W3C’s bitstring status list draft turns credential revocation into an engineering decision

On 24 September 2026, W3C moved credential status from a vague requirement to a concrete design choice. Its First Public Working Draft for Bitstring Status List v1.1 does not prove adoption, but it does give identity teams something they can actually prototype: list sizes, encoding rules, and a privacy-oriented way to avoid making a verifier ask an issuer about one credential at a time. Bitstring Status List v1.1

That shift matters because the baseline W3C data model had already made status checking part of verification when a credential includes status information, while leaving the mechanism open. The 15 May 2025 Recommendation for Verifiable Credentials Data Model v2.0 says verification can include a successful status check, but it also warns that verification does not itself prove the underlying claims are true; relying parties still apply their own rules. In other words, the ecosystem already had a place for revocation or suspension, but not a settled operational pattern. Verifiable Credentials Data Model v2.0

The new draft fills that gap with unusually specific parameters. It describes a bitstring-based mechanism for revocation, suspension, refresh, and message states. The default status list size is 131,072 entries, which the draft equates to 16 KB of single-bit values, and it sets that as a minimum list length for group privacy. It also requires the encoded list to be a Multibase-encoded base64url form of a GZIP-compressed bitstring, with the uncompressed bitstring at least 16 KB. A separate terse entry format fixes even larger constants for implementations that use it. Those details do not establish that one setting is best in production, but they do turn status handling into measurable engineering work instead of hand-waving. Bitstring Status List v1.1

The privacy case is clearer when read next to W3C’s 27 September 2026 threat-model draft. That document identifies correlation through status and revocation lookup as a privacy threat: per-credential or centralized checks can reveal where a credential is presented. Its suggested mitigations include privacy-preserving bulk status mechanisms. The bitstring draft maps directly onto that concern by using a bulk list and by allowing a holder to provide the status list credential directly to a verifier, which the draft presents as a stapling-style privacy improvement. The important distinction is not that privacy is solved, but that the design now has an explicit threat model behind it. Verifiable Credentials Data Model Threat Model v2.1 Bitstring Status List v1.1

NIST’s 15 September 2026 token guidance makes this more than a niche standards story. NIST says it finalized NIST IR 8587 for protecting identity and access tokens, and its news release says the final publication adds more options for token revocation and for sharing signals around tokens, alongside revised guidance on key protection and other lifecycle issues. That is not the same technology as Verifiable Credentials, and the news page is not the full report text. Still, the timing suggests a broader standards direction: by late September 2026, both W3C and NIST were emphasizing what happens after issuance, when a token or credential may need to be checked, limited, or distrusted. NIST finalizes token guidelines

For product and security teams, the immediate question is not whether W3C has settled the market. It has not. As of 2 October 2026, the records here show a First Public Working Draft, a threat-model draft, and a NIST news release about a finalized report. They do not establish vendor support, interoperability, deployment counts, or measured security outcomes. What they do provide is a sharper evaluation checklist: whether the draft’s minimum group size fits a real credential population, how compression and decoding behave in a verifier pipeline, and whether holder-supplied status data reduces correlation without breaking trust assumptions. That is enough to justify testing now, but not enough to claim the problem is already solved. Bitstring Status List v1.1 Verifiable Credentials Data Model Threat Model v2.1 NIST finalizes token guidelines