processes. They can make it easier to reuse trusted data, automate checks, reduce repeated document submissions and improve confidence in digital interactions.For public authorities, they can support more efficient digital services and reduce manual verification. For businesses, they can simplify onboarding, compliance, certification and cross-border interactions. For users, they can provide more control over which data is shared and with whom.
The impact depends on adoption and interoperability. Credentials must be issued by trusted parties, supported by wallets, accepted by relying parties and described in a way that others can discover and reuse.
The role of FIDES
For the FIDES Community, Verifiable Credentials are one of the core building blocks of digital trust ecosystems.FIDES focuses on the practical conditions needed for adoption: discoverable credential types, trusted issuers, compatible wallets, relying parties that accept credentials, and interoperability profiles that make implementations work together.
A successful credential ecosystem requires more than standards. It requires a shared understanding of which credentials exist, who issues them, which wallets support them, where they are accepted and how they can be reused in real-world processes. That is precisely the role of the FIDES Ecosystem Explorer, Credential Catalog, interoperability work and community use cases.