--- title: "Decentralized Identifier — Identity Glossary | IDSync" description: "A decentralized identifier (DID) is a W3C standard for globally unique identifiers that are controlled by the subject — not issued by a central registrar…" lang: en json-ld: | [ { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://idsync.com/" }, { "@type": "ListItem", "position": 2, "name": "Glossary", "item": "https://idsync.com/glossary" }, { "@type": "ListItem", "position": 3, "name": "Decentralized Identifier", "item": "https://idsync.com/glossary/decentralized-identifier" } ] }, { "@context": "https://schema.org", "@type": "DefinedTerm", "@id": "https://idsync.com/glossary/decentralized-identifier", "name": "Decentralized Identifier", "alternateName": [ "DID", "DID", "W3C DID" ], "description": "A decentralized identifier (DID) is a W3C standard for globally unique identifiers that are controlled by the subject — not issued by a central registrar — and that resolve to a public-key document used to verify signatures.", "url": "https://idsync.com/glossary/decentralized-identifier", "inDefinedTermSet": "https://idsync.com/glossary" }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "DID vs OIDC subject?", "acceptedAnswer": { "@type": "Answer", "text": "An OIDC `sub` is issued and controlled by the IdP. A DID is controlled by the subject — the IdP/issuer doesn't get to revoke the identifier itself." } } ] } ] --- [![IDSync — identity software buyer platform](/assets/idsync-logo-BKS89EW4.png)](/) [Directory](/directory) [Compare](/compare) [Resources](/resources) [Browse tools](/directory)[Run Stack Finder](/stack-finder) 1. [Home](/) 2. [Glossary](/glossary) 3. Decentralized Identifier Decentralized Identity # Decentralized Identifier (DID) A decentralized identifier (DID) is a W3C standard for globally unique identifiers that are controlled by the subject — not issued by a central registrar — and that resolve to a public-key document used to verify signatures. Last reviewed 3 months ago Key points - W3C DID Core specification (1.0) - Format: did:method:identifier (e.g. did:web:idsync.com, did:key:z6Mk...) - Resolves to a DID document containing public keys and service endpoints - Foundation for verifiable credentials and SSI - Multiple 'methods' — did:web, did:key, did:ion, did:ethr — with very different trust models ## What it is A DID is an identifier the subject controls, paired with a public-key infrastructure that doesn't depend on a central CA or directory. It's how an issuer or holder of a verifiable credential is named and proves control of their keys. A DID looks like: `did:web:idsync.com` or `did:key:z6MkpTHR8VNsBxYAAWHut2Geadd9jSrqNUqj8jXBcrYHrjeu`. Resolving it returns a DID document — JSON listing public keys, authentication methods, and service endpoints. ## DID methods - **did:web** — hosted at a `/.well-known/did.json` path; relies on DNS + HTTPS trust - **did:key** — derives the document from the key itself; no network at all - **did:ion / did:ethr** — backed by Bitcoin or Ethereum for censorship resistance - **did:jwk** — embeds a JWK directly Each method has very different operational and trust properties. ## When buyers care - Implementing verifiable credentials (issuer or verifier) - EUDI Wallet, mDL, and other government wallet integrations - Pilots of reusable workforce identity ## Common misconceptions - **DIDs don't require a blockchain.** did:web and did:key don't touch one. - **DIDs are not user-facing identifiers.** Users see human-readable names; DIDs sit underneath. ## FAQ ### DID vs OIDC subject? An OIDC `sub` is issued and controlled by the IdP. A DID is controlled by the subject — the IdP/issuer doesn't get to revoke the identifier itself. IDSync provides educational buyer guidance based on publicly available information, editorial review, and user-submitted data. Vendor information should be verified before purchase. [Who we are, our methodology & disclosure policy](/about). ### One identity concept, explained per issue Get vendor-neutral identity explainers and market updates in your inbox. Work email\* Name Company Role (optional) Interests (optional) Pick what you want more of. IAMCIAMSSO/MFAIGA/PAMSCIM/provisioningAI agent identityVendor updatesSecurity incidents Subscribe Twice-monthly identity digest. Curated, vendor-neutral. Unsubscribe any time. ### Not sure which tool you need? Run the IAM Stack Finder for a vendor-neutral shortlist tailored to your stack. [Run the Stack Finder](/stack-finder) [![IDSync home](/assets/idsync-logo-BKS89EW4.png)](/) The buyer-focused platform for identity, access, and authentication software. #### Platform - [Home](/) - [IAM Stack Finder](/stack-finder) - [Directory](/directory) - [Resources](/resources) - [State of AI Agent Identity 2026](/reports/state-of-ai-agent-identity-2026) - [Buyer Guides](/guides) - [Glossary](/glossary) - [Newsletter](/newsletter) - [Newsletter Archive](/newsletter/archive) #### Best of guides - [All comparisons](/compare) - [All vendor alternatives](/alternatives) - [Best SSO tools](/compare/best-sso-tools) - [Best MFA tools](/compare/best-mfa-tools) - [Best PAM tools](/compare/best-pam-tools) - [Best IGA tools](/compare/best-iga-tools) - [Best CIAM tools](/compare/best-ciam-tools) - [Best passwordless auth](/compare/best-passwordless-authentication-tools) - [Best identity security](/compare/best-identity-security-tools) - [Best machine identity](/compare/best-machine-identity-tools) - [Best SaaS access governance](/compare/best-saas-access-governance-tools) - [Best developer auth](/compare/best-developer-authentication-tools) - [Best for startups](/compare/best-iam-tools-for-startups) - [Best for enterprises](/compare/best-iam-tools-for-enterprises) - [Best SCIM tools](/compare/best-scim-provisioning-tools) - [Best for AI agents](/compare/best-ai-agent-identity-tools) - [Best NHI tools](/compare/best-nhi-management-tools) - [Okta pricing explained](/guides/okta-pricing) - [Auth0 pricing explained](/guides/auth0-pricing) - [Okta alternatives](/alternatives/okta) - [Auth0 alternatives](/alternatives/auth0) #### For Vendors - [Sponsor](/sponsor) - [Badges](/badges) - [Submit Product](/submit-product) - [Claim Profile](/claim-profile) - [Partner](/partner) #### Company - [About & Methodology](/about) - [Contact](/contact) - [Privacy](/privacy) Vendor names, logos, and trademarks are the property of their respective owners. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated. Logos are displayed for identification purposes only. IDSync (idsync.com) is operated by TetraCore, Bowling Green, Ohio. It is not affiliated with the IDSync® Active Directory synchronizer by Identity Syncronizer — [learn more](/about#idsync-disambiguation). © 2026 IDSync. All rights reserved. Editorial independence. Sponsored placements are clearly disclosed.