Abstract: A digital identity wallet system includes a web wallet and Identity Cloud. The web wallet leverages browser APIs, platform authenticators, and secure device hardware to create, store, and use cryptographic keys. The Identity Cloud stores data encrypted on a per-user basis, so only a specific user can decrypt it, using the web wallet in a particular web browser, on a particular device. The web wallet, in conjunction with the browser and device, leverages cryptographic keys to perform all cryptographic operations locally. This allows the Identity Cloud to only handle sensitive data that's already been encrypted on a per-user basis before it receives it.