Digital Identity: How Online Identity Really Works
Digital identity is the set of credentials, devices and records that prove you are you online, and it is now the main battleground for account security.
In this guide
Every login is a small identity decision: is this person who they claim to be, and should they be allowed to do this? Most systems answer with three factors: something you know, something you have and something you are. The strength of a login comes from combining factors and reducing how much a stolen factor is worth.
Digital identity is broader than passwords. It includes government-issued digital IDs, corporate single sign-on, social logins, device-bound passkeys and the verified attributes held in a digital wallet. The design question is always the same: who controls the credential, and what happens when it is lost or stolen?
From passwords to passkeys
Passwords are a shared secret, which means both the user and the service know them. That makes them phishable and reusable across breaches. Multi-factor authentication helps by adding a code or a hardware key, but one-time codes can still be relayed by a determined attacker.
Passkeys replace the shared secret with a cryptographic key pair. The private key stays on your device, protected by the device unlock, and the service stores only the public key. There is nothing reusable to phish, which is why passkeys are a meaningful improvement rather than another layer of friction.
- Something you know: password or PIN.
- Something you have: phone, security key or passkey.
- Something you are: fingerprint or face.
- Context: location, device and behaviour signals.
Verification versus authentication
Authentication happens every time you sign in. Verification happens when a service checks a real-world attribute such as your age, address or right to work. Verification usually requires a document, a selfie or a database check, and it creates a privacy problem because the service may retain more than it needs.
Good systems separate the two. A site might verify your age once and then store only a yes/no claim, not your passport image. Reusable verified credentials, held in a wallet and shared selectively, aim to make that separation practical.
Digital wallets and reusable credentials
A digital identity wallet stores signed credentials on a device and presents only the attributes a service requests. Instead of uploading a driving licence, you might prove that you are over 18 and live in a certain region. The signature lets the receiver trust the issuer without contacting them.
The model depends on standards, issuer trust and recovery. If a phone is lost, the credentials must be revocable and restorable. If an issuer is compromised, relying parties need a way to check revocation. These are operational problems, not just cryptography.
Protecting your identity in practice
Turn on phishing-resistant multi-factor authentication, preferably a passkey or hardware key, for email, banking and work accounts. Email is the recovery channel for almost everything else, so it deserves the strongest protection you can use.
Reduce the number of places that hold your identity data. Use unique passwords in a manager, review app permissions, and be sceptical of any message that asks you to confirm a login you did not start. Recovery flows are a favourite target because they bypass the front door.
Key facts at a glance
Frequently asked questions
Are passkeys safer than passwords?
Yes, for phishing resistance and reuse. A passkey cannot be guessed or copied from a server breach, and it is bound to the site it was created for. Recovery still needs care, especially if all your devices are lost.
Is a digital ID the same as a login?
No. A digital ID proves attributes about you, such as your name or age. A login proves control of an account. Some systems combine them, but they are different jobs.
What should I do if my identity is stolen?
Secure your email and financial accounts first, change reused passwords, enable strong MFA, and contact the relevant providers. In many countries you can also place a fraud alert or freeze credit.
