What is PUID

For every user and every service provider, WWPass generates a distinct PUID: an opaque, randomly generated string. It is not a username, an email address, or any value derived from information the user entered.

A service provider stores and uses this identifier the way it would any other account reference, but the PUID itself discloses nothing about the user's identity. It functions as a pointer, not a credential.

How it's generated 

To create a PUID, WWPass generates a unique random number and stores it in a data container specific to the combination of a user and a service provider. Because the PUID is random, it is impossible to recover either the original user or the service provider from its value.

The same user is assigned a different PUID at every service provider.

Why isolation matters 

A user's PUID at one service provider has no relationship to their PUID at another. There is no shared value that would allow two service providers to determine they are dealing with the same person.

If a service provider's database is compromised, the exposed PUID reveals nothing about that user's identity or activity elsewhere. There is no identifier to correlate and no pattern to trace across other accounts. 

This is the same principle behind WWPass's broader architecture: a breach at one point should not expose anything beyond it.

What happens when access is revoked 

Revoking a user's access removes the underlying keys, not merely a login credential. Without those keys, the PUID cannot be reconstructed, and the data associated with it cannot be located. There is no separate step in which a stale identifier remains active in a database; once the keys are withdrawn, the PUID is rendered unusable along with them.

Why it matters for regulated data 

Because a PUID contains no personal information, users remain anonymous to both the service provider and to WWPass. 

This has direct relevance to GDPR, where minimizing stored personal data reduces exposure and compliance burden, and to frameworks such as DORA and NIS2, which require that a compromise be contained to a single point rather than propagate across systems.

Where it fits 

PUID is not a standalone feature. It is the identifier mechanism underlying every WWPass solution. WWPass Authentication, WWPass SSO, and PassHub each generate and rely on the same per-relationship PUID model, rather than a shared identifier that could be tracked or correlated across them.

Any integration built on a WWPass platform is already relying on PUID, whether or not that product's own documentation names it directly.

Related 

See the full authentication sequence in How WWPass Works, how identifier isolation fits into the broader architecture in Zero-Trust Architecture, how this connects to regulated-industry requirements in DORA and NIS2, or how this applies to enterprise identity strategy in Managed IAM Services.