Verifiable Credentials Data Model 2.0: What Changed and Why It Matters
The W3C Verifiable Credentials Data Model 2.0 is the standard for structuring digital credentials: claims issued about a subject, held by a holder, and checked by a verifier. Version 2.0 updated the vocabulary and context, renamed validity fields, and moved securing mechanisms into companion specifications. It underpins portable work and education credentials.
The model in brief
A verifiable credential is a set of claims, such as a degree awarded or a certification earned, issued by an issuer about a subject and cryptographically secured so that tampering is detectable. The holder, often the subject, stores the credential, typically in a digital wallet, and presents it to a verifier, sometimes wrapped in a verifiable presentation. The verifier checks the proof, the issuer's identity, and the credential's status, such as whether it has been revoked.
What changed in version 2.0
According to the W3C specification, version 2.0 made several notable changes from version 1.1:
- New base context. Credentials reference a version 2.0 context that defines the core vocabulary.
- Validity fields. Properties named validFrom and validUntil express when a credential is valid, replacing the earlier issuance and expiration date properties.
- Securing mechanisms separated. The core data model no longer defines how credentials are signed. Companion specifications cover data integrity proofs and securing credentials with JOSE and COSE formats, giving implementers clearer, interoperable options.
- Media types. Specific media types were defined for credentials and presentations.
- Status and related specs. Mechanisms such as status lists for revocation are defined in related W3C specifications.
Implementers moving from 1.1 should review these changes in the specification itself.
Why it matters for hiring
Much of hiring verification is manual: calling universities, contacting former employers, checking certification databases. Verifiable credentials let issuers such as universities, training providers, and employers issue signed records that candidates hold and share. A verifier can check authenticity in seconds without contacting the issuer, and the candidate controls what is shared. A common standard means credentials from different issuers can be verified with the same tools.
Privacy and selective disclosure
Credentials can contain more information than a verifier needs. Some cryptographic approaches support selective disclosure, sharing only certain claims, or proving a fact, such as holding a qualification, without revealing everything else. Privacy-preserving designs matter for hiring, where data protection rules limit what employers may collect.
Verifiable credentials and onchain reputation
Verifiable credentials do not require a blockchain; they are signed data that can be stored anywhere. Blockchains may be used for registries of issuer keys or status information, and onchain records can complement credentials by showing completed, paid work. Both aim at the same hiring problem: replacing self-reported claims with records that others can verify.
How verification works in practice
A verifier receives a credential or presentation, checks the cryptographic proof against the issuer's public key, confirms the issuer is trusted for that type of claim, checks validity dates, and queries the status mechanism to confirm the credential has not been revoked or suspended. It may also check that the presenter is the holder, for example through a proof of control of a key. Each step relies on interoperable formats, which is what the standard provides.
For employers: first steps
Start by accepting credentials where issuers already provide them, such as some certification bodies and universities, using verification tools that support the W3C model. Define which issuers you trust for which claims. Consider issuing credentials yourself, for example employment verification letters, so former employees can prove their history without repeated requests to HR.
Adoption considerations
Value depends on issuers participating and verifiers accepting credentials. Adoption is growing in education, professional certification, and government identity programmes, but coverage is uneven. Organisations adopting credentials should choose interoperable formats, plan key management and revocation, and consider how candidates without credentials will be treated fairly.
Frequently asked questions
- What is the W3C Verifiable Credentials Data Model?
- It is a W3C standard defining how to express credentials, such as qualifications or memberships, as signed digital claims issued by an issuer about a subject, held by a holder, and checked by a verifier. Version 2.0 is the current Recommendation, succeeding version 1.1.
- What is the difference between VC 1.1 and 2.0?
- Version 2.0 introduced a new base context, replaced issuance and expiration date properties with validFrom and validUntil, defined media types, and moved securing mechanisms into companion specifications for data integrity proofs and JOSE or COSE signatures. Implementers should consult the specification for full details and migration considerations.
- Do verifiable credentials need a blockchain?
- No. Verifiable credentials are signed data that can be issued, stored, and verified without a blockchain. Some systems use blockchains for issuer key registries or status information, but the data model itself is independent of any particular storage or ledger technology.
- How are verifiable credentials used in hiring?
- Universities, certification bodies, and employers can issue signed credentials for degrees, certifications, and employment. Candidates hold them in wallets and share them with employers, who verify authenticity instantly without contacting issuers. This reduces credential fraud and speeds up background checks, provided issuers participate.
- What is a verifiable presentation?
- A verifiable presentation packages one or more credentials, or derived information from them, for sharing with a verifier, often with proof that the holder is presenting them. It lets a holder share exactly the credentials a verifier requested, sometimes with selective disclosure, rather than handing over everything in their wallet.
- Who maintains the Verifiable Credentials standard?
- The World Wide Web Consortium, through its Verifiable Credentials Working Group, maintains the data model and related specifications. Implementers should rely on the published W3C Recommendation and companion specifications, and test interoperability with other implementations, since real-world adoption depends on different systems accepting each other's credentials.