Should You Put Your Passport on a Soulbound Token?

No. Vitalik Buterin’s soulbound-token concept is not a proposal to publish everyone’s passport on a blockchain. A soulbound token (SBT) is a non-transferable token intended to represent something about a person or account, such as a qualification, membership, or credential. A passport is one possible kind of identity credential people might discuss, not a requirement of the idea.

That distinction matters. An SBT could represent that an issuer checked a credential without putting a passport image or passport number in the token. But linking a token to your wallet can still connect your real identity to public blockchain activity. Non-transferable does not mean private.

Before accepting an identity token, ask:

• What exact fact does it prove?
• Who issued it, and how can you verify that issuer?
• What personal information is on-chain or linked to the token?
• Can it be revoked, and what happens if you lose your wallet?

If a service says you must upload a passport directly to a public blockchain, treat that as a serious privacy warning. You should be able to understand the data flow before deciding whether to proceed.

Buterin and co-authors discussed SBTs as part of a broader idea called decentralized society. The basic thought is that digital communities may need credentials and relationships that are not freely bought or sold. For example, a token might indicate that an account completed a course, belongs to an organization, or received a qualification from a particular issuer.

A typical NFT can be transferred if its contract and marketplace allow it. An SBT is designed to be bound to a wallet instead. That could make it harder to sell a credential or borrow someone else’s membership token. It can also help applications distinguish accounts based on an issuer’s claim.

An SBT is not automatically a verified fact. Its meaning depends on who issued it, how that issuer checked the claim, and whether a verifier recognizes the token. A token called “passport verified” is not trustworthy just because it is on-chain. You still need to know whether the issuer is legitimate and whether the credential remains valid.

Think of an SBT as a possible digital container or signal for a claim—not as proof that the claim is accurate, fair, or safe to share.

A passport contains highly sensitive information, including identifiers and details that can help establish your identity. Putting the document itself on a public blockchain would create a lasting exposure risk: blockchain data may be copied, indexed, and difficult or impossible to remove. Encrypting the document does not eliminate the risk if keys are leaked or the data is later exposed.

A less direct design might put only a credential or a reference on-chain while keeping the passport with an issuer. That avoids placing the full document on-chain, but it does not settle every privacy issue. The token could still reveal that a wallet belongs to a named person, and observers may connect it with that wallet’s transactions. A token can disclose information simply by existing or being used.

Check the design before connecting your identity to a wallet:

1. Does any passport image, number, or personal detail go on-chain?
2. Is the credential linkable to your public wallet activity?
3. Who can read the credential or revoke it?
4. What happens if the issuer or wallet provider is compromised?

If the answers are unclear, do not share the passport or sign a wallet request just to find out.

A well-designed credential system could let you prove a narrow fact without disclosing the full document. For instance, a service might need to know that you meet an age threshold, not your exact birth date, passport number, or home address. Some identity systems use cryptographic methods to support selective disclosure, where a person reveals only specified claims.

That privacy is not an automatic feature of NFTs or SBTs. It depends on how the credential is issued, stored, presented, and checked. If an app asks you to upload a passport scan and then mints a public token tied to your wallet, the token’s “soulbound” status does not hide the scan or protect your identity.

When assessing a claim of private verification, look for specific answers:

• What data does the verifier receive?
• Does the verification create a reusable identifier that can track you across services?
• Can you choose which claims to reveal?
• Is any personal information written to a public chain?

Do not treat phrases such as “zero knowledge,” “decentralized identity,” or “soulbound” as a privacy guarantee on their own. Ask what is revealed in the actual verification flow.

SBTs could be useful when a service needs a credential that should not be casually sold or transferred. A school might issue a completion record, an organization might issue a membership credential, or a community might use credentials to reduce duplicate participation. These are examples of possible uses, not proof that every such system works reliably.

The same design can create risks. A permanent, public credential could make sensitive affiliations easy to inspect. A mistaken or fraudulent token could damage someone’s reputation. A lost wallet may leave a person unable to use a credential, while a recovery process may introduce a trusted party that can access or replace it. People without compatible devices, wallets, or identity documents could also be excluded.

Before relying on an SBT, check the issuer’s reputation, the token’s purpose, the accuracy of the underlying claim, and the process for correcting mistakes. Ask whether you can use another form of proof if you do not want a wallet-based identity. A credential is only useful if it is accepted where you need it, and its benefits should justify the data and control you give up.

SBTs may support some identity tasks, but they do not remove the need for accountable issuers and careful privacy choices.

A token being non-transferable only describes one property: it is intended not to move from one wallet to another. That does not guarantee that it cannot be revoked, burned, replaced, or invalidated. Those actions depend on the contract and issuer’s powers. Read the rules rather than assuming “soulbound” means permanent or under your sole control.

It also does not establish that a credential is accurate. A token might be issued after weak checks, or an issuer might make a mistake. Nor does it prevent someone from linking a wallet to a person through other records, public posts, or transactions. If a wallet is shared, compromised, or connected to a real-name service, the token’s intended binding may not protect the holder.

Watch for these common mistakes:

• Treating an NFT label as proof that a passport was checked properly.
• Assuming a non-transferable token is confidential.
• Signing an unfamiliar wallet message without reading what it authorizes.
• Ignoring issuer control, recovery, correction, and revocation rules.
• Reusing an identity-linked wallet for activity you want to keep separate.

If you already connected a wallet, review its permissions and the service’s data-retention policy. Do not share a seed phrase or private key with anyone offering to verify or recover a token.

If a website, employer, or community asks you for a passport-based SBT, pause before uploading documents or connecting a wallet. Ask the requester to explain why it needs the credential, whether a less revealing method is accepted, and exactly which information will be shared with the verifier. A legitimate need to confirm one fact does not automatically justify collecting or publishing the whole document.

Use this decision checklist:

1. Confirm the request comes from the real organization, not a lookalike account or unsolicited message.
2. Ask whether the passport is stored off-chain and whether anything identifiable is written to a public blockchain.
3. Check who issues the token, who can inspect it, and whether it can be corrected or revoked.
4. Find out how wallet loss, account recovery, and data deletion are handled.
5. Decline if the organization cannot explain the process or pressures you to act immediately.

Never give a service your seed phrase or private key. A normal verification process should not need them. A wallet signature can also authorize actions, so read the prompt and stop if it requests transfers or broad permissions unrelated to identity verification.

You do not need to adopt an SBT simply because it is described as the future of identity. If you only need to prove a limited fact, ask whether the organization accepts a conventional document check, an age-verification service, or another credential that discloses less. Compare what each option reveals, how long the data is kept, and who can access it.

For a blockchain-based credential, prefer a system that keeps passport documents off-chain, minimizes the claims it reveals, and clearly explains issuer accountability, revocation, correction, and wallet recovery. Verify that the intended recipient actually accepts the credential; a token that no relevant service recognizes may add wallet and privacy risks without helping you.

If your goal is buying, selling, or collecting NFTs, a passport SBT is generally a separate identity question—not a technical requirement of NFT ownership. Review the marketplace’s own identity and transaction requirements instead, and do not confuse an NFT marketplace with a government identity authority.

The practical decision is straightforward: share only the information needed for the task, with an organization you can verify, through a process you understand. If a passport-linked token creates a public connection between your identity and wallet that you do not want, decline it and ask for another way to prove the necessary fact.