Every time you log in to a government portal, open a bank account online, or prove your age at a checkout, you are using a digital identity. Most people have dozens of them, scattered across services they barely remember signing up for. This guide explains what digital identity actually is, how the three main models work, and why governments and organisations around the world are rebuilding it from the ground up. If you are new to this topic, our guide to Verifiable Credentials covers the credential side in detail; this article covers the identity layer that sits above it.
What is digital identity?
A digital identity is the collection of information that represents a person, organisation, or device in digital systems, and that can be used to prove who they are. It typically combines an identifier (such as a username or national ID number) with attributes (such as your name, date of birth, or qualifications) and a way to prove the identity belongs to you.
It helps to separate two ideas that are often blurred together. Your identity is who you are. Your credentials are the claims made about you: a university says you graduated, a regulator says you are licensed, an employer says you worked there. Digital identity systems manage the first; Verifiable Credentials are one way of handling the second. The two work together, but they solve different problems.
How does digital identity work?
Digital identity works by linking an identifier (e.g. national ID number) to verified attributes (your name, date of birth, etc), then providing you a way to prove that link when needed. Every digital identity system, from a simple login to a national ID scheme, is built to do this.
There are four components worth knowing:
- 1 Identifiers are something that is uniquely yours and distinguishes you from everyone else: an email address, a national ID number, or a cryptographic key.
- 2 Attributes describe you: name, date of birth, nationality, qualifications.
- 3 Authentication proves you are the person linked to the identifier, using something you know (a password), something you have (a phone), or something you are (a fingerprint).
- 4 Authorisation determines what you can do once authenticated, such as viewing your own tax records but not anyone else’s.
A useful distinction: identification answers “who are you?” while authentication answers “are you really that person?”. Many high-profile fraud cases exploit the gap between the two, where a system knows who an account belongs to but cannot reliably confirm who is using it.
What are the three models of digital identity?
Digital identity systems follow one of three models: centralised, where one organisation holds your identity; federated, where one login is reused across services; and decentralised, where you hold your own credentials and share them directly. Most of the identity systems you use today are centralised or federated. The shift now under way is towards the third.
In a centralised model, a single organisation creates, stores, and controls your identity. Every website account you have ever created works this way. It is simple to build, but every organisation becomes its own honeypot of personal data, and you have to manage a separate identity for each one.
In a federated model, a trusted identity provider vouches for you across many services. “Log in with Google” is the everyday example; national schemes where one government login opens every agency’s services follow the same pattern, e.g. Singapore’s Singpass. It is far more convenient, but the identity provider can see much of what you do, and if your central account is compromised, everything connected to it is exposed.
In a decentralised model, an issuer gives you credentials that you store yourself, usually in a digital wallet, and you present them directly to whoever needs proof. No central party sits in the middle of each transaction, and you can share only the specific attributes required rather than your whole record.
| Centralised | Federated | Decentralised | |
|---|---|---|---|
| Who holds your data | Each service, separately | The identity provider | You, in a wallet |
| How you log in or prove identity | Separate account per service | One login reused across services | Present credentials directly |
| Breach exposure | Every service is a target | Identity provider is a single point of failure | Data stays distributed; no large central database |
| Can the middleman see your activity | Not applicable | Yes, the provider can observe usage | No intermediary in the transaction |
| Portability | None | Within the federation only | Credentials work anywhere that accepts the standard |
| Everyday example | A website account | “Log in with Google” | A digital wallet holding a mobile driver’s licence |
Why is digital identity changing?
Digital identity is changing because the centralised model is failing under three pressures at once: record-breaking data breaches, stricter privacy regulation, and AI-generated fraud. Each pressure pushes in the same direction, towards systems where personal data is not pooled in one place.
The breach problem keeps growing. The Identity Theft Resource Center tracked 3,322 data compromises in the United States in 2025, the highest annual count it has ever recorded. Regulators have responded with rules such as GDPR that make holding large stores of personal data a liability rather than an asset. And generative AI has made identity fraud cheap and scalable: one industry analysis found a 311% increase in synthetic identity document fraud between early 2024 and early 2025. We covered how AI reshapes the verification problem in more detail in our Verifiable Credentials guide.
How do Verifiable Credentials fit into digital identity?
Verifiable Credentials are the mechanism that makes decentralised identity work: digitally signed, tamper-evident credentials that you hold and present yourself.
The decentralised model depends on a verifier being able to trust a credential without contacting the issuer, and that is exactly the problem Verifiable Credentials solve through cryptographic signatures.
What is a digital identity wallet?
A digital identity wallet is an app that stores your credentials, lets you prove your identity, and gives you control over what you share and with whom.
It keeps credentials secured on your device, shows you exactly what a verifier is requesting before you share anything, and supports selective disclosure, which means proving a single fact (e.g. that you are over 18) without revealing the entire credential it came from (which likely contains your full date of birth and address, for instance).
What do real digital identity systems look like?
Governments across Europe and Asia are already running national digital identity systems at population scale, and several are now adding decentralised, wallet-based capabilities. Four examples show where things stand in 2026.
The European Union. Under the eIDAS 2.0 regulation, every EU member state must offer citizens at least one EU Digital Identity Wallet by 24 December 2026, with banks, telecoms, and large platforms required to accept it from late 2027. It is the largest decentralised identity rollout ever attempted, covering roughly 450 million people.
Singapore. Singpass serves around 5 million users, about 97% of residents aged 15 and above, and handles over 40 million transactions a month. It began as a federated login and has steadily added citizen-controlled features, including digital credentials that can be presented from the app.
The United States. Mobile driver’s licences built on the ISO/IEC 18013-5 standard are live in 21 states plus Puerto Rico as of early 2026, accepted at TSA airport checkpoints. Adoption is state by state rather than national, which makes the US a useful case study in interoperability.
India. Aadhaar is the world’s largest identity programme, with around 1.34 billion holders. A new Aadhaar app launched in January 2026 lets residents share identity attributes selectively instead of handing over photocopies, a decentralised feature added on top of a centralised system.
Digital identity, digital ID, SSI, DID: what’s the difference?
These terms overlap but are not interchangeable: digital identity is the broad concept, digital ID usually means a government-issued credential, and SSI and DID are specific technical approaches to the decentralised model.
| Term | What it means | How it relates |
|---|---|---|
| Digital identity | All the information representing you in digital systems | The umbrella concept |
| Digital ID | A government-recognised digital credential, such as a national ID app | One instance of digital identity |
| Decentralised identity | The model where you hold and present your own credentials | One of the three architectures |
| Self-sovereign identity (SSI) | A philosophy of decentralised identity emphasising full user control | The principles behind the decentralised model |
| Decentralised identifier (DID) | A W3C standard for identifiers not tied to any central registry | A technical building block |
| Verifiable credential (VC) | A digitally signed, tamper-evident credential | The data format that carries the claims (full guide) |
Key takeaways
- A digital identity links an identifier to verified attributes, plus a way to prove the link belongs to you. Identity is who you are; credentials are the claims about you.
- Three models exist. Centralised (each service holds your data), federated (one login reused everywhere), and decentralised (you hold credentials in a wallet and share them directly).
- The shift to decentralised identity is driven by real pressure: record data breaches, privacy regulation, and AI-generated fraud that centralised verification struggles to catch.
- Verifiable Credentials are the engine of the decentralised model. They let a verifier trust a credential without contacting the issuer. Our Verifiable Credentials guide covers how.
- This is no longer theoretical. The EU wallet deadline is December 2026, Singpass covers nearly every Singapore resident, 21 US states have live mobile driver’s licences, and Aadhaar covers 1.34 billion people.
Sources: Kennedys Law on the EU Digital Identity Framework · Credence ID mDL State Tracker · Singpass · Aadhaar overview · Varonis data breach statistics · DeepStrike deepfake statistics
Frequently asked questions
Is digital identity safe?
Safety depends on the model, not the word “digital”. Centralised systems concentrate risk in large databases; decentralised systems reduce it by keeping credentials on your device and sharing only what each transaction needs. No model removes risk entirely, and wallet security and recovery processes matter as much as the architecture.
Who owns and controls my digital identity?
In centralised and federated systems, the organisation running the system controls it, and your access can be suspended by that party. In decentralised systems, you hold the credentials and decide what to share, though issuers can still revoke a credential they issued, just as a regulator can withdraw a licence.
Is digital identity the same as biometrics?
No. Biometrics (fingerprints, face scans) are one way to authenticate, that is, to prove you are the person linked to an identity. A digital identity system may use biometrics, passwords, or hardware keys; the identity itself is the linked set of identifiers and attributes, not the fingerprint.
Do digital identities work across borders?
Increasingly, within defined frameworks. The EU wallet is designed to work across all member states, and standards such as ISO/IEC 18013-5 and W3C Verifiable Credentials mean a credential issued in one country can, in principle, be verified in another. Global interoperability remains a work in progress, and legal recognition varies by jurisdiction.
Is a digital identity legally recognised?
In a growing number of places, yes. eIDAS 2.0 gives EU wallets legal standing across the union, Singapore’s Singpass is recognised for government and commercial transactions, and US states with mobile driver’s licences accept them for official purposes within the issuing framework. Recognition is jurisdiction-specific, so it always pays to confirm local rules.