W3C publishes five draft threat models for verifiable credentials

The World Wide Web Consortium (W3C) has published five draft threat models examining security and privacy risks associated with verifiable credentials. Released on 8 October 2026 by its Verifiable Credentials Working Group, the documents cover different technologies and methods used to handle these digital records.

Verifiable credentials are digital versions of documents or claims that can be checked for authenticity. They could, for example, be used to prove a qualification, confirm a person’s age or demonstrate that someone holds a particular licence. Unlike a simple image or scanned copy, a verifiable credential can include technical evidence that helps a recipient check whether it was issued by a recognised source and whether its contents have been altered.

However, these systems can introduce risks. Credentials could be forged, sensitive personal information could be exposed, or someone could misuse a legitimate credential. The new W3C drafts examine potential threats in specific parts of the technology and identify issues that developers should consider when designing and implementing them.

The five documents address different areas. The Recognized Entities Threat Model examines risks related to identifying recognised entities. The Data Integrity Threat Model focuses on protecting data against unauthorised changes and ensuring that its integrity can be checked. The Verifiable Credential Barcodes Threat Model examines risks associated with credentials represented through barcodes. The Verifiable Credentials Render Method Threat Model considers the security and privacy implications of how credentials are presented to users. The VCALM Threat Model addresses risks associated with the Verifiable Credential Architecture and Lifecycle Management specification.

Together, the drafts provide security and privacy analysis for the technologies covered by their respective W3C documents. Their publication does not mean that the specifications are final or that all identified risks have been resolved. Instead, the threat models are intended to support further review and development.

The W3C Working Group is inviting feedback through issues in the relevant GitHub repositories. Links to the repositories are available in the headers of the individual draft documents.