A Decentralized Identifier (DID) is a globally unique identifier that you control without relying on any central authority (no company issues it, no company can revoke it). It is anchored to a blockchain or distributed ledger, and you prove ownership by signing with your private key. DIDs let you own your digital identity the same way self-custody lets you own your crypto.
What Is a Decentralized Identifier (DID)?
3 min read
The short version
Today, your online identity is controlled by companies: Google controls your Gmail, Facebook controls your social login, and your government controls your passport number. A DID flips this: YOU create your identifier, YOU control who can verify it, and nobody can take it away from you. It is a self-sovereign identity that no platform can suspend or delete.
How It Works
DID structure: did:method:unique-identifier (e.g., did:ethr:0x742d...3a1b). The method specifies which blockchain/system anchors the DID. The unique identifier maps to your public key or smart contract. A DID Document describes: what public keys are associated with the DID, what services (endpoints) it supports, and authentication methods. Verifiable Credentials: once you have a DID, issuers (universities, employers, governments) can issue credentials TO your DID. These credentials are cryptographically signed and can be verified by anyone without contacting the issuer. Example: your university issues a "Bachelor of CS" credential to your DID. Any employer can verify it is legitimate by checking the university's signature without calling the university directly. W3C standard: DIDs are a W3C recommendation (web standard), not just a crypto concept. They are designed to work across blockchains and even non-blockchain systems. Major implementations: ION (Bitcoin-anchored), did:ethr (Ethereum), Ceramic Network, and SpruceID.
Using a DID for passwordless login
A dApp supports Sign-In with Ethereum (SIWE), which functions as a DID-based login. Process: (1) The dApp presents a message: "Sign in to app.example.com with your Ethereum address." (2) You sign this message with your wallet's private key (MetaMask pop-up, one click). (3) The dApp verifies the signature matches the address (your DID). (4) You are authenticated. No password stored, no email needed, no central authentication server that could be breached. If you use the same wallet across 100 dApps, you have a consistent identity without any company managing the login. You cannot be locked out (you hold the key). The dApp cannot be hacked for "passwords" (there are none to steal). This is the simplest practical form of decentralized identity in use today.
What People Get Wrong
DIDs replace government-issued IDs
DIDs complement traditional identity, they do not replace it (yet). You still need a passport for border control. But DIDs can carry verifiable proofs of government ID (without revealing the full document) for contexts where full identity disclosure is unnecessary. They add a self-sovereign layer on top of existing identity systems.
Your DID reveals everything about you
DIDs enable selective disclosure: you can prove "I am over 18" without revealing your birthdate, or "I graduated from MIT" without revealing your GPA. Verifiable Credentials with zero-knowledge proofs allow proving facts about yourself without revealing unnecessary personal data.
Everyone needs to use the same DID system
The W3C DID standard is method-agnostic. Different systems (Ethereum-based, Bitcoin-based, web-based) can all interoperate through the standard. A verifier does not need to use the same blockchain as the DID holder. The standard provides the interoperability layer.
Keep Reading
Sources & Further Reading
- W3C DID Specification
The official W3C standard for Decentralized Identifiers
- Sign-In with Ethereum (EIP-4361)
The SIWE standard for using Ethereum addresses as decentralized login
- SpruceID
Identity infrastructure implementing DIDs and Verifiable Credentials
Questions People Also Ask
- Is "Sign-In with Ethereum" a DID?
- Functionally yes. Your Ethereum address acts as a DID (did:ethr:0x...), and signing a message proves you control it. SIWE (EIP-4361) standardizes this pattern. It is the most widely adopted form of decentralized identity in crypto today, used by thousands of dApps.
- What are Verifiable Credentials?
- W3C standard for digitally signed claims. An issuer (university, employer, government) creates a credential, signs it with their DID, and gives it to your DID. Anyone can verify the credential's authenticity by checking the issuer's signature, without needing to contact the issuer. Credentials can be selectively disclosed (show some fields, hide others).
- How is this different from ENS names?
- ENS (Ethereum Name Service) is a naming layer (human-readable address: vitalik.eth). A DID is an identity framework (with credential issuance, verification, and selective disclosure). ENS names can be part of a DID system (as a friendly identifier), but DIDs are a broader concept encompassing authentication, credentials, and identity management.