Glossary
What Is Credential Revocation?
Revocation is an issuer withdrawing a credential before its expiry date, because it was issued in error or the holder no longer qualifies for it.
Also called: revoke a certificate, credential status
What it's for
Issuers make mistakes. A certificate goes to the wrong person, or to someone who was later found to have cheated, or names an achievement that turned out not to have happened. Sometimes the holder's standing changes: a membership is terminated, a licence is suspended, a certification is withdrawn after a review.
Revocation is the issuer saying, after the fact, that this credential should no longer be relied on.
How it works
Revocation is harder than it sounds, because the whole design goal of a Verifiable Credential is that a verifier can check it without contacting the issuer. Revocation reintroduces exactly that dependency: the verifier now has to find out something that happened after issue.
The usual answer is a status list. The issuer publishes one document — a long bitstring where each credential has a position — and each credential says which position is its own. A verifier fetches the list and checks one bit. The W3C's Bitstring Status List is the current version of this idea, and its main virtue is privacy: the issuer learns that someone fetched the list, not which credential was being checked.
Two things worth knowing:
- A revoked credential isn't deleted. The signature is still valid and always will be — the credential really was issued. The status is separate information layered on top.
- Revocation and expiry are different. Expiry is planned at issue. Revocation is unplanned and carries a stronger signal: something was wrong.
Where you'll see it
Professional licensing, where suspension has to be visible. Academic credentials withdrawn after misconduct findings. Employment and membership credentials tied to a status that can end.
In Verifycate
We support expiry, not revocation, and it's worth being direct about that. You can set an expiry date at issue, and the public page reports the certificate as expired once it passes. What we don't do today is publish a status list, so there's no way to withdraw a still-in-date certificate and have external verifiers see that.
For the certificates most of our issuers send — participation, completion, event and workshop credentials — the gap rarely bites, because those don't get withdrawn. If you're issuing something that genuinely needs revocation, such as a professional licence or a membership that can be terminated, that's a real limitation and worth weighing before you choose us.
Everything on this page runs in Verifycate. The first 300 certificates are free, no card. Start for free
Common questions
- What's the difference between revoking and deleting a certificate?
- Deleting removes the record, so the holder can no longer show they ever earned it and an honest credential becomes indistinguishable from a fake. Revoking keeps the record and marks it as withdrawn, which is almost always the right behaviour.
- How does a verifier know a credential was revoked?
- By checking a status list the issuer publishes. The credential points at its position in that list; the verifier fetches it and reads one bit. Without a published list, a verifier has no way to learn about a revocation.
- Can Verifycate revoke a certificate?
- Not through a published status list, no. Expiry is supported, and it covers the common case of a credential that lapses on a known date. If you need to withdraw in-date credentials verifiably, we're not the right fit yet.
Related terms
- Credential ExpiryCredential expiry is a date set at issue after which a credential is no longer current — the record stays, but verification reports it as expired rather than valid.
- Verifiable CredentialA Verifiable Credential is a claim about someone, signed by whoever made it, in a W3C format any verifier can check on its own — without contacting the issuer.
- Open Badge 3.0Open Badge 3.0 is the current version of the Open Badges standard, rebuilt on the W3C Verifiable Credentials data model so a badge carries its own cryptographic proof instead of relying on the issuer's server staying online.
- Certificate VerificationCertificate verification is confirming that a certificate was really issued by the organisation it names, to the person it names, and hasn't been altered since.
Issue certificates people can actually check.
Every certificate gets a QR code, a public page, and an Open Badge 3.0 credential. 300 free credits, no card.
“We issued 2,000+ certificates for InCTF — winners, participants, the lot.” — Aravind BL, Amrita InCTF
Start for free