SD-JWT
Selective Disclosure JWT. A token format that lets a holder reveal only chosen claims from a credential, used for privacy-preserving verifiable credentials and EU digital identity.
SD-JWT won the format argument for European digital identity because it is a JWT: existing libraries, existing tooling, and a mental model developers already have, with salted per-claim hashes providing selective disclosure. The trade-off against BBS is that a verifier can see how many claims were withheld, and presentations are linkable unless the wallet takes extra steps.
See also: selective disclosure, verifiable credentials, EUDI wallet, BBS signature
Related on Start with Identity
- GlossaryDecentralized Identifier (DID)
A W3C standard identifier that a subject controls without a central registry, resolvable to a document with keys and endpoints. A building block of decentralize
- GlossaryMobile Driver's License (mDL)
A driver's license issued to a phone wallet under the ISO/IEC 18013-5 standard, presentable in person and increasingly online. It supports selective disclosure,
- GlossaryVerifiable Presentation (VP)
A signed package a holder sends to a verifier that bundles one or more verifiable credentials, or claims derived from them, along with proof that the presenter
- CVEICS JWT auth bypass via hard-coded constants
An industrial-control product accepted JWTs built from hard-coded constants (CWE-547). Critical authentication bypass. CISA ICSA-25-175-07.
- CVESharePoint JWT alg:none, impersonate any user
SharePoint's ReadTokenCore skipped signature checks when the JWT header said alg:none. An unauthenticated attacker became any user, including farm admin. CVSS 9
- CVESharePoint JWT validation chain, forge a token and become any user
Four weaknesses across two SharePoint JWT token handlers chain into an unauthenticated authentication bypass. Rapid7 published a proof of concept in August 2026