did:web
Protocolo de Identidade
Comunidade
Detalhes
Licença Open specification (W3C CCG / DIF document licence); implemented in every significant DID resolver library under permissive licences
Status de Dev 🟢 Ativo
Proprietário W3C Credentials Community Group / DIF — specification contacts listed in the W3C registry are Oliver Terbu, Mike Xu, Dmitri Zagidulin and Amy Guy
Órgão de Governança W3C Community Group (Credentials Community Group) | DIF
País International (W3C CCG and DIF participation; contributors across the USA, Europe and the UK)
Ano de Início 2019
Stack Language-agnostic specification; resolution is an HTTPS GET plus a path transformation, implementable in any language in a few lines
Financiamento N/A — no infrastructure or funding required beyond ordinary web hosting
Última Investigação 31 de jul. de 2026
Protocolo de Identidade Atributos
Origens Self-sovereign identity / enterprise adoption — created to remove the infrastructure barrier to DID adoption by reusing the web PKI and DNS that organizations already operate
Banco de Dados N/A — the DID document is a static JSON file served over HTTPS; storage is whatever the controller's web host provides
Linguagem de Consulta HTTPS GET — resolution is a deterministic transformation of the DID into a URL, followed by an ordinary web request
Formatos de Dados W3C DID Document as JSON or JSON-LD, served at /.well-known/did.json or at a path derived from the DID's optional path components
Suporte Móvel Library-level — implemented inside resolver libraries and wallets; no standalone application
Suporte Web Yes — HTTPS is the entire resolution mechanism; the DID document is an ordinary web resource
Aplicativos Nativos Library-level — embedded in resolver libraries; no standalone application
Termos Free at the specification level; real cost is domain registration and hosting, which the controller already bears
Fundos N/A
Baseado Em W3C DID Core 1.0; DNS; HTTPS and the web PKI (certificate authority trust); RFC 8615 well-known URIs
Permissões Web server access control — whoever can write to the hosting path controls the identifier
Autenticação e Identidade Domain-anchored — control of the identifier is control of the domain and its web server. There is no cryptographic binding between the identifier and any key; the keys are simply what the document at that URL says they are
Modelo de Armazenamento Web-hosted — a static JSON document on the controller's own server or CDN. No replication, no history, no verifiable log of changes
Interoperabilidade Universal within the W3C DID ecosystem; the default assumption in most enterprise deployments. did:webvh (in this file) is backwards-compatible with did:web and can be resolved in legacy mode by dropping the SCID segment
Portabilidade de Dados Poor — the domain is part of the identifier, so the DID cannot be moved to a different host without becoming a different DID. This is the specific limitation did:webvh and did:scid were designed to address
Governança e Tomada de Decisão W3C Credentials Community Group and DIF — open participation and public repository for the specification; each DID document is governed solely by whoever controls the domain
Maturidade / Padronização do Protocolo Registered W3C DID method with the widest production deployment of any method, though the specification remains a community draft rather than a W3C Recommendation. Maturity here is adoption-driven
Padrões de Identidade W3C DID Core 1.0; registered in the W3C DID Extensions methods registry
Métodos DID Suportados did:web (defines this method). did:webvh is a backwards-compatible extension that adds verifiable history and self-certification
Gestão de Chaves Controller-managed with no verifiable history — keys can be changed at any time by editing the hosted document, but there is no signed log, so a relying party cannot distinguish a legitimate rotation from a compromise or a substitution by whoever controls the host
Tipos de Credenciais N/A — a DID method specification; defines no credential types. Compatible with W3C Verifiable Credentials issued against identifiers of this method
Método de Verificação Whatever the retrieved document asserts — trust is transitive through HTTPS and the CA system rather than being cryptographically self-certifying. There is no proof that the document was authored by any particular key
Recursos de Privacidade Minimal — did:web identifiers are public by construction, human-readable, and tied to an organizational domain, making them inherently correlatable. Unsuitable for pairwise or pseudonymous use
Métodos de Autenticação Cryptographic signature against keys listed in the hosted DID document
Mecanismo de Revogação Document edit or removal — the controller deletes or updates the hosted file. There is no cryptographic revocation record and no history, so past states cannot be verified
Tipos de Agentes Suportados Any key-controlling entity — individuals, organizations, services and devices
Tipos de Carteira/Cliente SDK / library integration — resolver implementations across the SSI tooling ecosystem; no method-specific wallet
Mecanismos de Recuperação Domain control — recovery means regaining control of the domain and the web server; there is no key-based recovery path
Conformidade / Regulamentações Widely used in regulated enterprise deployments precisely because it maps onto existing organizational domain governance and audit practice. The specification itself addresses no regulation directly
Protocolos de Troca de Credenciais Compatible with DIDComm, OpenID4VC and any W3C DID-resolving protocol; the dominant issuer method in enterprise credential deployments
Estrutura de Confiança Web PKI — trust derives from DNS registration and certificate authorities, both of which are hierarchical and centrally administered. This is the method's defining structural property
Modelo de Custo Domain registration plus hosting — recurring, and dependent on continued payment and registrar relationship. Lapse of the registration destroys the identifier
Resistência à Censura Low — the weakest on this tab. A registrar, certificate authority, hosting provider, court or state can each independently make the identifier unresolvable, and no fallback exists because the domain is embedded in the DID itself