| Myth | Reality |
|---|---|
| Decentralised identity requires a blockchain or crypto token. | The largest live deployments, including the EU Digital Identity Wallet and ISO 18013-5 mobile driver’s licenses, use standard public-key cryptography and signed data structures with no distributed ledger involved. |
| Verifiable credentials mean handing over your entire ID file every time. | Selective disclosure lets a wallet reveal a single attribute, such as “over 18,” without exposing a name, address, or document number. |
| Digital identity wallets always “phone home” to the issuer when checked. | Well-designed verification flows are built to avoid contacting the issuer at the moment of presentation, though some implementations still fall short of this goal, prompting active privacy campaigns. |
| This is a distant, experimental technology. | Under eIDAS 2.0, every EU member state is required to offer a Digital Identity Wallet, and several US states already issue ISO 18013-5 mobile driver’s licenses accepted at airport security and retail age checks. |
What Decentralised Identity Means Outside of Web3
The phrase “decentralised identity” is often assumed to be a blockchain concept, largely because early pilots in the space leaned heavily on distributed ledgers for anchoring decentralized identifiers. In practice, the deployments with the largest real user populations today, government-issued digital identity wallets and mobile driver’s licenses, do not depend on a blockchain at all. They rely on a more modest but extremely well-tested piece of infrastructure: public-key cryptography and signed data structures, the same foundation used in TLS certificates for decades. Background on that underlying cryptography and public key trust model, including the nine pillars that make PKI work, is linked at the end of this article.
The core shift that “decentralised” refers to here is architectural, not necessarily distributed-ledger based: instead of a verifier calling an issuer’s database every time someone needs to prove a fact about themselves, the issuer signs a credential once, the holder stores it locally on a device, and the verifier checks the signature and any revocation status without needing a live connection to the issuer for every transaction. That is a meaningful decentralisation of trust and data flow, even without a token or a chain.
The EU Digital Identity Wallet
The European Union’s eIDAS 2.0 regulation requires every member state to make a Digital Identity Wallet, commonly abbreviated EUDI Wallet, available to citizens. The wallet is designed to hold a government-issued electronic identity alongside other attestations, such as diplomas, professional licenses, or a mobile driver’s license, and to let a person present just the specific claim a relying party needs. A retailer checking age for an alcohol purchase receives a “yes, over 18” attestation rather than a full date of birth and a photo ID scan.
Technically, the EUDI Wallet ecosystem is built around OpenID for Verifiable Credentials, an extension of the widely deployed OAuth and OpenID Connect protocols already used across enterprise single sign-on. This choice matters practically: it means relying parties can integrate wallet-based verification using patterns their engineering teams already understand, rather than adopting an entirely new protocol stack. The EUDI Trust Framework defines how issuers and verifiers register and get recognized across all member states, which is what makes a credential issued in one country usable in another.
Selective Disclosure and Unlinkability
A defining technical feature of the EUDI approach is selective disclosure, sometimes implemented through cryptographic techniques that let a holder prove a specific attribute is true without revealing the full underlying document. Combined with unlinkability protections, this is meant to prevent two different verifiers from colluding to track a person across separate transactions using the credential as a common identifier, a privacy property that a plastic ID card or a simple scanned copy cannot offer.
Mobile Driver’s Licenses and ISO 18013-5
Mobile driver’s licenses, often called mDLs, are governed by the ISO/IEC 18013-5 standard, which defines how a phone-based driver’s license is issued, stored, and presented to a verifier such as a police officer’s scanner or an airport security checkpoint reader. The standard supports both online and offline verification, and critically, it defines a device retrieval mode that allows a verifier to check a credential over a local connection such as Bluetooth Low Energy or NFC, without requiring the phone to have an internet connection or the issuing authority to be contacted in real time.
This “no phone home by default” design is one of the standard’s most privacy-protective features, though implementation varies. Some rollouts have used online verification modes that do check back with an issuing authority, which has drawn scrutiny from privacy researchers and campaigns pushing for hard guarantees that verification does not create a centralized log of everywhere a person’s ID was checked. Getting this right in practice, not just in the specification, is one of the most consequential open debates in the mDL space.
| Deployment | Governing standard or framework | Primary use case | Blockchain involved |
|---|---|---|---|
| EU Digital Identity Wallet | eIDAS 2.0, OpenID4VC | National ID, diplomas, professional credentials, age checks | No |
| Mobile driver’s license (mDL) | ISO/IEC 18013-5 | Driving credential, airport security, age-restricted purchases | No |
| W3C Verifiable Credentials (enterprise) | W3C VC Data Model | Employee credentials, education records, supply chain attestations | Rarely; typically PKI-based issuer registries |
| Early self-sovereign identity pilots (2018 to 2021 era) | DID methods anchored on distributed ledgers | Experimental identity wallets, proof-of-concept credentialing | Yes, in most early designs |
W3C Verifiable Credentials in Enterprise and Government
The World Wide Web Consortium’s Verifiable Credentials Data Model is the data format underpinning most of these deployments, whether or not a blockchain sits anywhere in the stack. A verifiable credential is a tamper-evident set of claims, cryptographically signed by an issuer, that a holder can store and present to a verifier. The three-party model, issuer, holder, and verifier, is the conceptual backbone shared by the EUDI Wallet, mDLs, and enterprise deployments issuing things like verified employment credentials or educational transcripts.
Enterprises have started adopting verifiable credentials for use cases like verified employment history for background checks, professional license verification for regulated industries such as healthcare and finance, and supply chain attestations that prove a component or shipment passed a specific inspection. These deployments typically use a private or federated issuer registry rather than a public blockchain, since the trust anchor in most enterprise and government contexts is a known, accountable legal entity rather than an anonymous distributed network.
Figure: The three-party trust triangle behind real-world verifiable credentials
An issuer, such as a government motor vehicle agency or a university, cryptographically signs a credential and gives it to a holder’s wallet app. The holder later presents a selectively disclosed portion of that credential to a verifier, such as a border agent or an online retailer, who checks the signature against the issuer’s published public key without needing to contact the issuer directly for routine verifications.
Why Non-Blockchain Decentralised Identity Is Winning Adoption
Several practical factors explain why government and enterprise programs have converged on PKI-based, non-blockchain models rather than the ledger-anchored designs popular in earlier self-sovereign identity pilots.
- Regulatory clarity. eIDAS 2.0 and similar frameworks specify concrete technical and legal requirements that map cleanly onto existing PKI and OAuth-style infrastructure, giving vendors and government agencies a known compliance target.
- Integration with existing identity infrastructure. OpenID4VC builds on OAuth and OpenID Connect, protocols already deployed across enterprise identity providers, dramatically lowering the integration cost compared to a bespoke blockchain-based protocol.
- Revocation without a public ledger. Status list mechanisms let an issuer revoke a credential efficiently using a simple bitstring published at a known location, avoiding the throughput and privacy tradeoffs of writing revocation events to a public chain.
- Accountability model fits government and enterprise trust. A driver’s license or a diploma has a clear, legally accountable issuer, so anchoring trust in that issuer’s signature, rather than in an anonymous distributed network, matches how these credentials work in the physical world already.
- Offline verification requirements. Border checkpoints, police stops, and retail age checks often need to work without a live internet connection, which the device-retrieval modes in ISO 18013-5 support directly, whereas on-chain lookups generally assume connectivity.
| Adoption barrier | Description | Current mitigation |
|---|---|---|
| Cross-border interoperability | A credential issued in one country must be verifiable and trusted in another | EUDI Trust Framework registries and shared technical specifications across member states |
| Verifier fragmentation | Retailers, airlines, and agencies use different scanner hardware and software stacks | Convergence on ISO 18013-5 device retrieval and OpenID4VC as common protocols |
| Privacy concerns over tracking | Online verification modes can create a log of where and when an ID was checked | Push toward strict offline, no phone home verification defaults and public advocacy campaigns |
| Wallet loss or device change | Losing a phone can mean losing access to government-issued digital credentials | Backup and re-issuance flows tied to the original in-person or verified identity proofing event |
Rollout Realities for Organizations Accepting These Credentials
Businesses and agencies that want to accept mobile driver’s licenses or EUDI Wallet attestations need to think through more than just adding a QR code scanner. Verifier applications need to validate the issuer’s signature chain against a trusted list, handle selective disclosure correctly so they do not request more data than the transaction requires, and support graceful fallback for the portion of the population that has not yet adopted a digital wallet. Retailers doing age verification, for instance, should request only the boolean age claim rather than a full date of birth, both as better privacy practice and often as a regulatory expectation under emerging data minimization rules, a tradeoff explored further in a linked article at the end of this piece.
Enterprises issuing their own verifiable credentials, such as verified employment status for a contractor workforce, also need a clear plan for credential lifecycle management: issuance at onboarding, presentation for access requests, and timely revocation at offboarding. This connects directly to the broader challenge of managing workforce identity for a distributed contractor and gig workforce, where verifiable credentials are increasingly used to prove a worker’s current status without a live database call for every access decision.
Common Mistake
Common mistake
Assuming that because a digital identity wallet uses cryptographic signatures, it is automatically privacy-preserving. Some early or poorly configured verifier integrations request full credential disclosure instead of the minimal selective claim needed, or implement online verification modes that log every check with the issuer, recreating the exact surveillance risk that selective disclosure and offline verification were designed to prevent.
What Worked
What worked
Programs that succeeded designed their verifier integrations around the principle of requesting the minimum viable claim, such as a boolean age check rather than a birthdate, and defaulted to offline, device-retrieval verification modes wherever the standard supported it. Government issuers that published clear trust list registries and revocation status endpoints made it dramatically easier for relying parties across sectors to build correct, interoperable verification logic on the first attempt.
Frequently Overlooked Details
- Decentralized identifier (DID)A globally unique identifier that a holder controls directly, which can be resolved to public key material without needing a blockchain in every implementation.
- Selective disclosureA cryptographic technique letting a holder reveal only a specific attribute from a credential, such as an age threshold, without exposing the rest of the document.
- Status list revocationA compact, privacy-preserving mechanism for an issuer to mark a credential as revoked without publishing details about who or why.
- Device retrieval modeAn ISO 18013-5 verification path using a local connection such as Bluetooth Low Energy, letting an mDL be checked without an internet connection or issuer contact.
- Trust framework registryA published, authoritative list of which issuers and verifiers are recognized within a given jurisdiction, underpinning cross-border credential acceptance.
- Holder bindingA mechanism ensuring the person presenting a credential is the same person it was issued to, typically enforced through a biometric or device-level unlock at presentation time.
Glossary
- Verifiable credential
- A tamper-evident, cryptographically signed set of claims issued to a holder, defined by the W3C Verifiable Credentials Data Model.
- EUDI Wallet
- The European Union Digital Identity Wallet mandated under eIDAS 2.0, letting citizens store and selectively present government-issued and other attestations.
- ISO 18013-5
- The international standard defining the data model and transfer protocols for mobile driver’s licenses, including offline device retrieval verification.
- OpenID4VC
- OpenID for Verifiable Credentials, a protocol extension of OAuth and OpenID Connect used to issue and present verifiable credentials within familiar identity infrastructure.
- Issuer, holder, verifier model
- The three-party trust relationship underlying most verifiable credential systems, distinct from a two-party username-password relationship.
Key Takeaways
- Decentralised identity in real-world government deployment does not require a blockchain; it relies on established public-key cryptography and signed data structures.
- The EU Digital Identity Wallet under eIDAS 2.0 uses OpenID4VC, letting relying parties integrate with familiar OAuth-style infrastructure.
- Mobile driver’s licenses under ISO 18013-5 support offline, device-retrieval verification that avoids contacting the issuer at the moment of use.
- Selective disclosure lets a holder prove a single fact, such as being over an age threshold, without revealing an entire document.
- W3C Verifiable Credentials provide the common data model shared by government wallets and enterprise credentialing programs alike.
- Privacy risk in these systems comes mainly from implementation choices, such as online verification modes, not from the underlying cryptography.
- Organizations accepting these credentials must build verifier logic that requests minimal claims and validates issuer trust lists correctly.
FAQs
Does decentralised identity always involve a blockchain?
No. The largest current deployments, including the EU Digital Identity Wallet and ISO 18013-5 mobile driver’s licenses, use standard public-key cryptography and signed credential formats without any distributed ledger. Blockchain-anchored designs were more common in earlier experimental self-sovereign identity pilots.
What is the EU Digital Identity Wallet?
It is a government-mandated digital wallet application, required under the eIDAS 2.0 regulation, that lets citizens across European Union member states store a national digital identity along with other attestations such as diplomas or a mobile driver’s license, and present only the specific claims a verifier needs.
How does a mobile driver’s license protect privacy compared to a physical ID?
ISO 18013-5 supports offline device-retrieval verification over a local connection, meaning a verifier’s scanner can check the credential without an internet connection or contacting the issuing authority, and selective disclosure lets the holder reveal only relevant fields, such as confirming they are over a certain age.
What is a verifiable credential in the W3C sense?
A verifiable credential is a cryptographically signed, tamper-evident set of claims about a subject, issued by an accountable issuer and stored by a holder, following the data model defined by the World Wide Web Consortium. It underpins both government identity wallets and enterprise credentialing programs.
Can a verifier track everywhere someone uses their digital ID wallet?
It depends on implementation. Specifications like ISO 18013-5 are designed to support verification without contacting the issuer, but some deployments have used online verification modes that do create a record with the issuer, which is why privacy advocates continue to push for stricter offline-by-default requirements.
Are verifiable credentials only useful for government-issued identity?
No. Enterprises are increasingly issuing verifiable credentials for employment status, professional licensing, supply chain attestations, and education records, using the same three-party issuer, holder, verifier trust model but typically anchored to a private or federated registry rather than a government trust framework.
What happens if someone loses the phone holding their digital identity wallet?
Recovery processes vary by issuer, but they generally require the holder to re-prove their identity through the original in-person or verified proofing channel before a replacement credential is issued to a new device, similar in spirit to replacing a lost physical ID card.
How is this different from the decentralized identifiers used in Web3 or blockchain projects?
Web3-oriented decentralized identifier projects typically anchor identifiers and sometimes credential status on a public blockchain and often integrate with cryptocurrency wallets. Government and enterprise deployments discussed here instead anchor trust in accountable, legally recognized issuers using conventional PKI, making them a distinct and more institutionally grounded practical application.
References
- MobileIDWorld, “EU Mandates Digital Identity Wallets by 2026, Including Mobile Driver’s Licenses”
- Docusign, “EUDI Wallets: Your Guide to Europe’s Digital Identity Future”
- Indicio, “Decentralized Identity In 2026: Paving The Way For Progress”
- StartWithIdentity, “Verifiable Credentials Use Cases: Where They Pay Off in 2026”
- Security Boulevard, “Decentralized Identity and Verifiable Credentials: The Enterprise Playbook 2026”
- ISO/IEC 18013-5 mobile driving licence standard documentation
For further reading on this site, see the underlying cryptography and PKI trust pillars behind decentralisation, how these wallets intersect with age verification technology and privacy trade-offs, how verifiable credentials support workforce identity for contractors, gig workers, and agents, why device-bound sign-in matters in our guide to passwordless authentication with passkeys and FIDO2, and how these credentials can help counter fabricated identities as covered in protecting digital identity from deepfakes.
