Educational demo of W3C StatusList2021. Issue a single compressed bitstring as a status list credential, mint credentials that reference bit indices, flip those bits to revoke or restore, verify status locally. All synthetic. No network calls.
StatusList2021 (now formalized in the W3C Bitstring Status List Recommendation, with the original community draft at w3.org/TR/vc-status-list) is the W3C-standard mechanism for revoking Verifiable Credentials at scale. It boils down to one idea: instead of querying the issuer once per verification, the issuer publishes a single compressed bitstring containing one bit per credential. Verifiers fetch the whole list and check the bit at the credential's assigned index.
Bit value 0 = credential is valid. Bit value 1 = credential is revoked (or suspended; the statusPurpose field disambiguates).
credentialStatus block with a statusListCredential URL and a statusListIndex (e.g. "4287").GETs the URL. The response is itself a signed StatusList2021Credential wrapping an encodedList field.encodedList, then GZIP-decompresses it, getting a raw bitstring (typically 16,384 bits = 2,048 bytes).4287. 1 = revoked, 0 = valid.| Approach | How it works | Honest tradeoff |
|---|---|---|
| StatusList2021 | One signed bitstring per status purpose; verifier downloads whole list. | Privacy-preserving (issuer can't tell which credential is being checked); scales to ~131K credentials per 16KB list. List grows with issuer scale; freshness depends on republish cadence. |
| Per-credential CRL query | Verifier asks issuer "is credential X still valid?" each time. | Issuer learns who is being verified, when, by whom — classic OCSP-style privacy leak. Server load scales with verification volume, not credential count. |
| OCSP-like online check | Lightweight protocol returning status of a specific cert. | Same privacy concern as CRL; adds availability dependency on the issuer being online for every verification. OCSP stapling exists but is weakly adopted in the VC ecosystem. |
| Short-lived credentials | Don't revoke at all; expire credentials in minutes/hours. | Eliminates the revocation problem for low-stakes claims; useless for long-lived credentials (diplomas, employment, age proofs); shifts burden to a busy reissue endpoint. |
| Cryptographic accumulators (RSA/ZK) | Issuer publishes a single accumulator value; non-revocation proofs accompany the VC. | Strongest privacy and constant-size status; complex to implement, witness updates are an open UX problem, performance is improving but still niche. |
statusPurpose (revocation or suspension) to distinguish, but most implementations only model permanent revocation. Re-clearing a "revoked" bit is cryptographically trivial and semantically loaded — auditors will ask why a revocation was undone.| Demo does | Demo does NOT do |
|---|---|
|
|
Generate the bitstring (initialized to all zeros), GZIP-compress it, base64-encode the result, and wrap it in a W3C StatusList2021Credential envelope. The list is persisted in localStorage so revocations survive page reloads.
Spec recommends ≥ 131,072 for production. 16,384 used as the default here so the bit grid stays browsable. Must be a multiple of 8.
Mint a regular W3C VC 2.0 credential, but add a credentialStatus block that points back to the status list and assigns this credential a bit index. Indices auto-increment per session; you can override.
Auto-incremented; bumped after each successful issuance. Must be < list size.
credentialStatus structure. A real verifier would reject an unsigned VC; the JSON shape, however, is exactly what the W3C spec requires.Issued credentials are tracked in localStorage under nexus_statuslist_issued. Revoking flips the bit at that credential's index in the stored list. Restoring clears it. The list's encodedList is recomputed each time (decode → flip → recompress → re-encode).
Paste a credential that contains a credentialStatus block. The verifier extracts the status list URL and index, looks up the bit in the locally-stored list, and reports VALID or REVOKED.
fetch() the status list URL each time (with HTTP caching) and validate the list's signature before trusting any bit. This demo skips the network round trip and uses the list from your local storage. If the credential's statusListCredential URL doesn't match the locally-stored list URL, the verifier flags it and refuses to look up the bit.