For each selectively disclosable claim the issuer builds a disclosure, the base64url of a JSON array of a salt, the claim name and the value, and puts its digest (SHA-256 unless _sd_alg says otherwise) into an _sd array in the signed payload; array elements use ... entries instead. The presentation is issuer-JWT~disclosure~disclosure~…~ followed by an optional key-binding JWT. Decoy digests hide how many claims exist.
The key-binding JWT (typ kb+jwt) proves the presenter holds the key named in the issuer JWT's cnf claim; it contains iat, aud, nonce and sd_hash, a digest over the presented SD-JWT. Verifiers recompute every disclosure digest, check that each appears exactly once, verify the issuer signature and then the key binding.
SD-JWT is a building block: SD-JWT VC (an Internet-Draft) adds a credential type (vct), status and issuer key discovery and is one of the two credential formats of the EU Digital Identity Wallet. Presentations of the same credential are linkable through the issuer signature, so wallets request batches of credentials for one-time use. The SD-JWT inspector decodes presentations locally.