Revocation
Revocation is the mechanism an issuer uses to invalidate a credential after it was issued, for example when a qualification expires or a registration is withdrawn, so verifiers checking it afterwards see it as no longer valid.
Most issuers publish revocation state as a status list: a single compact bitstring where each credential is assigned one bit, published and signed by the issuer so anyone can look up a credential's status without contacting the issuer for every check or exposing which specific credential was checked. A verifier fetches the status list once, checks the relevant bit, and rejects a presentation if the credential has been marked revoked. The IETF Token Status List specification, which builds on the earlier W3C Bitstring Status List work, standardises this format so a status list issued for an SD-JWT VC credential can be checked the same way regardless of which issuer or wallet produced it. Because the whole list is fetched rather than a single lookup, a verifier cannot tell from the network request which specific credential was being checked, which is what keeps the revocation check itself from leaking the holder's activity to the issuer. Status lists are typically refreshed on a short cache interval, a few minutes to a few hours, so a revoked credential stops verifying quickly without requiring the issuer to be contacted at the moment of every presentation. Revocation is distinct from expiry: an expired credential simply carries a validity date that has passed, while a revoked credential is actively marked invalid before its natural expiry, usually because the fact it attested to has changed.
Related terms
Is a revoked credential the same as an expired one?
No. An expired credential has simply passed the validity date it was issued with. A revoked credential is actively marked invalid before that date, usually because the underlying fact changed, such as a licence being withdrawn. The issuer signals revocation through a status list that verifiers check on every presentation.