Murmurations has always focussed on ways to map and share public data. We made the choice to focus on public data at the outset to keep things simple, because selectively sharing private data is much harder since it requires handling complex permissions.
During 2025 we began researching ways to handle sharing private data. This led us into the world of Decentralised Identitifiers (DIDs) and User Controlled Access Networks (UCANs) which enable people to set permissions and manage user access without relying on centralized services.
You can read our research into DIDs and UCANs which provide a robust solution for user authentication and authorization across a wide range of services without creating a single point of failure. These technologies are key requirements for our larger vision of the decentralised ‘cooperating system’ which we are working towards via our PLANET project.
In order to experiment with DIDs and UCANs and to update the Murmurations tools, in 2025 we developed a new open source tool to support decentralised mapping which we have called MurmurMaps.
MurmurMaps brings together all of the functionality required for creating and updating Murmurations profiles (for groups, organisations, projects, people, offers, wants and anything else you’d like to create a map or directory of), along with the ability to create bespoke maps and directories from data in the Murmurations index. It’s completely open source and available for free on GitHub. You can create your own instance of MurmurMaps, or use our demo instance to create profiles and add them, or bulk batches of data, to the Index, and to make your own maps which you can embed on your own website.
So MurmurMaps replaces the original set of Murmurations tools we have been hosting – and incorporates all of the functionality of the WordPress Profile Generator and Collaborative Map Builder plugins which are still available for download, but which we have now archived.
Introducing DIDs and UCANs
MurmurMaps also incorporates the DID and UCAN functionality we researched at the beginning of 2025. Whilst not entirely necessary for the profile creation, index updating or map building functionality the incorporation of DIDs and UCANs demonstrates some exciting functionality, which will be essential aspects of PLANET, and also makes MurmurMaps more secure.
The use of Decentralised Identifiers means you don’t even need to create a password when you register on Murmurmaps. When you load the site, a public/private key pair is generated and stored safely in your browser. To access your account from another device you can generate a Login Token and open a bespoke link, which automatically logs you in on the second device. Decentralized Identifiers (DIDs) are more secure than email addresses and passwords because they replace shared secrets (e.g. an email and password combination) with cryptographic proof (a mathematical technique using algorithms to verify data’s authenticity, integrity, and origin without revealing the data itself), eliminate centralized data stores which are vulnerable to data breaches, and give users self-sovereign control over their identity.
UCANs (User Controlled Authorization Networks) enable advanced MurmurMaps users to delegate permissions to other users. Again, they’re not strictly necessary for the basic MurmurMaps functionality, but we wanted to experiment with them to learn how they work and how to incorporate them into future projects.
What are UCANs?
UCAN permissions are basically cryptographic, self-contained “permission slips” that let users delegate specific actions (e.g., upload, read) on particular resources (data) for defined durations, without needing a central server, allowing for fine-grained, portable, and auditable access control for decentralized apps. They prioritise user control and the Principle of Least Authority (PoLA) – giving users or processes only the privileges which are essential to perform an intended function.
Key Aspects of UCAN Permissions:
- Delegation: You sign a UCAN giving another entity (e.g. an app or a user) a subset of your capabilities, much like passing on a movie ticket.
- Capability-Based: They focus on what someone can do (e.g. read or write to a file) rather than granting access to an entire system.
- Cryptographically Signed: To ensure they’re tamper-proof, verifiable, and auditable using DIDs (Decentralized Identifiers) and public key crypto.
- Distributed: They work offline and in distributed systems because all authorization information is in the token, not a central database.
- Time-Bound: They can include expiration times, automatically revoking permissions when they expire, enhancing security.
- Composable: UCANs can be chained (delegated, then delegated again) to create complex permission structures.
So, advanced MurmurMaps users can use UCAN functionality to link MurmurMaps accounts and delegate permissions. This provides an easy way for teams to collaborate on keeping a particular dataset up to date. To create a delegation the other user/s must be registered on MurmurMaps and send you their Public Key. To delegate some of your permissions (e.g. to view and edit profiles) all you have to do is paste in their Public Key, select the capabilities you want to delegate, click Generate Delegation, and pass the Delegation Token which is generated to your colleague so they can enter it in their account under Receive Delegation.
This might seem complex – and it is really – but it demonstrates a critical tool for handling complex permissions in a secure and decentralised way, which we’re sure will form part of the rapidly evolving self-sovereign internet we are working towards.
So, MurmurMaps is not only a key update to the Murmurations tools, which anyone can use and self-host to support distributed data sharing, it is also a demonstration project showcasing how DIDs and UCANs can be combined to provide secure decentralised systems with composable permissions structures. It also forms the last active development of the Murmurations tool set we have been developing for the last five years.
All the tools we have developed, including the code for hosting a Murmurations index, will remain open source and available for others to use, fork and build on. But now that Murmurations has reached a mature and stable state we will be archiving the majority of the code and focussing our efforts on building other aspects of the self-sovereign internet that can help make PLANET a reality.
We will continue to host the index so Murmurations can still be used to support decentralised data sharing and mapping projects. If you would like to contribute to the ongoing costs of keeping the index and other services running we would be very grateful.
And, if you have questions, feedback ideas or want to let us know about other related projects we’d love to hear from you.