A driver's license is an oddly talkative object. Ask it a modest question about someone's age and it offers a name, a birthday, an address, a photograph. It arrives at the conversation with its entire autobiography. Wayne Chang has spent years working on a more restrained introduction.
As co-founder and CEO of SpruceID, Chang builds infrastructure for digital credentials: information that an institution can sign and a person can carry and present. The ambition is personal, even when the vocabulary becomes institutional. A person should have a say in how information about them moves through the world. The interesting engineering begins with deciding how little a transaction needs to know.
That question has taken his company into California's mobile driver's license program and taken Chang into standards groups, conference rooms, and discussions of public policy. It has also acquired a new urgency as artificial intelligence makes convincing impersonation easier. His answer keeps returning to the same place: give people useful evidence about themselves without requiring them to surrender everything else.
The database belonged to somebody else
Chang's interest started with a familiar childhood activity: spending time on the internet and trying to work out how websites functioned. The less familiar part was what bothered him. As he learned how sites assembled databases containing his information, he noticed who controlled those databases. It was somebody else.
He studied electrical engineering and describes himself as a “software engineer by trade.” The distinction suits the work. Electrical engineering asks how a system behaves; software lets its builder change the arrangements. In Chang's case, the arrangements around personal information became a lasting concern.
Before Spruce, the founding team worked together at ConsenSys. There, they dealt with enterprises and governments, applied cryptography, and digital identity. Their work included a winning entry in New York City's 2019 BigApps competition, addressing real-estate management with digital identity for assets. Identity, in this setting, could describe a building or a formal approval as readily as a person.
When Spruce launched in 2020, Chang described a business concerned with trust and transaction costs. His examples were concrete: a driver carrying signed evidence of a license, insurance, and a background check could establish qualifications without giving a single marketplace exclusive custody of the relationship. The economics of the intermediary interested him as much as the credentials.
An announcement with working parts
On January 28, 2021, Chang sent a message to the W3C Credentials Community Group announcing that Spruce had released DIDKit as open-source software the previous day. Its core was written in Rust. It supported several programming environments, with more planned. The announcement thanked the community whose specifications and work had made the release possible.
It is a small professional artifact, the sort of message that rarely becomes a founder's defining anecdote. Yet it explains his approach rather well. A standard needs an implementation. An implementation needs to work in the languages other people already use. And those other people need permission to inspect and adapt it.
The company's financing grew around that ambition. In April 2022, Spruce announced a $34 million Series A led by Andreessen Horowitz, with participants including Okta Ventures and returning investors Electric Capital and Y Combinator. Its product plans spanned authentication, credentials, and storage. Sign-In with Ethereum offered one route toward using an account controlled by its holder to access web services.
The DMV becomes a design problem
California provided a different test. SpruceID worked with the state's Department of Motor Vehicles on its mobile driver's license, with SpruceKit components supporting wallet construction and the Credible platform managing credentials through their life cycle. By the company's 2023 account, the work had occupied the preceding 18 months.
A government credential brings obligations that a clever demonstration can avoid. Existing systems have to keep working. Verification has to follow shared standards. People need to understand what a phone is revealing and what happens when they use it. The project put Chang's preferred relationship between a person and their data into an ordinary public service.
One design choice deserves more attention than its name usually receives: preventing “issuer phone-home.” In offline verification, the institution that issued the credential does not need a notification whenever the holder presents it. Otherwise, replacing a plastic card with a phone could quietly give the issuer a new diary of its holder's movements.
The example returns to the license's excessive sociability. For an age check, selective disclosure can let the holder establish an age threshold while withholding unrelated details. The transaction gets an answer. The address stays out of the conversation.
Address
Birth date
Age threshold
Good systems remember when to forget
Chang's technical writing follows the privacy problem beyond the visible fields on a screen. In July 2024, he outlined a proposal called Provably Forgotten Signatures. The concern was linkability: even when two transactions disclose different facts, repeated cryptographic values can allow observers to connect them.
In his example, a site checking age and a bank checking a name could compare underlying values. Restricting the obvious information would not necessarily prevent the two encounters from being joined. Privacy has a back room, and the back room also needs tidying.
His proposed approach combines changing signatures and keys with trusted execution environments that process sensitive values and provide evidence about their deletion. He presented the proposal at NIST's 2024 Workshop on Privacy-Enhancing Cryptography. It was an approach for examination and refinement, with explicit discussion of hardware trust and security limitations.
The attraction is its incremental character: improve existing credential systems without requiring every participant to replace everything at once. Chang's November 2024 essay on Rust makes a related case at a different layer. Memory safety belongs inside the construction of digital infrastructure. A promise about privacy deserves engineering choices capable of supporting it.
A seat between the engineers and the policymakers
At the European Identity and Cloud Conference in Berlin in June 2024, Chang appeared on three panels. On one, he joined Kim Hamilton Duffy and Linda Jeng to discuss trust in AI. Other sessions concerned wallets, verifiers, and credentials already being put to work.
These rooms reveal something about the job he has chosen. Digital identity needs agreement among parties with different responsibilities. A wallet developer, a government official, and a civil-liberties advocate may use the same word, trust, while asking quite different questions about it.
Chang has served as a co-chair in the W3C Credentials Community Group and the Decentralized Identity Foundation's Claims and Credentials Working Group. In conversation, he also shows a dry appreciation for old technology's survival skills. When podcast host Danny Allan described a retired mainframe reaching a museum, Chang replied: “Yes, you think it's a museum, but they're all these engineers, and they're keeping it on ice, just in case.”
“Implementer, not cryptographer.”
Wayne Chang's introduction at NIST's 2024 workshop
That self-description is useful. His work involves carrying ideas into environments where procurement, software, standards, and public expectations all have a vote. The mainframe joke lands because the machines, and the habits surrounding them, tend to outlast the announcements.
Proving a person, preserving a choice
In August 2024, Chang joined a research coalition involving Harvard, Microsoft, MIT, and other organizations in a proposal for personhood credentials. The intended proof was deliberately narrow: establish that a holder is human while protecting identifying information and limiting tracking between uses.
The proposal addressed an uncomfortable consequence of cheap automated activity. Online services may want evidence that there is a person behind an interaction, while that person may have sound reasons to remain anonymous. A credential designed around personhood could help separate those requirements. The researchers presented a direction for further work, with open questions around issuance and implementation.
By December 2025, Chang was participating in the SEC's Roundtable on Financial Surveillance and Privacy. The setting changed; the tension remained recognizable. Institutions want reliable checks. Individuals have an interest in preventing each check from becoming another opportunity for comprehensive observation.
Utah added another chapter. In March 2026, Chang wrote about SB 275 and the state's State-Endorsed Digital Identity program, examining how privacy principles could become obligations for the institutions around a credential. His attention had reached well beyond the wallet interface to the rules governing its ecosystem.
Who gave the agent permission?
In August 2026, a SpruceID essay adapted from Chang's talk at Stanford's Multi-Agent Ecosystems Workshop asked who stands behind an AI agent. A system acting across tools and services needs more than an impressive introduction. Its counterparties may need evidence of who authorized it, what it may do, and how that authority can be withdrawn.
The essay explored wallets for agents, carrying credentials and narrowly scoped permissions. It also left governance questions open, including which issuers to trust and when identity is necessary at all. An agent researching a public topic and one making a regulated transaction should not automatically face identical demands.
Here, Chang's early concern about somebody else's database reappears in another form. If a single platform records every delegation and action, it gains a detailed picture of the people behind the software. If responsibility disappears across vendors, accountability becomes difficult. His work searches for arrangements that preserve usable evidence without making disclosure boundless.
His career now circles a deceptively small question: what must this particular interaction know? Answering it takes code, institutions, and patience with rooms full of people who disagree. But the desired experience is almost impolite in its brevity. A credential answers the question it was asked. Then it stops talking.