did:plc

Identity Protocol

A W3C-style DID method, "Public Ledger of Credentials", built for the AT Protocol (atproto) ecosystem but defined as a general DID method. A did:plc identifier is derived from the hash of its first signed operation, so it is self-certifying. Control rests in up to five priority-ordered rotation keys; each update is a signed operation that points to the previous one by hash, and a higher-priority key can overwrite a lower-priority one's operations within a 72-hour window. Operations are submitted to a central directory server that validates them, orders them and publishes the full log. No blockchain is used. The system gives accounts a persistent identifier that survives changes of name or service provider; in practice it identifies over 40 million atproto accounts, and the project names no non-atproto adopter.

Company
Links
Visit Website See this tool in the graph Suggest an edit

Details

License Permissive (dual MIT / Apache-2.0, at the user's option; copyright 2022-2026 Bluesky Social PBC). https://github.com/did-method-plc/did-method-plc (TypeScript reference implementation and directory server); https://github.com/did-method-plc/go-didplc (Go implementation, Apache-2.0)
Dev Status 🟢 Active
Owner Bluesky Social PBC (original developer, 2022; copyright holder of the reference code); the PLC Organization, a small Swiss association founded in 2026, as neutral steward
Owner - List
  • Bluesky Social PBC
Governing Body PLC Organization (Swiss association, founded 2026, developing its policies) as neutral steward; Bluesky Social PBC as the original developer. The cited sources do not say who operates the directory at plc.directory today or how the steward is governed
Country Switzerland (the PLC Organization, a Swiss association with a registered address in Zug)
Start Year 2022
Stack TypeScript (reference library and directory server) and Go; DAG-CBOR operations with CIDs; ECDSA-SHA256 over secp256k1 or P-256; did:key encoding of keys; HTTP API described by an OpenAPI schema
Funding Not stated by the project.
Last Investigated Oct 29, 2026

Topology view

This tool in the centre and the things it is directly related to. Each line names the kind of relationship.

Topology view: did:plcThis tool in the centre and the things it is directly related to. Each line names the kind of relationship.did:plcATproto (Basis for, Based on, Speaks protocol)ATprotodid:key (Based on, Conforms to, Identifies via, Speaks protocol)did:keydid:scid (Basis for)did:scidDIDs (Conforms to, Identity primitive for, Speaks protocol)DIDsBluesky Social PBC (Developed by)BlueskySocial PBC
  • ATproto (Tool): Basis for, Based on, Speaks protocol
  • did:key (Tool): Based on, Conforms to, Identifies via, Speaks protocol
  • did:scid (Tool): Basis for
  • DIDs (Tool): Conforms to, Identity primitive for, Speaks protocol
  • Bluesky Social PBC (Organization): Developed by

Open in Graph Explorer

Use Case Domains

Identity & Trust

Affordances

Sovereign identity Trust graph portability

Identity Protocol Attributes

Owner - List
  • Bluesky Social PBC
Origins Account identity for the AT Protocol: a persistent identifier that lets accounts keep their relationships while changing names or moving between service providers, with cryptographic control by the account holder, no blockchain, and cheap, fast, recoverable updates
Database A central directory server holding each identifier's append-only operation log, with the full history publicly readable and exportable
Query Language HTTP resolution at plc.directory (the DID document, current data, and the audit log per DID) and a paginated export of all operations
Data Formats Signed operations as DAG-CBOR for hashing and signing and as plain JSON over HTTP; rotation and signing keys as did:key; rendered as a W3C DID document; identifier is 24 base32 characters of the SHA-256 of the genesis operation
Mobile Support Library-level only: it is an identifier layer used by atproto applications and has no app of its own
Web Support Yes: public HTTPS resolution at plc.directory, a lookup page and API documentation
Native Apps None: an identifier method, not an application
Terms Free to use; the project calls it inexpensive enough to provide as a no-cost service
Funds Not stated by the project.
Based On W3C DID Core, did:key, DAG-CBOR and CIDs, ECDSA over secp256k1 and P-256
Permissions Cryptographic capabilities: only holders of a current rotation key can update an identifier, with priority order deciding disputes; creation and resolution are open to anyone
Authentication & Identity Self-certifying identifier plus rotation keys: the holder (or a service the holder trusts) signs operations with a rotation key; separate signing keys, handles and service endpoints are carried as data. Handles and service claims are not cross-checked by the directory and must be verified bi-directionally by the application
Storage Model Centralized log: the directory server stores every operation permanently with a server timestamp and serves it publicly; clients can verify the log themselves because it is self-certifying
Interoperability Registered W3C DID method, listed in the DIF Universal Resolver's driver table, with a Go implementation beside the reference code; used by the atproto ecosystem. No use outside atproto was found in the cited sources
Data Portability Strong at the identity level: the identifier is independent of any one service provider, and the holder can move between providers while keeping relationships. Dependent on the directory for ordering and resolution
Governance & Decision Making The specification is maintained in the open repository by its developers; the neutral steward is meant to oversee the system, with changes promised to be backwards compatible. Its decision process is not described in the cited sources
Protocol Maturity / Standardization Specification v0.3.0 (December 2025), registered in the W3C DID Extensions registry, in production at atproto scale; not a standards-body deliverable, and the neutral steward was founded only in 2026
Identity Standards W3C DID Core (implements the standard); did:key; registered in the W3C DID Extensions registry
Identity Standards - List
DID Methods Supported did:plc (defines this method); keys are expressed as did:key
DID Methods Supported - List
Key Management Up to five priority-ordered rotation keys (secp256k1 or P-256), kept apart from signing keys by recommendation; control and recovery rest on them, and keys may be reused across accounts
Credential Types N/A: a DID method; it defines no credential types
Credential Types - List
Verification Method The log is self-certifying: a verifier checks each operation's signature against the previous operation's rotation keys and the hash chain; trust in the directory is limited to refusing operations and choosing between forks
Privacy Features Limited by design: the full operation history, with timestamps, is permanently public even after deactivation, so personal information placed in aliases stays visible and key reuse can link accounts
Authentication Methods Operations signed with rotation keys; atproto separately uses a signing key listed in the identifier's data
Revocation Mechanism Update operations rotate or remove keys; a tombstone operation permanently deactivates the identifier (subject to the recovery window); the history is kept
Agent Types Supported Individuals and organizations; the page says "individuals (or organizations)"
Wallet/Client Types Libraries and atproto software; no method-specific wallet
Recovery Mechanisms A higher-priority rotation key can overwrite operations signed by a lower-priority one within 72 hours, which is the recovery path when a lower key is compromised
Compliance / Regulations Not stated by the project.
Credential Exchange Protocols N/A: identifier layer; used inside atproto's own protocols
Credential Exchange Protocols - List
Trust Framework Cryptographic verification of a public log plus trust in one directory for availability and fork ordering; neutral stewardship by the PLC Organization is the stated direction
Cost Model Free to resolve and register
Censorship Resistance Moderate to low: anyone can submit signed operations and the log is verifiable, but a single directory server can refuse operations or serve the wrong fork, and no alternative directory is described

Relationships

How this tool connects to other tools and organizations, from relationships reviewed by the OpenHaven data steward. They describe how projects connect, not how good they are.

Based on
Conforms to
Developed by
  • Bluesky Social PBC
Identifies via
Speaks protocol
Basis for
Identity primitive for