What is a USB token? Do you need one for e-invoicing in Vietnam?

Learn how USB tokens work, their practical disadvantages, and how Invoi.vn provides built-in HSM eSignature at no additional charge in every account.

When using electronic invoicing software in Vietnam, you may be asked to plug a USB token into your computer to sign an invoice. But what is a USB token? Is it mandatory for electronic invoicing? And can you sign invoices without carrying a physical device?

This guide explains the fundamentals of USB tokens, the legal framework for digital signatures, the limitations of traditional signing tools, and how Invoi.vn makes digital signing more convenient with HSM.

1. What is a USB token?

A USB token is a small hardware device used to store cryptographic keys and digital certificates for digital signing.

In Vietnam, businesses commonly use USB tokens to sign electronic invoices, tax declarations and other electronic documents.

A USB token does not store the invoices themselves. Instead, it protects the signing key and enables software to perform digital-signature operations using the corresponding cryptographic key.

How does a USB token work?

A typical electronic invoicing process using a USB token involves four steps:

1. Create the invoice: The business prepares an invoice in its electronic invoicing software.
2. Connect the device: The user plugs the USB token into a computer and enters its PIN if required.
3. Sign digitally: The software uses the cryptographic key to generate a digital signature for the invoice data.
4. Complete the process: The invoice is processed according to the applicable issuance workflow, including transmission to the tax authority where required.

A digital signature helps establish the origin and integrity of signed data. The validity of an invoice also depends on the certificate, the signer's authority and applicable legal requirements.

2. Do digital signatures have the same legal value as handwritten signatures?

A valid digital signature can have legal effect comparable to a handwritten signature when the applicable legal requirements are met.

In Vietnam, electronic signatures and trust services are regulated by the Law on Electronic Transactions No. 20/2023/QH15 and Government Decree No. 23/2025/NĐ-CP, which took effect on 10 April 2025.

For digital signatures, legal validity does not depend solely on whether someone has completed a signing action. The signature must satisfy the applicable requirements concerning the digital certificate, signing key, data integrity and permitted scope of use.

Do electronic invoices require handwritten signatures?

Electronic invoices are created and processed as electronic data. A handwritten signature on paper is therefore not the signing method used for an electronic invoice.

Instead, businesses must follow the applicable requirements for creating, signing and issuing electronic invoices. Where a digital signature is required, the business must use a solution that meets the relevant requirements.

It is important to distinguish two concepts:

• Legal validity: A valid digital signature can satisfy legal requirements for authentication and signing.
• Signing method: Digital signing can be performed using a USB token or a suitable remote signing solution, such as HSM.

Businesses therefore do not necessarily need a USB token to sign electronic invoices.

Reference: Government Decree No. 23/2025/NĐ-CP.

3. The disadvantages of USB tokens

USB tokens have been widely used for years. However, dependence on physical devices and locally installed software can introduce practical limitations.

Dependence on a physical device

Users need access to the USB token whenever a signing operation requires it. If the device is forgotten, lost or damaged, work may be interrupted.

Dependence on computers and operating systems

USB tokens typically require compatible signing software or device drivers.

In Vietnam, many USB token signing utilities are primarily designed for Windows. macOS support may be limited depending on the provider, while direct signing from mobile devices is often less convenient or unsupported.

This can make it difficult for business owners who want to sign invoices using a MacBook, iPhone, iPad or a device other than a compatible Windows computer.

Additional software installation

Depending on the provider, users may need to install drivers, signing applications or browser components.

When changing computers, reinstalling an operating system or encountering compatibility problems, users may need to reconfigure the environment before signing again.

Coordination between business owners and accountants

In many small businesses, the business owner and accountant are different people. If the signing process depends on a physical USB token held by one person, invoice issuance can be delayed when that person is unavailable.

USB tokens can still work well in an appropriately managed process. However, businesses must carefully manage devices, PINs and signing permissions, and avoid unsafe sharing of authentication credentials.

4. HSM eSignature: No USB token, more flexibility across devices

HSM stands for Hardware Security Module. It is a dedicated hardware system designed to protect cryptographic keys and perform cryptographic operations in a controlled environment.

With remote HSM signing, the signing key is protected within dedicated infrastructure rather than requiring the user to connect a USB token directly to a computer.

Users can initiate signing through an online platform or application, depending on the provider's implementation.

How does HSM address USB token limitations?

• No USB token required: No physical signing device to carry or connect.
• More device flexibility: Sign using compatible Windows, macOS, mobile or tablet devices.
• No USB token driver dependency: Reduce the need to install and manage device-specific software on individual computers.
• Remote working support: Business owners can handle signing tasks away from the office, subject to authentication and permissions.
• Centralized controls: Providers can implement authentication, signing permissions and activity monitoring.

HSM does not automatically eliminate every security risk. Businesses still need appropriate user authentication, secure account access and controlled signing permissions.

5. Which digital signature certificates do businesses need?

Not all electronic signatures are interchangeable in every transaction.

For electronic invoicing, businesses must select a digital signature that meets the applicable legal requirements. When using a public digital signature, the certificate must be issued by a public digital signature certification service provider that meets the relevant licensing requirements.

The key distinction is that HSM and USB token are technical signing methods, not different levels of legal validity. Legal validity depends on the signature, certificate, service provider and compliance with the applicable requirements, not simply where the signing key is stored.

Businesses can therefore use either USB token signing or remote HSM signing, provided the selected solution meets the relevant requirements.

6. Verify the digital certificate's status before signing

One important consideration when choosing a signing solution is the status of the digital certificate.

Under Decree No. 23/2025/NĐ-CP, signatories must check their certificate's status before signing. Recipients must also verify the relevant certificate information and status before accepting a digital signature, as required by the decree.

A valid digital signature certificate must be unexpired and not suspended or revoked. If the certificate is suspended, revoked or expired at the time of signing, the signature does not meet the corresponding validity requirements.

For public digital signatures, the verification process also involves checking the status of the service provider's certificate through the prescribed systems.

Businesses should therefore look beyond whether software allows them to sign an invoice. They must also ensure that the certificate is valid, used within its permitted scope and subject to the required verification procedures.

Reference: Articles 15 and 16 of Decree No. 23/2025/NĐ-CP.

7. invoi.vn: Built-in HSM eSignature at no additional charge

invoi.vn enables businesses to create and manage electronic invoices alongside quotations, customers, suppliers and related financial information on one platform.

HSM eSignature is built into every Invoi.vn account at no additional charge for the signing feature.

You do not need to purchase or plug in a USB token to use the HSM solution integrated into Invoi. Signing is performed through the platform using any device with internet connection.

What can you do with invoi.vn?

• Create and manage electronic invoices on one platform.
• Use built-in HSM eSignature without a USB token.
• Work across supported devices, including computers and mobile devices.
• Manage quotations, invoices, customers and suppliers in one place.
• Collaborate with your accountant using shared company data.

Invoi is designed to help business owners and accountants work on the same platform, with company information managed centrally rather than scattered across devices, emails and messages.

No USB token. No separate HSM feature fee. More time to focus on your business.

Explore invoi.vn at https://invoi.vn/

8. Should your business switch from a USB token to HSM?

The answer depends on your workflow, legal requirements and existing digital-signature solution.

A USB token may remain suitable if your business has a stable signing process, uses compatible computers and has no significant device-management problems.

An HSM-based solution is worth considering if your business wants to:

• Sign across different types of devices.
• Reduce dependence on only Windows computers and physical USB devices.
• Support remote work for business owners.
• Simplify coordination between business owners and accountants.
• Reduce the need to install and manage signing devices.

Before choosing a solution, verify the provider, certificate, authentication process, permitted scope of use, certificate-status checks and compliance with the requirements applicable to electronic invoicing.

Conclusion

USB tokens are a common way to use digital signatures, but they are not the only option for electronic invoicing in Vietnam.

HSM-based signing allows users to sign remotely without depending on a physical USB device, while supporting more flexible working across compatible devices.

Invoi.vn includes HSM eSignature in every account at no additional charge for the signing feature, helping businesses manage quotations, invoices and business finances more conveniently.

Explore invoi.vn to manage quotations, invoices and business finances on one platform: https://invoi.vn/