OpenVTC
Identity Toolkit / Platform
Community
Links
Details
License Open source — Apache-2.0 (repository at github.com/OpenVTC/openvtc; written in Rust)
Dev Status 🧪 Alpha
Dev Status Detail Alpha (CLI binary installable from source via cargo; setup wizard, DID generation, DIDComm mediator connectivity, and VRC exchange flows present; no published releases yet; 4 GitHub stars, 6 forks as of May 2026)
Owner OpenVTC GitHub organization (community-maintained); core contributors include Kaliya 'Identity Woman' Young and Grace; derived in lineage from the FPP PoC app and the H2H app demonstrated at the Decentralized Trust Graph workshop in Napa, February 2026
Country International (distributed team)
Start Year 2026
Stack Rust 1.91.0+ (workspace organized as openvtc-cli, openvtc-cli2, openvtc-lib, openvtc-service, robotic-maintainers sub-crates); HTTPS for DID resolution; OpenPGP-Card hardware token support via openpgp-card feature flag (enabled by default)
Funding Unknown (community-developed; no funding source documented in repository)
Last Investigated Jul 1, 2026
Identity Toolkit / Platform Attributes
Origins Decentralized identity / Supply-chain trust (motivated by Jia Tan / XZ Utils supply-chain attack pattern; designed to provide cryptographically verifiable first-person trust relationships among open-source maintainers as an alternative to anonymous-contributor risk)
Database Local encrypted configuration files (~/.config/openvtc/config.json or config-<PROFILE_NAME>.json) plus OS-level secure storage (macOS Keychain, Linux Keyring) for private key material; no centralized database; relationship and contact data encrypted within the user's public config file
Query Language N/A — CLI tool; DID resolution via HTTP GET to well-known did:webvh paths; no query API surface
Data Formats W3C DID documents (did:webvh format, JSON Lines did.jsonl); W3C Verifiable Credentials; DIDComm messages with multi-layer envelope structure (confidentiality, sender authenticity, non-repudiation, sender anonymity layers); JSON configuration files
Mobile Support N/A — desktop CLI only; no mobile client
Web Support N/A — CLI tool; requires publicly accessible web domain to host the DID document (did.jsonl) but does not itself provide a web UI
Native Apps CLI binary for macOS, Linux, and Windows (Rust-compiled; installed via cargo install --path .)
Terms Free / self-hosted (open source; users provide their own publicly accessible domain for DID hosting and optionally their own DIDComm mediator)
Funds
Based On First Person Project white paper (architectural foundation); W3C Decentralized Identifiers (DID Core); W3C Verifiable Credentials Data Model; did:webvh DID method (an enhancement of did:web with self-certifying identifiers and pre-rotation keys); DIDComm Messaging Protocol; Personhood Credentials (PHCs) specification; Verifiable Relationship Credentials (VRCs) specification; OpenPGP-Card standard for hardware token cryptographic operations
Permissions Apache-2.0 (permissive open-source license; allows commercial use, modification, and distribution with attribution)
Development Tools Rust workspace with multiple crates (openvtc-cli — primary user interface; openvtc-cli2 — auxiliary CLI; openvtc-lib — core library; openvtc-service — DIDComm mediator service; robotic-maintainers — utility crate); CLI command-reference documentation in docs/; example flows for setup, DID hosting, profile management, relationship establishment, and VRC exchange
Authentication & Identity Self-Sovereign Identity (SSI) using two DID types: Persona DID (P-DID) — long-lived identifier representing a person across contexts; Relationship DID (R-DID) — pairwise identifier used per-relationship for unlinkability. Multiple profiles supported via OPENVTC_CONFIG_PROFILE env var so a user can represent different identities in different contexts. Authentication via cryptographic signatures on DIDComm messages
Storage Model User wallet only — all credentials, relationships, and key material stored locally on user's device (encrypted config files plus OS secure storage); DID documents hosted at user-controlled publicly accessible domain (e.g., https://mydomain.com/.well-known/did.jsonl); no platform storage, no central credential database
Interoperability High: implements widely-adopted open standards (W3C DID Core, W3C VC, DIDComm); compatible with any DIDComm-compliant mediator (OpenVTC provides a default but operators may run their own); did:webvh provides self-certifying portability allowing the user to migrate domains while keeping the same identity; designed to interoperate with the broader First Person Project ecosystem and Decentralized Trust Graph Working Group standards
Data Portability Full portability: did:webvh provides self-certifying identifiers (SCIDs) that allow the user to move the DID to a different domain without losing identity continuity; all credentials are standard W3C VCs; configuration files are user-controlled JSON
Governance & Decision Making Community-led open source project; Apache-2.0 license with standard CONTRIBUTING.md governance; aligned with First Person Project, Decentralized Trust Graph Working Group (joint ToIP-DIF), and the broader LFDT community direction
Identity Standards W3C DID Core; W3C Verifiable Credentials Data Model; did:webvh DID method (an enhancement of did:web); DIDComm Messaging Protocol v2; W3C Personhood Credentials (in draft); W3C Verifiable Relationship Credentials (in draft)
DID Methods Supported did:webvh (primary — uses self-certifying identifier (SCID), pre-rotation keys, and witness proofs; resolves via HTTP GET of did.jsonl from a well-known URL path on a user-controlled domain)
Key Management User-controlled in local OS secure storage (macOS Keychain or Linux Keyring); optional hardware token support via OpenPGP-Card feature flag for signing and authentication operations; pre-rotation keys built into did:webvh method for forward security; encrypted session keys when hardware tokens are used
Credential Types Verifiable Credentials (W3C VC Data Model); Personhood Credentials (PHCs) — issued by qualified ecosystems (e.g., LF, university, employer) attesting holder is a real unique person within that ecosystem; Verifiable Relationship Credentials (VRCs) — issued peer-to-peer between PHC holders to attest verifiable first-person trust relationships
Verification Method Cryptographic signature verification on credentials and DIDComm messages; DID resolution via did:webvh did.jsonl fetch with witness proof verification; relationship verification via VRC signature chain back to issuing PHCs
Privacy Features Pairwise Relationship DIDs (R-DIDs) for unlinkability across relationships; encrypted local configuration; DIDComm multi-layer envelope encryption providing confidentiality, sender authenticity, non-repudiation, and sender anonymity layers; OS-level secure storage for keys; optional hardware token offload; no centralized credential or relationship database
Authentication Methods Cryptographic signatures with private keys held in OS secure storage; OpenPGP-Card hardware tokens (default-enabled); DIDComm-mediated authenticated message exchange
Revocation Mechanism Bilateral relationship termination (either party can terminate a VRC relationship); standard W3C VC revocation mechanisms (specific revocation list approach TBD as DTGWG standardization proceeds); did:webvh pre-rotation keys allow key rotation without DID change
Agent Types Supported Humans (developers and maintainers in open-source communities are the primary use case); organizational PHC issuers (LF, universities, employers, governments, nonprofits); supports multiple profiles per user to represent different contexts
Wallet/Client Types Command-line tool (the OpenVTC binary itself functions as the user's identity wallet and DIDComm client)
Recovery Mechanisms Backup and Restore procedures documented in repository (docs/backup-restore.md); user-managed file backup of encrypted configuration plus OS secure-storage entries; did:webvh pre-rotation keys allow recovery from key compromise via planned rotation
Compliance / Regulations Privacy-preserving by design (no central database, no PII collection by any platform operator, encrypted local storage); aligns with GDPR data minimization principles; no specific regulatory compliance certifications documented
Credential Exchange Protocols DIDComm Messaging Protocol v2 (for all peer-to-peer credential issuance, presentation, and verification exchanges); HTTP for DID document resolution; OpenVTC provides a default DIDComm mediator service (openvtc-service crate) but users may operate their own
Trust Framework Decentralized trust graph rooted in PHCs issued by ecosystems the verifier trusts; verifiable first-person trust relationships (VRCs) extend trust peer-to-peer; aligns with the First Person Project's decentralized trust graph architecture; no central authority
Cost Model Free open source (no usage fees); user costs limited to operating a publicly accessible domain for DID document hosting and optional DIDComm mediator self-hosting
Censorship Resistance Moderate: did:webvh depends on DNS and HTTP availability of the user-controlled domain hosting the did.jsonl file (a DNS or hosting compromise is the primary attack surface); the SCID-based portability of did:webvh allows the user to move to a different domain in response to censorship; pairwise R-DIDs and DIDComm encryption protect relationships from network observers