How does SD-JWT (Selective Disclosure for JWTs) work?
Instead of plain claims, the signed JWT contains hashes of each claim (SD-claims); the holder also receives the cleartext claims as separate "disclosures" and later sends only the ones they choose, which the verifier checks against the signed hashes.
* The issuer signs hashes, not values: the holder decides which disclosures to reveal, and each revealed one can be checked against its signed hash. *
A JWT (JSON Web Token) is a signed bundle of key-value claims. SD-JWT changes what goes inside the signature:
- Issuance: for each selectively disclosable claim, the issuer builds a disclosure containing a random salt, the key and the value, and puts only the hash of that disclosure into the JWT (the SD-claim). Claims that must always be visible stay as normal non-SD claims. The issuer signs the JWT and gives the holder the signed SD-JWT plus the list of disclosures in cleartext.
- Presentation: the holder sends the SD-JWT together with only the disclosures they want to reveal, for example the birth date but not the address.
- Verification: the verifier checks the issuer's signature on the SD-JWT, hashes each received disclosure, and confirms the hash appears among the signed SD-claims. A match proves the value is unchanged; hidden claims stay as opaque hashes.
The random salt matters: without it, a verifier could hash likely values ("born 1990-01-01", "1990-01-02", …) and guess the hidden claims.
Tip: Picture a signed envelope listing fingerprints of sealed notes. You hand over only some notes; anyone can match them to the signed fingerprints, but the other notes stay sealed.
Go deeper:
RFC 9901: SD-JWT and disclosures — the exact format of salts, disclosures and digests.- JSON Web Token (Wikipedia) — the plain JWT that SD-JWT builds on.