did:webvh

Identity Protocol

A W3C DID method that extends did:web with cryptographically verifiable history, self-certifying identifiers (SCIDs), and key pre-rotation. Every DID version is cryptographically chained to its predecessor through a signed DID log; updates require signatures from authorized keys. A did:webvh URL is backwards-compatible with did:web (resolve in "legacy mode" by dropping the "vh" and SCID segment) while providing enhanced trust guarantees when resolved natively. Incubated at DIF Identifiers & Discovery Working Group; v1.0 released 2025 with three complete implementations.

Community
Links
Visit Website See this tool in the graph Suggest an edit

Details

License Permissive (Apache-2.0); https://github.com/decentralized-identity/didwebvh — specification; https://github.com/decentralized-identity/didwebvh-ts — TypeScript; https://github.com/decentralized-identity/didwebvh-server-py — Python; Rust implementation donated by Affinidi
Dev Status 🟢 Active
Dev Status Detail Released (v1.0 specification at identity.foundation/didwebvh; three complete implementations: TypeScript (didwebvh-ts), Python (didwebvh-server-py), Rust (donated by Affinidi); Dockerized installation option; deployed in Swiss swiyu national trust infrastructure)
Owner Decentralized Identity Foundation (DIF) — Identifiers & Discovery Working Group; specification co-created by Stephen Curran (BC Government) and John Jordan; originally incubated as did:tdw (Trust DID Web) at BC Government
Owner - List
  • Decentralized Identity Foundation
Governing Body DIF (Identifiers & Discovery Working Group)
Country International (DIF is globally distributed; incubated by Government of British Columbia, Canada; now DIF-governed)
Start Year 2023
Stack Language-agnostic specification; implementations in TypeScript (Bun/Node.js), Python (FastAPI), Rust; HTTPS for DID document hosting; JSON-LD for DID documents
Funding Foundation / Government (DIF member funding; original incubation by Government of British Columbia; ongoing development by DIF I&D Working Group contributors)
Funding - List
  • Decentralized Identity Foundation
Last Investigated Jul 1, 2026

Topology view

This tool in the centre and the things it is directly related to. Each line names the kind of relationship.

Topology view: did:webvhThis tool in the centre and the things it is directly related to. Each line names the kind of relationship.did:webvhdid:scid (Basis for, Identity primitive for, Interoperates with, Required by)did:sciddid:vh (Basis for, Interoperates with)did:vhdid:web (Based on, Identity primitive for, Identifies via, Interoperates with)did:webOpenVTC (Basis for, Conforming implementations, Identity primitive for, Interoperates with, Protocol spoken by)OpenVTCKERI (Bridged from)KERIDIDs (Conforms to, Identity primitive for, Speaks protocol)DIDsVCs (Conforms to)VCsDecentralized Identity Foundation (Developed by, Funded by)DecentralizedIdentity Fou…Keyring (Identity primitive for)KeyringDIDComm (Speaks protocol)DIDCommJSON-LD (Speaks protocol)JSON-LDOpenID for Verifiable Credentials (OpenID4VC) (Speaks protocol)OpenID forVerifiable C…
  • did:scid (Tool): Basis for, Identity primitive for, Interoperates with, Required by
  • did:vh (Tool): Basis for, Interoperates with
  • did:web (Tool): Based on, Identity primitive for, Identifies via, Interoperates with
  • OpenVTC (Tool): Basis for, Conforming implementations, Identity primitive for, Interoperates with, Protocol spoken by
  • KERI (Tool): Bridged from
  • DIDs (Tool): Conforms to, Identity primitive for, Speaks protocol
  • VCs (Tool): Conforms to
  • Decentralized Identity Foundation (Organization): Developed by, Funded by
  • Keyring (Tool): Identity primitive for
  • DIDComm (Tool): Speaks protocol
  • JSON-LD (Tool): Speaks protocol
  • OpenID for Verifiable Credentials (OpenID4VC) (Tool): Speaks protocol

Open in Graph Explorer

Use Case Domains

Identity & Trust

Affordances

Sovereign identity Trust graph portability

Identity Protocol Attributes

Owner - List
  • Decentralized Identity Foundation
Origins DID ecosystem / enterprise identity (motivated by did:web's lack of verifiable history and self-certification; designed as a "grown-up" production-grade upgrade to did:web with cryptographic provenance and key rotation without ledger dependency)
Database N/A (DID log stored as append-only file at well-known HTTPS URL; no database required by spec)
Query Language DID URL resolution (standard W3C DID resolution via HTTPS; DID log fetched and verified client-side)
Data Formats W3C DID Document (JSON-LD); DID Log (append-only JSON Lines file of signed DID document versions); data integrity proofs per version
Mobile Support Library-level (TypeScript and other SDKs usable in mobile environments; no dedicated mobile app)
Web Support Yes (HTTPS-based DID document hosting; standard web infrastructure)
Native Apps Library-level (embedded in DID resolver libraries and server implementations; no standalone app)
Terms Free / Open standard (Apache-2.0; no fees)
Funding - List
  • Decentralized Identity Foundation
Funds Unknown (DIF member contributions; BC Government R&D investment not separately disclosed)
Based On W3C DID Core specification; did:web (backwards-compatible upgrade); SCID (self-certifying identifier derived from genesis state); data integrity proofs; JSON Lines log format
Permissions Cryptographic Capabilities (key control determines update permissions; multi-key authorization possible; no ACL)
Authentication & Identity Self-certifying DID (SCID derived from initial DID document state; full cryptographic key history verifiable from log; backwards-compatible did:web resolution)
Storage Model Web-hosted (DID log stored at well-known URL alongside DID document; standard HTTPS hosting; no blockchain or distributed ledger required)
Interoperability W3C DID ecosystem (any DID consumer); backwards-compatible with did:web (legacy mode resolution); Swiss swiyu national trust infrastructure deployment; Hyperledger ACA-py integration
Data Portability Full portability (DID can be moved to new HTTPS host via portability mechanism; SCID and history preserved; key rotation supported without identity loss)
Governance & Decision Making Foundation-governed (DIF Identifiers & Discovery Working Group; DIF membership governance)
Protocol Maturity / Standardization Community Standard (v1.0 released 2025; three complete implementations; DIF Identifiers & Discovery Working Group; deployed in Swiss national infrastructure; Apache-2.0; not yet submitted to W3C DID Methods Registry as a formal W3C standard)
Identity Standards W3C DID Core 1.0; W3C Data Integrity; SCID (Self-Certifying Identifier); compatible with W3C Verifiable Credentials
Identity Standards - List
DID Methods Supported did:webvh (defines this method); backwards-compatible with did:web
DID Methods Supported - List
Key Management User-controlled with pre-rotation (authorized keys listed in DID log; key rotation recorded as new signed log entry; pre-rotation commitments supported for forward security)
Credential Types N/A (DID method specification; compatible with any W3C VC issued against did:webvh identifiers)
Credential Types - List
Verification Method Cryptographic signature verification (each DID log entry carries data integrity proof signed by authorized key; full history verifiable from SCID genesis; no external trust anchor required)
Privacy Features Minimal (web-hosted DID is publicly discoverable; SCID enables portable history without exposing private keys; no ZKP features in base spec)
Authentication Methods Cryptographic signatures (DID-based key control; standard DID authentication challenge-response)
Revocation Mechanism Key rotation via DID log (new log entry with updated keys signed by currently authorized key; revoked keys removed from active verification methods; history preserved immutably)
Agent Types Supported Humans (individuals), Organizations, Services/APIs, Devices/IoT — any entity with HTTPS hosting capability
Wallet/Client Types SDK/Library integration (TypeScript, Python, Rust libraries); server-side implementations; compatible with standard W3C DID wallets and agents
Recovery Mechanisms Pre-rotation / Key history (recovery via pre-committed rotation keys; M-of-N multisignature possible via DID document configuration)
Compliance / Regulations eIDAS-aligned (Swiss swiyu national trust infrastructure deployed did:webvh for eIDAS-compatible national identity; GDPR-compatible via standard HTTPS infrastructure)
Credential Exchange Protocols Compatible with DIDComm, OIDC4VC, ACA-py / Hyperledger Aries; any protocol supporting W3C DID resolution
Credential Exchange Protocols - List
Trust Framework Cryptographic verification (no external trust anchor required beyond HTTPS; optional governance layer via trust registries for ecosystem deployments)
Cost Model Free (no blockchain fees; standard HTTPS hosting costs; open source libraries)
Censorship Resistance Service provider dependent (relies on HTTPS hosting; DID owner controls the hosting; portability mechanism allows migration if host becomes unavailable; not as censorship-resistant as blockchain-anchored methods)

Relationships

How this tool connects to other tools and organizations, from relationships reviewed by the OpenHaven data steward. They describe how projects connect, not how good they are.

Based on
Conforms to
Developed by
  • Decentralized Identity Foundation
Funded by
  • Decentralized Identity Foundation
Identifies via
Speaks protocol
Interoperates with
Basis for
Bridged from
Conforming implementations
Identity primitive for
Protocol spoken by
Required by