How do verifiable credentials work?

An issuer signs a credential containing claims and metadata and gives it to the holder, who stores it in a digital wallet. When sharing it, a verifier checks the signature against the issuer's public key, confirms it has not expired or been revoked, and decides whether to trust that issuer.

How are verifiable credentials used in hiring?

Employers can verify degrees, certifications, skills assessments, and employment history quickly by checking signatures instead of contacting institutions. This speeds background checks, makes fabricated documents easier to detect, and lets candidates reuse credentials across applications while controlling what they share.

Can verifiable credentials be faked?

The signature cannot be forged without the issuer's private key, and altered credentials fail verification. However, a credential only proves who issued a claim. A dishonest or low-quality issuer can still issue misleading credentials, so verifiers need to decide which issuers they trust.

What Are Verifiable Credentials?

Verifiable credentials are digitally signed claims about a person or organisation, such as a degree, certification, or employment history, issued by a trusted party and held by the subject. Anyone can check the signature to confirm who issued the claim and that it has not been altered, without contacting the issuer. The W3C publishes the core standard.

How verifiable credentials work

The model has three roles.

Issuer. An organisation that makes a claim and signs it: a university issuing a degree, a certification body issuing a certificate, or an employer confirming dates of employment.

Holder. The person or organisation the claim is about, who stores the credential, usually in a digital wallet, and decides when to share it.

Verifier. Anyone who receives the credential and wants to check it, such as a hiring team.

The flow. The issuer creates a credential containing the claims, metadata such as issue date and expiry, and a cryptographic signature. The holder stores it. When applying for a role, the holder presents it. The verifier checks the signature against the issuer's public key, confirms the credential has not expired or been revoked, and decides whether it trusts that issuer.

Identifiers. Issuers and holders are often identified with Decentralized Identifiers, a W3C standard for identifiers that resolve to public keys without depending on a single central registry.

Standards. The W3C Verifiable Credentials Data Model defines the structure, so credentials from different issuers can be understood by different verifiers and wallets.

Where credentials are stored

Holders usually keep credentials in a digital wallet app designed for them. The wallet stores the signed credential, manages the holder's keys, and creates presentations that share selected credentials with a verifier. Losing the wallet without a recovery method can mean requesting reissuance from each issuer.

Why they matter for hiring

Faster verification. Background checks that verify degrees, certifications, and employment by contacting institutions take time and cost money. A signed credential can be checked almost instantly.

Fraud resistance. Fabricated degrees and altered certificates are a real problem, and remote hiring increases exposure to identity fraud. A credential whose signature fails or whose issuer is unknown is immediately visible.

Portability. Candidates keep credentials across jobs and platforms instead of re-proving the same history for every application.

Selective disclosure. Some credential formats let a holder prove a specific fact, such as holding a certification or being over a required age, without revealing the whole document.

Skills evidence. Credentials can represent completed assessments, course completions, contributions to projects, or verified work history, not only formal degrees.

Candidate control. The holder decides who sees which credentials, which can reduce unnecessary sharing of personal data.

Verifiable credentials and onchain reputation

Some systems record attestations or credential references on public blockchains, so they can be checked by anyone and composed with other onchain activity, such as contributions to open-source or decentralised projects. Putting personal data directly onchain raises privacy and correction concerns, so many designs keep personal details offchain and record only proofs or references.

Credentials for contributors

In open-source and decentralised communities, credentials or attestations can represent merged contributions, completed bounties, or roles held in a project. They give hiring teams verifiable evidence of work done outside traditional employment, which self-reported profiles cannot provide.

Limits and practical questions

A signature proves origin, not truth. A credential shows that a particular issuer made a claim. Whether that issuer is reputable, and whether their assessment was rigorous, is still a judgement for the verifier.

Issuer adoption. Credentials only help when relevant issuers, such as universities, certification bodies, and employers, issue them. Coverage is still uneven.

Revocation and expiry. Verifiers must check whether a credential has been revoked, for example a withdrawn certification, not only whether the signature is valid.

Key management. Holders who lose access to their wallet may lose access to credentials unless recovery is designed in. Issuers must protect signing keys carefully, since a compromised key could issue false credentials.

Identity binding. A credential proves that a claim was issued to a particular identifier. Hiring processes still need to confirm the person presenting it controls that identifier and is who they say they are.

Privacy and regulation. Credential data is often personal data, so storage, sharing, and retention need to respect data protection law.

Using them in a hiring process. Accept credentials as one input alongside interviews and work samples, maintain a list of trusted issuers for the credentials that matter to the role, check revocation status, and document how verification decisions were made.

Frequently asked questions

What are verifiable credentials?: Digitally signed claims about a person or organisation, such as a degree, certification, or employment record, issued by a trusted party and held by the subject. Anyone can check the signature to confirm who issued the claim and that it has not been altered, without contacting the issuer.
How do verifiable credentials work?: An issuer signs a credential containing claims and metadata and gives it to the holder, who stores it in a digital wallet. When sharing it, a verifier checks the signature against the issuer's public key, confirms it has not expired or been revoked, and decides whether to trust that issuer.
How are verifiable credentials used in hiring?: Employers can verify degrees, certifications, skills assessments, and employment history quickly by checking signatures instead of contacting institutions. This speeds background checks, makes fabricated documents easier to detect, and lets candidates reuse credentials across applications while controlling what they share.
Can verifiable credentials be faked?: The signature cannot be forged without the issuer's private key, and altered credentials fail verification. However, a credential only proves who issued a claim. A dishonest or low-quality issuer can still issue misleading credentials, so verifiers need to decide which issuers they trust.