did:plc is a decentralised identifier method created for AT Protocol and used by many Bluesky accounts. It gives an account a stable DID that can continue to identify the same user even when the account's handle or Personal Data Server changes.
Stable identity underneath a changing handle
A did:plc identifier looks like did:plc: followed by an identifier derived during creation. Its current DID document is resolved through the PLC directory and contains information needed by AT Protocol, including service endpoints and verification material. Updates are represented through an operation log with cryptographic authorisation. Because the stable DID is distinct from the familiar @handle, the handle can be changed or revalidated without changing the account's fundamental repository identity.
Why AT Protocol uses DIDs
That separation is central to portability. Human-readable domain handles are useful for people, but domains can move and hosting providers can change. A stable DID gives repositories, follows and references something less fragile to point at. The protocol currently supports did:plc and did:web, with different trade-offs around control and resolution.
The shared dependency behind did:plc
The 'decentralised' label needs context. did:plc resolution depends on the PLC directory infrastructure and the method has its own governance and recovery model. It is therefore not the same as having no shared dependency. Users also normally interact with handles rather than raw DIDs, so successful identity resolution combines DID records, handle verification and service endpoints.
Related reading
- Bluesky Firehose vs Jetstream: What Is the Difference?
- What Is a PDS in AT Protocol? Personal Data Servers Explained