W3C publishes draft threat model for verifiable credentials
The World Wide Web Consortium (W3C) has published a draft threat model examining security and privacy risks around verifiable credentials. The document looks at how credentials can be issued, stored and presented, and identifies risks including data tampering, excessive disclosure, tracking and identity theft.
The W3C Verifiable Credentials Working Group published the first draft of the Verifiable Credentials Data Model Threat Model v2.1 on 24 September 2026. The document examines security and privacy threats that can arise when verifiable credentials are used.
Verifiable credentials are digital records that allow an organisation to make claims about a person or entity in a form that can later be checked. For example, a university could issue a digital qualification, an employer could issue a work credential, or a government agency could issue a document. The person or organisation receiving the credential can then present it to another party, which can check whether it is authentic and still valid.
The model describes three main roles: the issuer, which creates and issues a credential; the holder, which stores it and presents it when needed; and the verifier, which checks the credential before deciding whether to accept it.
The draft examines threats across this process. These include changing the contents of a credential, issuing a credential to the wrong person, compromising signing keys and attacks during the exchange of credentials. It also examines privacy risks such as excessive data disclosure, tracking through identifiers or metadata, and linking a person’s activities across different interactions.
One example concerns credential status checks. When a verifier checks whether a credential has been revoked, the way that check is carried out could reveal that a particular credential is being used. The document therefore examines approaches that could reduce the information exposed through these checks.
The threat model also addresses risks that fall outside the data model itself. These include data mining by storage providers, device tracking, the aggregation of credentials and the unauthorised use of information after a credential has been presented.
The document is a Group Note Draft, rather than a W3C standard. W3C says it is a work in progress and that it may be updated, replaced or withdrawn. It is intended to help developers and organisations consider security and privacy issues when implementing or designing systems based on the Verifiable Credentials Data Model.
In simple terms: the document is a security checklist for digital credentials. It asks what could go wrong when a credential is created, stored, shared and checked, and outlines measures that can reduce those risks.
