A SWHID, or SoftWare Hash Identifier, is a unique and permanent identifier derived directly from a piece of code's content. It became ISO/IEC standard 18670 on 23 April 2025. A DOI is assigned to a record in a repository. Many projects use both together.
Two different ideas
Software Heritage describes the SWHID as derived from the code, so the identifier is computed rather than issued. If two copies are identical, they get the same identifier. It can identify software at different levels of detail, from directories and files up to a whole snapshot, and qualifiers can add the location within the archive or a code fragment.
A DOI, as used by Zenodo through GitHub, is assigned when a release is archived and points to that archive record. GitHub's documentation says Zenodo issues a new DOI each time you create a release.
| Feature | SWHID | DOI via archive |
|---|---|---|
| How it is created | Computed from content | Issued on deposit |
| Granularity | Files, directories, snapshots | A release or deposit |
| Needs a registry to mint | No, derivable | Yes |
| Typical use | Exact code identity | Citation in papers |
How to get code into the archive
Software Heritage says that if your code is not yet archived, or the latest snapshot is stale, you can trigger archival with its Save Code Now feature. A GitHub action is also available that sends a Save Code Now request when you publish a release. The FAQ also covers what happens if you delete the original repository, so read it before relying on the archive.
Why this matters for integrity
A content derived identifier gives you a check that does not depend on trust in a name. If the code behind an identifier is altered, the identifier no longer matches. That complements signing and hash pinning, though it does not say anything about whether the code is safe.
Steps to use both:
- Archive the release with Zenodo and record the DOI.
- Ask Software Heritage to archive the repository, and record the SWHID of the release.
- Put both identifiers in the README and the paper's availability statement.
- Keep the version in your citation file in step with them.
See also Software Heritage archive and preservation.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a project is watched after release, since an identifier freezes code but advisories keep arriving.
Quick check
Can I use a SWHID instead of a DOI?
They answer different needs. A SWHID identifies exact code. Journals and indexes usually expect a DOI, so many authors list both.
Does an archived copy mean the code is safe?
No. Archiving preserves code, including any flaws. Scan it before you rely on it.
Safeguard's SBOM and dependency scanning can inventory what a release depends on, and a free scan is available.
Sources
Last reviewed: 19 October 2026.
