← All practicals

Prove one claim, hide the rest

Issue a selective-disclosure credential, then present only membership_level — verify it without ever seeing your date of birth.

1. 1

   On the Verifiable Credentials lab, issue yourself a membership credential.

   The issuer JWT embeds only a sorted `_sd` array of salted digests — one per claim (given_name, email, membership_level, date_of_birth, member_since). No claim value sits in the signed token; each lives in a separate disclosure string only you (the holder) hold.

2. 2

   Build a presentation revealing ONLY membership_level.

   The other four disclosures are simply left out of the presentation string — omission IS the selective-disclosure mechanism. Their salted digests remain in `_sd`, but a digest alone reveals nothing about the value it was computed from.

3. 3

   Verify the presentation and read the result.

   The verifier checks the issuer's signature, then recomputes the digest of the ONE presented disclosure and confirms it's in `_sd` — that's the entire trust chain. disclosed_claims shows membership_level only; hidden_count reports how many claims stayed hidden, by count, never by value.

4. 4

   Try tampering with a disclosure (flip a character) and verify again.

   The recomputed digest no longer matches anything in `_sd`, so verification fails outright — a forged or altered disclosure can never be laundered through a valid issuer signature.