DIF RECOMMENDED

did:web plus verifiable history.

did:webplus extends did:web with a cryptographically verifiable history for every DID, so anyone can prove which keys were valid at a given point in time, using standard web infrastructure.

Get started

Read the spec

didwebplus — resolve

$ didwebplus resolve did:webplus:example.com:uHiA…C8A

→ fetching did-documents.jsonl over https …

✓ 4 versions · hash-chain intact · no forks detected

✓ update rules verified at every step

# keys valid @ 2026-03-14T09:12Z

key-1 Ed25519 valid · key-2 Ed25519 valid

did:webplus:example.com:uHiBKHZUE3HHlYcyVIF-vPm0Xg71vqJla2L1OGXHMSK4NEA

Motivation

did:web can’t prove which keys were valid in the past.

did:web resolves a DID to its current document, and stops there. In regulated environments, verifiers must prove which keys were valid at a specific moment, sometimes years after the original transaction. Without a verifiable history, long-term auditability and non-repudiation break down.

did:webplus keeps everything that makes did:web practical, and adds an append-only, self-hashed history that any party can verify independently, without trusting the server that hosts it.

Data model

Each DID is an append-only chain of self-hashed documents.

Each DID document is self-hashed and linked to its predecessor. The DID itself embeds the root document’s hash, so the identifier never changes but commits cryptographically to its entire origin.

Capabilities

What did:webplus adds over did:web

Verifiable history

Every DID maintains an append-only microledger of self-hashed DID documents. Any verifier can independently reconstruct the exact state of a DID at any point in time, without trusting the registry that serves it.

Expressive update rules

Authorize updates with single keys, hashed pre-rotation keys, any/all combinators, or weighted thresholds. The rules travel with the history and are enforced by every verifier, not just the server.

Full and Thin resolvers

Run a Full resolver for offline, fork-detecting resolution with a local archive. Or run a Thin resolver, as simple as did:web and browser-friendly, that delegates verification to a trusted gateway.

Verifiable Data Gateways

A VDG witnesses, archives, and serves DID histories at scale, and detects forks and alterations. Parties that trust the same VDG share one scope of agreement on every DID’s history.

Runs on standard web infrastructure

Plain HTTPS, one JSONL file per DID, incremental range requests, CDN-friendly caching. Host a DID on anything from GitHub Pages to a hyper-scaled service.

No ledger required

No blockchain, no tokens, no consensus round to wait on. did:webplus runs on ordinary web servers and CDNs, which keeps operation cheap, simple, and free of chain lock-in.

Isometric diagram of a did:webplus deployment: the DID controller and wallet, the Verifiable Data Registry serving the microledger, a Verifiable Data Gateway witnessing and archiving it, and Full and Thin resolvers verifying for a relying party.

Live demo

Resolve a live DID in your browser.

This is a real Full DID Resolver running in your browser. It fetches the spec’s own did:webplus microledger over plain HTTPS from GitHub Pages and cryptographically verifies the whole history: self-hashes, update-rule proofs, hash-chain continuity, and JCS wire format. Try it with the CLI afterwards.

This is a real Full DID Resolver running in your browser: it fetches the DID's did-documents.jsonl microledger over HTTPS and cryptographically verifies it end to end — every selfHash recomputed, every update's detached JWS proofs checked against the predecessor's updateRules, hash-chain and versionId continuity enforced, and each line checked byte-for-byte against its JCS canonical form. Every result above is computed from the bytes that were served, per document. Resolution is performed by the community TypeScript implementation, whose Ed25519 support is conformance-tested against the Rust reference implementation's published vectors. Query parameters like ?versionId=1 are supported. Works with any publicly hosted did:webplus DID whose server allows cross-origin reads (GitHub Pages does).

Status

Standards status and implementations

DIF + ToIP Recommended

One of the first two DID methods to pass the DIF vetting process for Recommended DID Methods, announced jointly by DIF and Trust over IP in June 2026.

Read the announcement