did:webvh
Identity Protocol
Community
Links
Details
License Permissive (Apache-2.0); https://github.com/decentralized-identity/didwebvh — specification; https://github.com/decentralized-identity/didwebvh-ts — TypeScript; https://github.com/decentralized-identity/didwebvh-server-py — Python; Rust implementation donated by Affinidi
Dev Status 🟢 Active
Dev Status Detail Released (v1.0 specification at identity.foundation/didwebvh; three complete implementations: TypeScript (didwebvh-ts), Python (didwebvh-server-py), Rust (donated by Affinidi); Dockerized installation option; deployed in Swiss swiyu national trust infrastructure)
Owner Decentralized Identity Foundation (DIF) — Identifiers & Discovery Working Group; specification co-created by Stephen Curran (BC Government) and John Jordan; originally incubated as did:tdw (Trust DID Web) at BC Government
Country International (DIF is globally distributed; incubated by Government of British Columbia, Canada; now DIF-governed)
Start Year 2023
Stack Language-agnostic specification; implementations in TypeScript (Bun/Node.js), Python (FastAPI), Rust; HTTPS for DID document hosting; JSON-LD for DID documents
Funding Foundation / Government (DIF member funding; original incubation by Government of British Columbia; ongoing development by DIF I&D Working Group contributors)
Last Investigated Jul 1, 2026
Identity Protocol Attributes
Origins DID ecosystem / enterprise identity (motivated by did:web's lack of verifiable history and self-certification; designed as a "grown-up" production-grade upgrade to did:web with cryptographic provenance and key rotation without ledger dependency)
Database N/A (DID log stored as append-only file at well-known HTTPS URL; no database required by spec)
Query Language DID URL resolution (standard W3C DID resolution via HTTPS; DID log fetched and verified client-side)
Data Formats W3C DID Document (JSON-LD); DID Log (append-only JSON Lines file of signed DID document versions); data integrity proofs per version
Mobile Support Library-level (TypeScript and other SDKs usable in mobile environments; no dedicated mobile app)
Web Support Yes (HTTPS-based DID document hosting; standard web infrastructure)
Native Apps Library-level (embedded in DID resolver libraries and server implementations; no standalone app)
Terms Free / Open standard (Apache-2.0; no fees)
Funds Unknown (DIF member contributions; BC Government R&D investment not separately disclosed)
Based On W3C DID Core specification; did:web (backwards-compatible upgrade); SCID (self-certifying identifier derived from genesis state); data integrity proofs; JSON Lines log format
Permissions Cryptographic Capabilities (key control determines update permissions; multi-key authorization possible; no ACL)
Authentication & Identity Self-certifying DID (SCID derived from initial DID document state; full cryptographic key history verifiable from log; backwards-compatible did:web resolution)
Storage Model Web-hosted (DID log stored at well-known URL alongside DID document; standard HTTPS hosting; no blockchain or distributed ledger required)
Interoperability W3C DID ecosystem (any DID consumer); backwards-compatible with did:web (legacy mode resolution); Swiss swiyu national trust infrastructure deployment; Hyperledger ACA-py integration
Data Portability Full portability (DID can be moved to new HTTPS host via portability mechanism; SCID and history preserved; key rotation supported without identity loss)
Governance & Decision Making Foundation-governed (DIF Identifiers & Discovery Working Group; DIF membership governance)
Protocol Maturity / Standardization Community Standard (v1.0 released 2025; three complete implementations; DIF Identifiers & Discovery Working Group; deployed in Swiss national infrastructure; Apache-2.0; not yet submitted to W3C DID Methods Registry as a formal W3C standard)
Identity Standards W3C DID Core 1.0; W3C Data Integrity; SCID (Self-Certifying Identifier); compatible with W3C Verifiable Credentials
DID Methods Supported did:webvh (defines this method); backwards-compatible with did:web
Key Management User-controlled with pre-rotation (authorized keys listed in DID log; key rotation recorded as new signed log entry; pre-rotation commitments supported for forward security)
Credential Types N/A (DID method specification; compatible with any W3C VC issued against did:webvh identifiers)
Verification Method Cryptographic signature verification (each DID log entry carries data integrity proof signed by authorized key; full history verifiable from SCID genesis; no external trust anchor required)
Privacy Features Minimal (web-hosted DID is publicly discoverable; SCID enables portable history without exposing private keys; no ZKP features in base spec)
Authentication Methods Cryptographic signatures (DID-based key control; standard DID authentication challenge-response)
Revocation Mechanism Key rotation via DID log (new log entry with updated keys signed by currently authorized key; revoked keys removed from active verification methods; history preserved immutably)
Agent Types Supported Humans (individuals), Organizations, Services/APIs, Devices/IoT — any entity with HTTPS hosting capability
Wallet/Client Types SDK/Library integration (TypeScript, Python, Rust libraries); server-side implementations; compatible with standard W3C DID wallets and agents
Recovery Mechanisms Pre-rotation / Key history (recovery via pre-committed rotation keys; M-of-N multisignature possible via DID document configuration)
Compliance / Regulations eIDAS-aligned (Swiss swiyu national trust infrastructure deployed did:webvh for eIDAS-compatible national identity; GDPR-compatible via standard HTTPS infrastructure)
Credential Exchange Protocols Compatible with DIDComm, OIDC4VC, ACA-py / Hyperledger Aries; any protocol supporting W3C DID resolution
Trust Framework Cryptographic verification (no external trust anchor required beyond HTTPS; optional governance layer via trust registries for ecosystem deployments)
Cost Model Free (no blockchain fees; standard HTTPS hosting costs; open source libraries)
Censorship Resistance Service provider dependent (relies on HTTPS hosting; DID owner controls the hosting; portability mechanism allows migration if host becomes unavailable; not as censorship-resistant as blockchain-anchored methods)