Rotation Key Census, July 2026 - Rob's wRitings<br>Rob's wRitings<br>Rotation Key Census, July 2026<br>Census of rotation keys and other ways of asserting strong control over identity on the Atmosphere<br>Rob Ricci

July 22, 2026

Share

On 2026-07-21, I looked at 5.062M accounts that have been active on Bluesky / the Atmosphere in the last 30 days.<br>This is an update to a similar census I did about 7 months ago.<br>I found the following users who have strong control over their identity via rotation keys or other mechanisms:

270 users on Bluesky servers with their own rotation keys

13,201 users on third party multi-user servers with their own rotation keys

1,293 users who probably don't need additional rotation keys because they are on their own PDSes

265 users who don't need a rotation key because they are using did:web

In total, I found 15,029 recently-active users (0.299%) who have strong control over their identity.<br>This is an increase of about 10x over my earlier census, in which 0.036% had such control. Most of this growth is due to accounts on multi-user third-party PDSes, and can probably be attributed to PDS migration tools helping users create rotation keys as part of migration: 96.4% of users with their own rotation keys on multi-user third-party PDSes have performed at least one migration.<br>What is a rotation key, and why have one?<br>Most accounts on Bluesky and in the Atmosphere use a standard called did:plc for identifying accounts.<br>Updates to did:plc identities are managed via cryptographic keys known as rotation keys. These are public/private key pairs, and the holder of the private half can use it to sign updates to the identity such as changing its handle or moving it to a different data server. All accounts will have at least rotation key, managed by their PDS server, and may optionally add other rotation keys under their own control.

What is a rotation key, and why have one?<br>Most accounts on Bluesky and in the Atmosphere use a standard called did:plc for identifying accounts.<br>Updates to did:plc identities are managed via cryptographic keys known as rotation keys. These are public/private key pairs, and the holder of the private half can use it to sign updates to the identity such as changing its handle or moving it to a different data server. All accounts will have at least rotation key, managed by their PDS server, and may optionally add other rotation keys under their own control.<br>User data on Bluesky and in the Atmosphere are stored in servers called PDSes. Each account is hosted on one PDS, and a PDS can host many accounts. In current practice, the vast majority of accounts are hosted on PDSes operated by the company Bluesky PBLC, though a growing number of users are on other PDSes, such as Blacksky, Eurosky, Northsky, and others. These PDSes, apps, and other services are collectively known as the Atmosphere.<br>atproto, which the Atmopshere is built on, supports migrating accounts between PDSes without losing data or changing your identity. This is normally done by downloading your data (in a "CAR" file) from the old PDS, uploading it to the new PDS, and asking your old PDS to use its rotation key to record that you have moved.<br>atproto also supports "adversarial migration" in which you are able move without the cooperation of your old PDS - perhaps because it has gone down, or because it has become hostile and does not wish to let you move.<br>In order to use adversarial migration, you need to have - ahead of time - a recent backup of your data and a rotation key that is controlled by you, not your PDS.<br>Thus, this census gives us an idea of how many users might be prepared to use adversarial migration if needed. In addition to having a rotation key, they must also have a recent CAR file, and must have securely kept track of the private half of their own rotation key.

How can I tell if I have my own rotation key?<br>To use a rotation key, you need to keep track of the private half of the key. So, if you are not sure, you effectively do not have one.<br>You can look at an account's rotation keys by looking up its handle at https://pdsls.dev/ and checking under the "identity" tab

How can I tell if I have my own rotation key?<br>To use a rotation key, you need to keep track of the private half of the key. So, if you are not sure, you effectively do not have one.<br>You can look at an account's rotation keys by looking up its handle at https://pdsls.dev/ and checking under the "identity" tab

How do I set up my own rotation key?<br>There are a number of web-based tools that make it easy to add a rotation key to your identity. They include:<br>Note that in order to be able to use your rotation key, you need to:

How do I set up my own rotation key?<br>There are a number of web-based tools that make it easy to add a rotation key to your identity. They include:

https://pdsmoover.com/backups

https://atpairport.com/ticket-booth

Note that in order to be able to use your rotation key, you need to:

Keep track of the private key!...