A verifiable credential (VC) is a digital statement that proves itself. It contains claims, such as "this product contains 30% recycled polyester" or "this factory holds ISO 14001 certification", along with a digital signature from the organization that made them. Anyone who receives it can check, by software, who issued it and that nothing has been changed since.
The format is an open web standard. The World Wide Web Consortium (W3C) published Verifiable Credentials Data Model v2.0 as a W3C Recommendation on 15 May 2025. The same model underpins digital identity wallets, education certificates and, increasingly, product and supply chain data.
How a verifiable credential works
Three roles are involved:
- Issuer: the party that makes the claims and signs them, for example a certification body, a supplier or a brand.
- Holder: the party that keeps the credential and shares it, for example a manufacturer passing a supplier certificate to its customer.
- Verifier: the party that checks it, for example a retailer, auditor, customs authority or software system.
The verifier does not need to call the issuer. It reads the issuer's public key, usually published through a decentralized identifier (DID) or a web domain, and checks the signature. If one character of the content has changed, the check fails. Issuers can also publish a status list, so withdrawn or expired credentials are rejected.
Why it matters for product data
Product compliance runs on claims from many parties: material composition from a fabric mill, a test report from a lab, a certificate from an auditor, a declaration of conformity from the manufacturer. Today most of these travel as PDFs and emails that someone has to read, retype and trust.
Verifiable credentials change that:
- Proof of origin. Each value carries the signature of the party that provided it.
- Tamper evidence. Any edit after signing is detected.
- Automation. Claims are structured data, so systems can check them at scale.
- No central database. Each party publishes its own credentials, and verifiers check them independently.
Verifiable credentials in Digital Product Passports
ESPR requires Digital Product Passport data to be based on open standards, interoperable, machine-readable and transferable without vendor lock-in. It does not name a technology, and verifiable credentials are one open standard that fits those goals.
The UN Transparency Protocol builds on them directly. Every UNTP credential, including its Digital Product Passport, Digital Facility Record and Conformity Credential, is a W3C verifiable credential. A brand's passport can then link to signed supplier and certification credentials, giving a chain of evidence behind each claim. Other formats, such as the Asset Administration Shell, focus on structuring the product data itself and can be used alongside credentials.
How to start
- Ask suppliers and certifiers whether they can issue certificates and declarations as verifiable credentials.
- Choose software that verifies signatures on arrival and keeps the original credential, not only a copy of its values.
- Publish your own claims as credentials, starting with documents customers and authorities ask for most, such as declarations of conformity.
- Work with a DPP service provider that can issue and host signed credentials for the full passport period.
How Veribl helps
Veribl publishes passports, declarations of conformity and facility records as signed UN Transparency Protocol credentials. In the supplier portal, certificates that arrive as verifiable credentials have their signature checked, and every supplier answer is signed and kept exactly as sent.
See the Veribl supplier portalOfficial sources
Frequently asked questions
What is a verifiable credential in simple terms?
It is a digital certificate with a tamper-proof signature. Like a paper certificate it says who issued it and what it claims, but anyone can check in seconds, by software, that it is genuine and has not been changed.
How is a verifiable credential different from a signed PDF?
A verifiable credential is structured, machine-readable data, so software can read each claim, such as a test result or a recycled content figure, and check it automatically. A PDF has to be read by a person, and its signature usually covers the file rather than individual data points.
Are verifiable credentials required for the EU Digital Product Passport?
ESPR does not require a specific technology. It requires passport data to be based on open standards, interoperable, machine-readable and transferable without vendor lock-in. Verifiable credentials are one open standard that meets these goals, and the UN Transparency Protocol builds its passport on them.
What is the current verifiable credentials standard?
The W3C Verifiable Credentials Data Model v2.0, which became a W3C Recommendation on 15 May 2025.
Can a verifiable credential be revoked?
Yes. Issuers can publish a status list that verifiers check, so a certificate that is withdrawn or expires stops being accepted even though copies of it still exist.
Last reviewed