Digital identity is the collection of information, credentials, attributes, identifiers, and authentication relationships used to represent and recognise a person, organisation, device, application, or other entity in digital systems. It allows a system to distinguish one entity from another and determine what that entity is permitted to do. A digital identity can include an account identifier, username, cryptographic key, digital certificate, biometric characteristic, device credential, authentication token, organisational role, or verified attributes. The meaning varies by context because digital identity is not necessarily a single universal record. One person can have many digital identities across different services, and one digital identity can contain multiple attributes and credentials.
Identity and authentication are related but distinct concepts. Identification is the process of claiming or indicating which identity is associated with an interaction, such as providing a username or account identifier. Authentication is the process of establishing confidence that the entity controlling the interaction is entitled to use that identity, commonly through passwords, possession of a device or security key, cryptographic credentials, biometrics, or combinations of factors. Authorisation then determines what the authenticated identity is allowed to access or perform. This distinction is fundamental because successfully authenticating an identity does not necessarily grant unrestricted access. A digital identity system therefore connects representation, authentication, attributes, and access decisions.
Digital identities can be established and managed in many ways. A traditional website may create an account identified by an email address and protected by a password. An organisation may use a central identity provider to authenticate employees across multiple applications through single sign-on. A device may have a hardware-backed cryptographic identity used for network or service authentication. Public-key infrastructure can associate certificates with identities for particular purposes.
Federated identity allows one organisation or identity provider to authenticate a user to another service according to an established trust relationship. Decentralised identity models can instead allow individuals to hold verifiable credentials and present selected attributes without relying on a single central identity database for every interaction.
Digital identity often consists of attributes as well as identifiers. An attribute is a property associated with an identity, such as age range, employment status, membership, qualification, or account role. Identity systems can sometimes verify an attribute without disclosing unnecessary information. For example, a service might need assurance that a user meets an age requirement rather than needing the user's exact date of birth. This principle is related to data minimisation and selective disclosure.
Cryptographic credentials and verifiable credentials can support mechanisms in which a trusted issuer attests to an attribute and a holder presents evidence to a verifier. The technical and legal frameworks governing such systems differ considerably, so a digital identity should not automatically be equated with a blockchain identity or a government identity document.
Digital identity is central to access control and cybersecurity. Identity and access management systems determine which identities exist, how they authenticate, which resources they can access, and how privileges are changed or revoked. Important concepts include least privilege, role-based access control, attribute-based access control, multi-factor authentication, privileged access management, identity lifecycle management, and account recovery. Identity lifecycle processes cover activities such as account creation, verification, credential issuance, changes to roles, suspension, and deletion. Poor identity management can allow attackers to take over accounts, retain access after leaving an organisation, escalate privileges, or exploit weak recovery procedures. Strong digital identity therefore requires both secure credentials and disciplined lifecycle management.
Digital identity also has privacy implications. A system that assigns a persistent identifier across many services can enable extensive profiling if different activities become linkable. Conversely, using separate identifiers or selective disclosure can reduce unnecessary correlation. Centralised identity databases can create valuable targets because compromising one system may expose large quantities of information. Federated and decentralised approaches distribute some responsibilities but introduce their own trust, interoperability, recovery, and governance challenges. Privacy-preserving identity systems therefore seek to establish sufficient assurance for a transaction while minimising unnecessary disclosure and avoiding excessive persistence of identifiers.
Digital identity is not necessarily equivalent to a person's legal identity. An online account can represent a pseudonym, a business role, a device, or a service account rather than a legally verified individual. Some systems require strong identity proofing to establish that an account corresponds to a particular real-world person, while others intentionally permit pseudonymous participation. Identity assurance describes the confidence that an identity assertion corresponds to the claimed entity, and different applications require different levels of assurance. A discussion forum may not need the same identity proofing as a financial service, government service, or high-security enterprise system.
Digital identity is therefore a foundational concept connecting people and other entities to digital services. It encompasses identifiers, attributes, credentials, authentication, authorisation, trust relationships, and lifecycle management. Good digital identity design balances security, usability, privacy, interoperability, recovery, and governance. Passwords are only one possible component, while modern systems increasingly use multi-factor authentication, hardware-backed credentials, federation, and cryptographic protocols. The central purpose is to provide a reliable basis for recognising an entity and making appropriate access or transaction decisions without unnecessarily exposing information or granting privileges beyond what the authenticated entity requires.
