# CodeB Wallet – Your European digital identity. On your Android phone. Source: https://myeuid.app/en/ Last updated: 2026-10-20 CodeB Wallet is an Android app for the European Digital Identity (EUDI) framework under eIDAS 2.0. Keep your digital ID, mobile driving licence and membership card on your phone, show them in person or online, check other people’s IDs and sign PDFs – and decide for yourself what you share. Made by Aloaha Limited, Malta – active in PKI, PDF development and digital signatures since 2003 and the maker of the CodeB product family. Status: CodeB Wallet for Android is available on Google Play by invitation – write to info@aloaha.com. ## In short - **What:** CodeB Wallet is an Android wallet app for the European Digital Identity (EUDI) framework – eIDAS 2.0, Regulation (EU) 2024/1183. - **Who:** developed by Aloaha Limited, Malta – active in PKI, PDF development and digital signatures since 2003, maker of the CodeB product family. - **Brand:** CodeB is a brand of Aloaha Limited, Malta. CodeB Wallet is developed and provided by Aloaha Limited. - **Made in Malta:** designed and developed in Malta by Aloaha Limited. - **Small download:** about 17 MB (the EU reference wallet’s demo APK is 363 MB) (as of 19.10.2026). - **Documents:** Person Identification Data (PID) including the German PID, mobile driving licence (SD-JWT VC and ISO/IEC 18013-5 mdoc) and the CodeB membership card – issued by the CodeB issuer (phone.codeb.io) via OpenID4VCI. Also: a Photo ID from your passport or ID card, optionally with the Digital Travel Credential (ICAO DTC type 1). - **ID cards and passports:** reads the chip of electronic passports and ID cards (eMRTD, ICAO Doc 9303) and checks it against the issuing country’s certificates. By our estimate that covers well over a billion documents worldwide: ICAO counts more than one billion ePassports from over 140 issuing states and organisations, and chip ID cards in Europe add, by our estimate, well over 200 million more. The chip can also be used to sign up for your PID at the CodeB PID Provider – right after installing the app. When the CodeB PID Provider reads the chip, the chip and the server set up their own end-to-end encrypted and authenticated channel (PACE, Chip Authentication, Secure Messaging): your phone only forwards messages that nobody in between can read or change unnoticed. - **Sharing:** online via OpenID4VP; in person via QR code or NFC tap, with the data sent over Bluetooth Low Energy (ISO/IEC 18013-5) – works offline. Selective disclosure, for example only “over 18”. - **Wallet and verifier in one:** the same app that holds your ID also checks someone else’s ID or age as an ISO/IEC 18013-5 reader, including a revocation check – no separate verifier app needed. - **PDF signing:** advanced electronic signatures (AdES) in PAdES format with trusted timestamp via the CodeB signing service, using Aloaha’s own PDF signing technology. The document stays on your phone. Signatures from the signing service are not qualified electronic signatures (QES). Also: signing with your own signature card over NFC – the Maltese eID or residence card, D-Trust Card 5, a German health professional card (HBA) or a German electronic health card (eGK). The key stays on the card, and the app shows whether the card’s certificate states a qualified electronic signature. CodeB Wallet itself is not certified. - **Privacy:** documents and history stay on your phone; keys in secure hardware; no ads, no tracking, no analytics. - **Languages:** this website and the app are available in English, German and Maltese. The app follows your phone’s language, and you can also choose it under Settings → Language. - Not an official government wallet and not certified – designed to comply with eIDAS 2.0 and the EUDI Wallet Architecture and Reference Framework (ARF). ## Everything you need to prove who you are – digitally CodeB Wallet keeps your documents on your phone, shows them in person or online when you decide, checks other people’s IDs and signs PDF documents. ### Personal ID (PID) Add your Person Identification Data (PID) – including the German PID – from the CodeB issuer (phone.codeb.io). Issuance uses OpenID4VCI; available as SD-JWT VC and ISO mdoc. ### Pseudonyms – passkeys without your name Sign in to websites and apps with a passkey from CodeB Wallet: a new pseudonym for every website, kept in your phone’s secure hardware, confirmed with your fingerprint or screen lock. Websites cannot link your pseudonyms. ### Self-protection The app notices when it was changed or is being inspected while it runs, and then refuses to use your keys and documents. Our own code – nothing is sent anywhere. ### Mobile driving licence Keep a mobile driving licence (mDL) on your phone – as SD-JWT VC for online use and as ISO/IEC 18013-5 mdoc for showing it in person. ### CodeB membership card Add the CodeB membership card from the CodeB issuer and show it like any other document in your wallet. ### Add documents your way Choose the issuer directly in the app, or scan the QR code an issuer gives you – the wallet then starts the issuance for you. Adding a card again replaces the older copy, so your wallet does not fill up with duplicates. ### Show your ID in person Start with a QR code or an NFC tap; the data then goes phone-to-phone over Bluetooth Low Energy. Both BLE roles are supported for broad reader compatibility, and it works offline. ### Share only what is needed Selective disclosure: confirm “over 18” without revealing your date of birth, or share just the details a service really needs. ### Prove your age – without showing your birthday Show only that you are over 18 – online on websites and apps (OpenID4VP) and in person (ISO/IEC 18013-5). CodeB Wallet can also check someone’s age as a reader, and websites can use the online age check. ### Share online Websites and apps request data via OpenID4VP. You see every request – who is asking and for what – and confirm with your PIN or biometrics. ### Verify someone’s ID or age CodeB Wallet works as an ISO/IEC 18013-5 reader with a clear verdict – trusted, look closer or do not accept – including a revocation status check. Nothing is stored. ### Check an ID back to back No QR code needed: hold the two phones back to back. The checking phone reads the other phone’s ID over NFC and Bluetooth – handy at a counter or between two CodeB Wallets. ### Door and PC access (CodeB Access) Your organisation can give you an access card in CodeB Wallet. Choose it, tap “Use at reader” and hold your phone to a door or PC reader: the phone answers with the card’s signed data and a fresh signature from a key that never leaves the phone’s secure hardware. Only the card you chose answers, for up to five minutes, and only while your phone is unlocked – it never interferes with your other cards or payment apps. Works offline. Also works with door readers of the open PKOC standard (PSIA): your phone answers with its own public key, which never leaves the phone’s secure hardware. ### Phone as a PKI card for Windows sign-in Your organisation can issue PKI cards to CodeB Wallet, and your phone then acts as a contactless PKI smart card at a Windows PC with an NFC reader. A read/write PKI card is filled by Windows itself with your sign-in certificate; a read-only PKI card carries your organisation’s signing certificate, so programs on the PC can sign with it. Every use needs the card PIN. The read/write card’s key is made in your phone’s secure hardware and never leaves it; for the read-only card, your organisation’s server puts its signing key into your phone’s secure hardware. Only the card you chose answers, and only while your phone is unlocked. Several PKI cards can be held side by side; each shows the name from its certificate. A light on the card screen shows when the phone is connected to the PC’s reader. In the app you can change the card PIN, unblock a read-only card with its PUK, and remove certificates from a read/write card. ### Your phone as an NFC tag An NFC memory card from your organisation turns your phone into a standard NFC tag: a link, a text or a contact card that any phone or NFC reader can read – read-only, or writable so a check-in desk or smart-home reader can store new content on your phone. Works with Home Assistant. ### Read ID cards and passports (eMRTD) Hold a chip ID card or an ePassport to your phone: CodeB Wallet reads the data on the chip – name, date of birth, nationality, document number, expiry date and the photo – and checks that the issuing country signed it and that the chip is not a copy. You open the chip with the card access number (CAN) or by scanning the machine-readable zone with the camera. Everything happens on your phone. If you save it, it appears as its own card on the home screen, encrypted on your phone. Scanning works for the two long lines of a passport as well as the three lines of an ID card; a switch turns on the camera light in poor light. ### Remote ID verification for organisations Organisations check a person’s passport or ID card remotely: the person holds the document to the phone, and the server reads the chip itself and checks the issuing country’s signature and that the chip is no copy – instead of photos or video calls of the document. ### Get your PID with your ID card When you add your Personal ID (PID) from the CodeB PID Provider, you can use the chip of your ID card or passport instead of typing your details: the provider’s server reads and checks the chip itself through your phone and fills in your details from it. This works right after installing the app – no other document needed. Your phone shows the server that it runs the genuine CodeB Wallet (Android Key Attestation and Play Integrity). ### Free CodeB account in the app Create your CodeB account right in the app with your passport or ID card: phone.codeb.io checks that the chip is genuine, you confirm your e-mail address with a code, and you can sign 5 of your own PDFs a day and add the test PID and Photo ID. A document-checked guest account – no spam, no paperwork. The app links this phone’s wallet to your account – if the phone is lost, revoke it on your account page. ### Photo ID from your passport or ID card A Photo ID (ISO/IEC TS 23220-4, eu.europa.ec.eudi.photoid.1) issued from your checked passport or ID card. If you agree, it also carries the chip data as a Digital Travel Credential (ICAO DTC type 1), so a verifier can check the issuing country’s signature itself. ### Trusted issuer certificates Manage the list of issuer certificates you trust when verifying. CodeB’s own issuer certificate is built in; you can import further certificates. ### Sign PDF documents Sign PDFs with an advanced electronic signature (AdES) – PAdES with trusted timestamp – via the CodeB signing service. You confirm every signature; the PDF stays on your phone. ### Sign with your own signature card (Maltese eID) Hold your signature card to the phone – the Maltese eID or a Maltese residence card, a D-Trust Card 5, a German health professional card (HBA) or a German electronic health card (eGK) – and sign PDFs with the key on the card: no browser, no account. You enter the card access number (CAN) and your signature PIN; the key never leaves the card. The app shows whether the card’s certificate states a qualified electronic signature. ### Sign in with your Maltese eID card Sign in to phone.codeb.io with the Maltese eID card: scan the QR code on the sign-in page, hold the card to your phone and enter the card’s authentication PIN. The card signs a one-time challenge; your PIN and the card’s key never leave the card, and the sign-in completes in your browser. ### Ask others to sign – from your phone Sign in to your CodeB account in the app and send PDFs to other people to sign, one after the other. Follow every answer, save the signed PDF and check any PDF’s signatures – plus two-step sign-in with the app’s own one-time codes and an encrypted backup copy on your account. ### One-time codes for two-step sign-in A built-in authenticator: scan a website’s QR code and get six-digit sign-in codes (TOTP) on your phone, even offline. Pin, sort into groups such as Work or Family, search, and move all codes to a new phone with a few QR codes. ### History A history of everything you added, shared and signed – with details – kept only on your phone. ### See who saw your document Each document shows the recent times you shared it – who received it, when, and exactly which details. One tap opens the entry, where you can ask for deletion or report a verifier. Taken from the history on your phone; nothing is sent anywhere. ### Always up to date The wallet checks the status of your documents automatically and can renew them before they expire, where the issuer supports it. ### Reminded before a document expires CodeB Wallet tells you on your phone when a document is about to expire or could not be renewed automatically – one tap opens it to renew. The reminder is created on your phone; nothing is sent anywhere. ### Made for everyone Built with the European Accessibility Act in mind: works with the TalkBack screen reader, with very large text and with animations switched off – results, checks and steps are read out clearly, and card colours stay readable. ### Guides and changelog Built-in “Learn more” guides explain every function in plain words, and an in-app changelog shows what is new. Swipe through your cards on the home screen. ## Your free CodeB account – opened with your passport or ID card Signing your own PDFs with the CodeB signing service and the test PID and Photo ID need an account on phone.codeb.io. You open it right in the app, in about two minutes: hold your passport or ID card to your phone, confirm your e-mail address – done. No form, no captcha, no waiting for approval. - Sign 5 of your own PDFs a day – documents others ask you to sign do not count - Add the test PID and Photo ID straight to your wallet - Works on a freshly installed app – no other card needed - Any passport or ID card with a chip, from any country **Why a passport or ID card?** To keep spam and bots out, phone.codeb.io reads the chip of your document through your phone and checks that it is genuine – and that the app is the genuine CodeB Wallet on a genuine phone. One account per document and per phone. The CAN, the machine-readable zone and the raw chip data are never kept. It is a document-checked guest account – not an official identity and not a qualified signature. Step by step: https://myeuid.app/en/free-account.html · in the app: https://myeuid.app/open/account ## Sign in without a password – and without your name CodeB Wallet already does what the EU Digital Identity Wallet architecture (ARF 3.0, Topic 11) describes for pseudonyms: on any website that offers passkeys, the app creates a new pseudonym just for that website. You confirm with your fingerprint, face or screen lock – no password to remember, nothing to phish, and no name or e-mail address handed over. - A new pseudonym for every website – websites cannot link them with each other - The key stays in your phone’s secure hardware and is used only after you confirm - Built on the passkey standard (W3C WebAuthn) that many websites already support - Rename or delete your pseudonyms in the app – every use is in the History **Why pseudonyms?** A password can be guessed, leaked or phished, and the same e-mail address lets websites follow you from one to the next. A pseudonym is a key pair made for one website only: the website gets the public key, your phone keeps the private key. It contains nothing about you and works only on the website it was made for. Needs Android 14 or newer. A pseudonym signs you in – it does not prove who you are; for that, you share your PID. How it works: https://myeuid.app/en/passkeys.html · test page: https://phone.codeb.io/pseudonym-test.html ## Four steps from issuer to verifier The EUDI wallet model separates the issuer of a credential, you as the holder, and the service that checks it. 1. **Get a document** – Choose an issuer in the app – such as the CodeB issuer – or scan an issuer’s QR code. Issuance uses the OpenID4VCI protocol. 2. **Keep it on your phone** – The document is stored on your device. Its keys are protected by the phone’s secure hardware; the wallet is locked with PIN or biometrics. 3. **Present it** – Show it in person via QR code or NFC tap with data over Bluetooth Low Energy (ISO/IEC 18013-5), or online to a website or app via OpenID4VP. 4. **You decide what to share** – Before anything leaves your phone, you see who is asking and for what – and you confirm with your PIN or biometrics. Only the attributes you approve are shared. ## The complete wallet ecosystem – from one company in Malta, for Malta and the rest of the world CodeB Wallet is one part. On phone.codeb.io, Aloaha also runs everything around it – wallet provider, issuers, verifier, status lists and signing service – for public bodies, issuers and relying parties to test. ### Wallet provider Checks that the app is the genuine CodeB Wallet on a phone with a locked, verified system – Android Key Attestation against Google’s pinned root and revocation list, with Play Integrity as a second signal – and issues wallet instance and wallet unit attestations. It can revoke a wallet unit; revoked units are published in a status list. ### PID provider Issues the EU Person Identification Data following the EU PID Rulebook, as SD-JWT VC and ISO mdoc, and a German PID. The identity data comes from the chip of your passport or ID card, read end to end by the server (PACE, Chip Authentication, Passive Authentication) – designed to follow ETSI TS 119 461, not certified. Issuer and document-signer certificates come from Aloaha’s own issuing CA. ### Attestation issuer Further credentials from the same issuer: mobile driving licence, Photo ID with Digital Travel Credential, membership cards, access cards and PKI cards for Windows – plus templates for organisations’ own credentials. ### Secure issuance OpenID4VCI with the high-assurance features: pushed authorization requests with PKCE, DPoP-bound tokens, wallet and key attestation checked on every issuance, and encrypted credential responses. ### Revocation and status Every credential carries a status entry: the IETF Token Status List as JWT and, for mdoc, as CWT, plus the W3C Bitstring Status List – optionally with shuffled positions, so observers cannot tell the order of issuance. ### Verifier for websites and apps An online verifier service for relying parties: OpenID4VP with signed requests, X.509 client identification and registration certificates, SD-JWT VC and mdoc, revocation check, EU trusted lists read automatically and OpenID Federation discovery. Tested with the EU reference wallet. Try the verifier test page, the online age check or read the integration guide. ### Relying-party register and access certificates A register of relying parties with the registration details the EU implementing rules list – legal name, identifiers, contact and intended use – with suspension and cancellation, and Aloaha’s own access-certificate CA modelled on ETSI TS 119 411-8, with a published policy and revocation list. Software key, for testing and private use. ### Data protection for relying parties Endpoints where a holder’s data-deletion request and a report to a data protection authority reach the relying party – the counterpart of the app’s data-deletion request. ### Signing service PAdES signatures with a trusted timestamp, signing requests to several people in turn, the Cloud Signature Consortium API v2 for remote signing, and a signature check for any PDF. Signatures from the service are advanced electronic signatures (AdES), not qualified. ### For developers API documentation with an OpenAPI description, the eMRTD reading API, the PKI card guide and the touchpoint guide. ## Built on open European and international standards CodeB Wallet follows the EU Architecture and Reference Framework (ARF) and is designed to comply with eIDAS 2.0. It is not certified and it is not an official government wallet. - Architecture and Reference Framework (ARF) (EU framework) - eIDAS 2.0 – Regulation (EU) 2024/1183 (Regulation) - OpenID for Verifiable Credential Issuance (OpenID4VCI) (Issuance) - OpenID for Verifiable Presentations (OpenID4VP) (Online) - ISO/IEC 18013-5 – QR code, NFC, Bluetooth Low Energy (both roles) (In person) - SD-JWT VC (Selective Disclosure JWT Verifiable Credentials) (Format) - ISO mdoc (mobile document) (Format) - PAdES baseline B-T (ETSI EN 319 142) – PDF signatures with trusted timestamp (Signing) - ETSI trusted lists (Issuer trust) - ICAO Doc 9303 – electronic passports and ID cards (eMRTD): PACE, BAC, Chip and Active Authentication, Passive Authentication (Chip reading) - ISO/IEC TS 23220-4 Photo ID with ICAO Digital Travel Credential (DTC type 1) (Photo ID) - ETSI TS 119 461 v2.1.1 – identity proofing: reading for the PID Provider is designed to follow it (extended LoIP); not certified (Identity proofing) - Signature cards over NFC – ISO/IEC 7816-4/-8, PACE (BSI TR-03110), CAdES/PAdES (ETSI EN 319 122 / 319 142), qcStatements (ETSI EN 319 412-5) (NFC) - OpenID4VC High Assurance Interoperability Profile (HAIP) – followed (Issuance and online presentation) - OAuth 2.0 DPoP (RFC 9449), Pushed Authorization Requests (RFC 9126), PKCE (RFC 7636) (Issuance security) - OAuth 2.0 attestation-based client authentication – wallet instance attestation (Wallet provider) - Android Key Attestation (Genuine app on a verified phone) - IETF Token Status List (JWT and CWT), W3C Bitstring Status List (Revocation) - ISO/IEC 18013-7 – mdoc online presentation (Online) - W3C Digital Credentials API – through Android’s Credential Manager, Android 14+ (Online) - OpenID Federation 1.0 (Trust discovery) - ETSI TS 119 475 – registration certificates (Relying-party registration) - ETSI TS 119 411-8 – access certificates (Relying parties) - EU PID Rulebook (PID) - Cloud Signature Consortium API v2 (Remote signing) - W3C WebAuthn – passkeys and pseudonyms (Pseudonyms) ### Why standards matter - Credentials issued according to these standards can be used with services that support the same EU framework. - CodeB Wallet is designed, built and maintained by Aloaha Limited in Malta. - Issuers are checked against EU trusted lists (ETSI) before their credentials are accepted. - Credentials can be checked for revocation. ## Privacy by design – your data stays with you Security is Aloaha’s core business: we have worked on PKI, PDF and digital signatures since 2003. - **Keys in secure hardware**: Cryptographic keys are kept in your phone’s secure hardware. - **Protects itself while it runs**: CodeB Wallet checks itself every time you open it: if it was changed, or another program is inspecting it (a debugger or a hooking tool), it stops and does not use your keys or documents until that is gone. These checks are our own code, without third-party libraries, and nothing about them is sent anywhere. For the same reason CodeB Wallet does not run on rooted phones, and it needs a phone with the Google Play Store. - **Proves it is genuine with your phone’s security chip**: When you add a card from the CodeB issuer, CodeB Wallet proves to our own wallet provider that it is the genuine app on a phone with a locked, verified system: the phone’s security chip certifies a fresh key for every request (Android Key Attestation). Google’s Play Integrity check is used as well, but issuing can keep working when Google’s service is unavailable. Only key certificates are sent – never your documents. - **PIN and biometrics**: The wallet is locked with a PIN and, if you wish, biometrics. Every share and every signature needs your confirmation. - **End-to-end protected chip reading**: When the PID Provider’s server reads your ID card or passport, the chip and the server set up their own encrypted, authenticated channel (PACE, Chip Authentication, Secure Messaging). Your phone only forwards the messages: neither the phone nor anyone in between can read them or change them unnoticed – at most the reading can be interrupted. The server also checks the issuing country’s signature on the data (Passive Authentication). - **Your signature card stays in charge**: When you sign with your own card, the key never leaves the card and every signature needs your PIN. - **Trusted issuers**: Issuer trust is checked against EU trusted lists (ETSI) and your list of trusted issuer certificates. - **Status checks**: Document status is checked automatically, so revoked documents are recognised. Where the issuer supports it, documents can be renewed automatically before they expire. - **On your device**: Your documents and your history are stored on your phone, not in a CodeB cloud. - **No ads, no tracking**: The app shows no advertising and contains no tracking and no analytics. - **Our servers protect themselves too**: Every server endpoint watches itself while it runs: anomaly detection, rate limits and refusal when in doubt. - **No database on the server**: All server state lives in encrypted, access-restricted files per customer – a small attack surface, and a full restore from a single backup. - **No tracking on our servers either**: No third-party analytics and no tracking on the server side. **This website does not track you** No analytics, no cookies, no external requests. Fonts and images are served from this site itself. ## PDF signing from a PDF specialist – since 2003 Aloaha has been active in PDF development and digital signatures since 2003. CodeB Wallet uses Aloaha’s own PDF signing technology – the same technology Aloaha uses on its servers. - Active in PDF development and digital signatures since 2003 (Heritage) - Aloaha’s own PDF signing technology (Own technology) - PAdES baseline B-T: signature with trusted timestamp (ETSI EN 319 142) - Advanced electronic signature (AdES) via the CodeB signing service (AdES) - Your own signature card over NFC – the key stays on the card (NFC) - The PDF stays on your phone (Privacy) ### What this means for you - The document never leaves your phone. - You confirm every single signature yourself. - The trusted timestamp records when the document was signed. - The same PDF signing technology runs on Aloaha’s servers. - Signatures from the CodeB signing service are advanced electronic signatures (AdES), not qualified electronic signatures (QES). With your own signature card, the card’s certificate decides – the app shows what it states. ## Two decades of smart cards and digital identity Aloaha Limited, the company behind CodeB Wallet, has built signing, PKI and smart card software since 2003. In 2012 Aloaha received the WIPO Award for Innovative Enterprises at the Malta Innovation Awards in Valletta, for being the first and only software company to develop middleware that works with many different smart cards. The certificate is signed by the Director General of the World Intellectual Property Organization. The same experience is in CodeB Wallet today: it signs with your signature card over NFC and reads the chip of passports and ID cards. WIPO Award for Innovative Enterprises, 2012 – Aloaha Limited, the maker of CodeB Wallet. Certificate: https://myeuid.app/assets/img/wipoaward.jpg ## Your own wallet app, built on CodeB Wallet CodeB Wallet is also available as a white-label solution: your name, your logo and your colours on proven wallet technology – for issuers, banks, public bodies, associations and companies that want to offer their own EU Digital Identity wallet app. - Your app name, logo, colours and store listing (Your brand) - Your issuers, documents and services preconfigured (Configuration) - PDF signing with your signing service or with signature cards over NFC (Signing) - OpenID4VCI, OpenID4VP, SD-JWT VC and ISO/IEC 18013-5 mdoc, built to conform with ARF 3 (Standards) - Keys in the phone’s secure hardware, PIN protection, no tracking (Security) - Updates and maintenance from Aloaha in Malta (Support) - Optionally with the backend – wallet provider, PID and attestation issuer, verifier, status lists and relying-party register – operated by Aloaha or handed over (file-based, no database) (Backend) ### Why a white-label wallet - Your customers see your brand, not ours. - Ready technology instead of years of development. - Android app with signature cards, chip reading and in-person sharing already built in. - Like CodeB Wallet itself, a white-label wallet is built to conform with the EUDI rules but is not certified. Contact: info@aloaha.com (subject: CodeB Wallet white label) ## Frequently asked questions ### What is CodeB Wallet? CodeB Wallet is an Android app that stores digital documents – such as your Person Identification Data (PID), mobile driving licence or CodeB membership card – and presents them in person or online. It can also check other people’s IDs and sign PDF documents. It is built for the European Digital Identity (EUDI) framework under eIDAS 2.0, Regulation (EU) 2024/1183, by Aloaha Limited, Malta. ### Is CodeB Wallet the German state wallet “d-you”? No. “d-you” is Germany’s official EUDI wallet, provided by the federal government from early 2027 – according to the federal guidance for municipalities from 2 January 2027 ([eudi-wallet.gov.de](https://eudi-wallet.gov.de/)). CodeB Wallet is a private wallet by Aloaha Limited, Malta, built on the EU wallet rules; it is not a certified EUDI wallet. You can use both on the same phone. ### Does CodeB Wallet replace my ID card or passport? No. Your physical ID card and passport stay valid and you still need them. CodeB Wallet is an additional way to show details from your documents digitally – and only the details you choose. ### Who can ask for my data, and how much can they ask for? Every request names who is asking. CodeB Wallet checks the relying party’s certificate and registration, shows the purpose, and warns you if data is requested that the relying party has not registered. You decide what you share – often a single detail is enough, for example “over 18” without your date of birth. ### Can I check someone’s EU wallet credential in person? Yes. Tap Verify in CodeB Wallet and scan the other person’s QR code: their wallet sends the details phone to phone over Bluetooth, and CodeB Wallet checks the issuer’s signature, that nothing was changed, the validity and the revocation status. Nothing is stored on your phone. In Germany, the federal checking app for in-person checks will not be available when d-you starts. ### Can private companies offer EU digital identity wallets? Yes – EU wallets are certified against EU-wide security and data-protection rules before they are recognised, and according to German federal guidance wallets from private providers can be added from 2028. CodeB Wallet is not certified today, and we do not claim it is. ### What are common misunderstandings about EU digital identity wallets? “The wallet replaces my ID card” – no, physical documents stay valid. “From 2027 everything only works with the wallet” – no, it is introduced step by step, using it is voluntary and the existing ways remain. “Without a smartphone I am excluded” – no, all existing ways stay open. Source: [German federal guidance for municipalities, 19 Oct 2026](https://www.digitale-verwaltung.de/Webs/DV/DE/digitale-identitaeten/eidas-2-0/eidas-2-0-node.html). ### What can CodeB Wallet do with a German ID card (Personalausweis)? With the card access number (CAN) printed on the front, CodeB Wallet reads the travel-document part of the chip – name, date of birth, nationality, document number, expiry date and the photo – and checks that the card is genuine (signature of the issuing state and chip authentication). With it you can also open a free CodeB account and receive a test PID and a Photo ID. ### Can CodeB Wallet use the online ID function (eID) of my Personalausweis? No. The online ID function with your six-digit PIN may only be used by services that hold a state authorisation certificate (Berechtigungszertifikat) and run an eID server; CodeB Wallet reads only the travel-document part with the CAN and never asks for your eID PIN. For the online ID function use the AusweisApp; Germany’s official digital ID in an EU wallet is set up from it in the state wallet d-you. The fingerprints on the chip can only be read by authorities – CodeB Wallet never reads them. ### Can I sign PDFs with my Personalausweis? No. The signature function of the German ID card can only be used with a special state signature-terminal certificate, so CodeB Wallet cannot sign with it. To sign PDFs in CodeB Wallet, use a signature card such as the D-Trust Card 5, the German health professional card (HBA) or the Maltese eID, or the CodeB signing service. ### Can I sign in to websites with CodeB Wallet without a password? Yes – passwordless sign-in with a passkey, on Android 14 or newer: switch CodeB Wallet on as a passkey provider (menu → Pseudonyms → Turn on in Android settings) and choose CodeB Wallet when a website offers a passkey. You get a separate pseudonym for every website – without your name – confirmed with your fingerprint, face or screen lock. In Chrome, set Settings → Autofill services to “Autofill using another service” so that Chrome passes passkeys to CodeB Wallet. ### What is the CodeB sign-in card? A card in CodeB Wallet that lets you sign in to phone.codeb.io without a password. Add it on https://phone.codeb.io/member-card.html (“My wallet credentials”) after signing in; then choose “Sign in with my CodeB sign-in card”. It holds only a random sign-in number for your account – it shows that you hold the card, not who you are. You can revoke it on the same page, for example after losing your phone. ### Do I need an account? How do I get one? Showing and checking IDs works without an account. For the CodeB signing service and the test PID and Photo ID you need a free account on phone.codeb.io, which you create in the app: Settings → Create a free CodeB account. You hold your passport or ID card to the phone, confirm your e-mail address with a code, and the document-checked guest account is ready – with 5 signatures of your own documents a day. Or tap myeuid.app/open/account on your phone – it opens the account screen directly. ### Can I ask other people to sign a PDF from the app? Yes. Sign in to your CodeB account in the app (Settings → CodeB account), open Signing requests and choose your PDFs, the signature level and the people who sign, in order. Each person gets an e-mail and signs with their own EU Wallet or signature card; you follow every step and save the signed PDF in the app. ### How can I check whether the signatures of a PDF are valid? Sign in to your CodeB account in the app (Settings → CodeB account) and tap “Check a signed PDF”. Choose any PDF on your phone: for each signature you see who signed, when, in which format (for example PAdES) and whether the document was changed afterwards. phone.codeb.io checks the PDF and keeps nothing. The certificates are not checked against the EU trusted lists; “qualified” is shown as the certificate states it. ### Can I sign a PDF that a website or another person sends me? Yes. On phone.codeb.io/sign-request someone uploads the PDFs and chooses who signs. You scan the QR code with the QR scanner in CodeB Wallet – or tap “Open in CodeB Wallet” – check who asks and every document, and sign with your signature card or the CodeB signing service. Invited people get an e-mail when it is their turn, and at the end everyone gets a link to the signed PDF. The manual chapter “Sign a document from a website (QR code)” shows every step. ### Who develops CodeB Wallet? CodeB Wallet is developed by Aloaha Limited, a company based in Malta. Aloaha has been active in PKI, PDF development and digital signatures since 2003 and makes the CodeB product family, including CodeB eForms Server and ZUGFeRD Pro. ### Which languages does CodeB Wallet support? CodeB Wallet is available in English, German and Maltese. It uses your phone’s language automatically – English for all other languages – and you can choose a different language under Settings → Language. ### What is an EU Digital Identity Wallet? eIDAS 2.0 (Regulation (EU) 2024/1183) introduces European Digital Identity Wallets: apps in which people can store identity data and other attestations and share them securely with public and private services. The technical rules are described in the EU Architecture and Reference Framework (ARF). ### Which documents can I store? Person Identification Data (PID) including the German PID, a mobile driving licence in SD-JWT VC and ISO/IEC 18013-5 mdoc format, and the CodeB membership card – all from the CodeB issuer (phone.codeb.io). You add them from the issuer list in the app or by scanning an issuer’s QR code. A Photo ID from your passport or ID card – you get it with a free CodeB account. ### What is an eMRTD? eMRTD stands for *electronic Machine Readable Travel Document*: a passport or ID card with a contactless chip, built to the international standard ICAO Doc 9303. You recognise an ePassport by the chip symbol on its cover. The chip stores the same details as the printed data page – name, date of birth, nationality, document number, expiry date – plus your photo, digitally signed by the issuing country so that any change would be noticed. The chip only opens with a key taken from the document itself – the card access number (CAN) or the machine-readable zone (MRZ), the two or three lines of characters at the bottom of the data page – so it cannot be read without access to the document. ### Which ID cards and passports can CodeB Wallet read? Electronic passports and ID cards that follow ICAO Doc 9303 – in practice most passports issued in recent years and the chip ID cards of the EU and EEA countries. According to ICAO, more than one billion ePassports are in circulation, issued by over 140 states and organisations. 29 EEA countries now issue ID cards with an ICAO-compliant chip; we estimate that well over 200 million of them are in use in Europe. Older cards without a chip cannot be read. CodeB Wallet checks the issuing country’s signature using the country certificates the states publish (CSCA master list). The country certificate list we use (BSI master list, October 2026) covers 115 countries plus the EU and the UN, including all EU member states – see [remote ID verification](remote-id-verification.html). ### My passport’s machine-readable zone is not recognised – what can I do? Open the photo page flat, hold the phone a little further away so that both lines of letters and numbers fit across the whole frame, and keep it still. In poor light, switch on the camera light on the scan screen. Avoid reflections from the laminate by tilting the passport slightly. If scanning still does not work, you can type the document number, date of birth and expiry date by hand. ### Can I use my ID card or passport to get my digital ID? Yes – at the CodeB PID Provider. When you add your Personal ID (PID), its sign-in page can ask your phone to read your ID card or passport. The provider’s server reads and checks the chip itself over an end-to-end encrypted, authenticated channel; your phone only passes the messages on, cannot read or change them and keeps no copy, and your details are filled in from the chip. It works right after installing the app, without any other document in your wallet. ### Can anyone intercept or change my ID card data when the server reads it? No. When the CodeB PID Provider reads your ID card or passport, the chip and the server build their own end-to-end encrypted and authenticated connection (PACE and Chip Authentication with Secure Messaging, ICAO Doc 9303). Your phone and the internet only carry these protected messages: neither your phone nor a man in the middle can read them or change them without the chip or the server noticing – at most the reading can be interrupted. In addition, the server checks the issuing country’s digital signature over the data (Passive Authentication), so altered data would be rejected. ### What is a Photo ID and a Digital Travel Credential (DTC)? A Photo ID is a standard EU wallet document (ISO/IEC TS 23220-4) with your name, date of birth and photo, issued from a passport or ID card that has been checked. A Digital Travel Credential (ICAO DTC type 1) is a copy of your passport chip’s data that a verifier can check against the issuing country’s signature. CodeB Wallet carries the DTC inside the Photo ID – only if you agree – and not as a separate document. ### Can I sign PDF documents with CodeB Wallet? Yes. CodeB Wallet signs PDFs with an advanced electronic signature (AdES) in PAdES format, with a trusted timestamp, via the CodeB signing service. You confirm every signature, and the PDF stays on your phone. CodeB Wallet uses Aloaha’s own PDF signing technology; Aloaha has been active in PDF development and digital signatures since 2003. Signatures from the signing service are not qualified electronic signatures (QES). You can also sign with your own signature card, such as the Maltese eID. ### Can I sign with my Maltese eID or another signature card? CodeB Wallet signs PDFs over NFC with the Maltese eID and Maltese residence cards, the D-Trust Card 5, the German health professional card (HBA) and the German electronic health card (eGK). Newly added – feedback welcome: the ID cards of Finland, Portugal (Cartão de Cidadão issued from June 2024) and Spain (DNIe 3.0 and 4.0). Enter the 6-digit card access number (CAN) printed on the card, hold the card to your phone and enter your signature PIN. The card itself makes the signature – the key never leaves the card – and CodeB Wallet adds it to the PDF as a PAdES signature with trusted timestamp. The app shows whether the card’s certificate states a qualified electronic signature; CodeB Wallet itself is not certified. ### Can CodeB Wallet check someone else’s ID? Yes. CodeB Wallet works as an ISO/IEC 18013-5 reader. With “Verify” you choose what you need – for example only “over 18” – and scan the QR code shown in the other person’s wallet. After they agree, the data arrives over Bluetooth. CodeB Wallet checks the issuer’s signature against your list of trusted issuer certificates (CodeB’s own certificate is built in, and you can import more), that the data is unchanged and belongs to the presenting phone, the validity period and the revocation status. You get a clear verdict – trusted, look closer or do not accept – and the data is deleted as soon as you close the result. Wallet and verifier come in one app – many wallet solutions need a separate app for checking IDs. ### Can I use it in person and online? Yes. In person, you start with a QR code or an NFC tap and the data is sent over Bluetooth Low Energy according to ISO/IEC 18013-5 – no internet connection needed. Both Bluetooth roles are supported for broad reader compatibility. Online, websites and apps request data via OpenID4VP, and you confirm every request with your PIN or biometrics. ### What does selective disclosure mean? Selective disclosure lets you share only the information a service needs. For example, you can confirm that you are over 18 without revealing your date of birth. The SD-JWT VC and ISO mdoc formats support this. ### Is my data safe? Your documents and your history are stored only on your phone. Cryptographic keys are kept in the phone’s secure hardware, the wallet is protected by PIN and optionally biometrics, and nothing is shared without your confirmation. The app has no ads, no tracking and no analytics. ### In which countries can I use CodeB Wallet? CodeB Wallet is built for the EU Digital Identity framework, which applies in all EU member states. Our first focus is Malta, Germany and Austria. Which documents you can use depends on the issuers available to you. ### Is CodeB Wallet an official or certified wallet? No. CodeB Wallet is not an official government wallet and it has not been certified. It is developed by Aloaha Limited and designed to comply with eIDAS 2.0 and the EU Architecture and Reference Framework (ARF). We will only call it certified once a certification has actually been completed. ### Which issuers can I use? In Settings you choose which issuers the wallet uses – currently the EU reference issuers and the CodeB issuer. Issuers are checked against EU trusted lists (ETSI). ### How do I move CodeB Wallet to a new phone? On the old phone go to Settings → Back up to a file and choose a password. On the new phone install CodeB Wallet, set your PIN and tap “New phone? Restore from a backup”. The history comes back and each issuer issues your documents again – the file never contains the data inside your documents or their keys. One-time code accounts come along too. Signed in to your CodeB account, you can also keep an encrypted copy of the backup on your account (Settings → CodeB account → Save a copy now) – only your backup password opens it. ### Can CodeB Wallet create sign-in codes for two-step sign-in (2FA)? Yes – CodeB Wallet has a built-in authenticator app for two-factor authentication (2FA). Open the menu → One-time codes and scan the QR code the website shows when you turn on two-step sign-in. CodeB Wallet creates the six-digit codes (TOTP, RFC 6238) on your phone, also offline. The keys stay on your phone, apart from your documents, and are never shared with a website or verifier. ### Can I sort my one-time codes into groups? Yes. In One-time codes, tap the three dots next to an account → “Move to a group”, or choose a group when you enter a key. Groups such as Work or Family appear A–Z below your pinned accounts and open or close with a tap; the pencil next to a group renames or removes it, and the search looks through all groups. Groups come along when you move your codes to a new phone. ### How do I move my one-time codes to a new phone? Either include them in “Back up to a file” and restore that file on the new phone, or open One-time codes → Transfer all accounts and scan the QR codes with the new phone – in CodeB Wallet or another authenticator app. Codes from another authenticator app come in the same way: scan its transfer QR codes in CodeB Wallet. ### The app said “Update ready”, but “Restart” did nothing – what now? Since version 2026.10.32 the button opens CodeB Wallet’s page in the Play Store when Google Play cannot finish the update itself (for example right after a phone update). With older versions: open the Play Store, search for CodeB Wallet and tap Update. ### How do I delete everything from CodeB Wallet? Open Settings → Delete wallet and confirm with your wallet PIN. All documents, the history, your settings and the keys are removed from your phone. Accounts with issuers or signing services are separate – for services of Aloaha Limited write to [info@aloaha.com](mailto:info@aloaha.com). ### When can I download CodeB Wallet? CodeB Wallet for Android is available on Google Play by invitation – write to info@aloaha.com. ### Can I open doors with CodeB Wallet? Yes, with a CodeB Access card from your organisation. Open the card, tap “Use at reader” and hold your phone to the reader. The reader checks the card offline: the issuer’s signature, the validity, your sites and groups, and a fresh signature from a key that stays in your phone’s secure hardware. ### Does an access card in CodeB Wallet interfere with payments or other NFC apps? No. CodeB Wallet answers access readers only for the card you chose, for at most five minutes and only while your phone is unlocked. At all other times its access function is switched off, so payment apps, other wallets and your other cards work exactly as before. ### Which door readers work with CodeB Wallet? Readers set up for CodeB Access (ISO/IEC 18013-5 data, checked offline) and readers of the open, royalty-free PKOC standard (Public Key Open Credential, PSIA). For PKOC your organisation enrols the card ID shown on your access card. ### Can I use my phone as a smart card to sign in to Windows? Yes, with a read/write PKI card in CodeB Wallet and a PC with a contactless (NFC) reader: Windows puts your sign-in certificate on the card itself, and you sign in with the card PIN. A read-only PKI card carries your organisation’s signing certificate for signing on the PC. Every use needs the card PIN, and the read/write card’s key never leaves your phone’s secure hardware. ### Can I change the PIN of my phone’s PKI card? Yes. Open the PKI card in CodeB Wallet and tap **Change card PIN**: enter the current PIN and the new one twice, then confirm with your fingerprint, face or screen lock. A wrong current PIN counts as a wrong try, exactly as at the PC. If a read-only card’s PIN is blocked, tap **Unblock with PUK**. You can also change the PIN from Windows as with any smart card. The PIN never leaves your phone. ### How do I know my phone is connected to the PC’s card reader? After **Use at PC**, a light on the card screen shows the connection: grey and pulsing while the phone waits, green while it is connected to the reader (it flickers when data goes through), red if the connection drops – then hold the phone to the reader again. ### Can I remove a certificate from my phone’s PKI card? Yes, on a read/write PKI card: open the card, tap **Remove** next to the certificate and enter the card PIN. The certificate and its key are deleted from the card for good. ### My Xiaomi phone does not answer at the PC’s reader as a PKI card – what can I do? On Xiaomi phones (MIUI) open Settings → Connection & sharing → NFC and set **Secure element position** to **HCE Wallet**. With “SIM wallet” or “eSE wallet” the phone passes the reader’s commands to the SIM or its secure chip instead of to CodeB Wallet, and Windows reports a card that needs a driver. Then open the card in CodeB Wallet, tap Use at PC and hold the back of the phone (near the camera) on the reader. ### Is CodeB Wallet available as a white-label solution? Yes. Organisations can offer CodeB Wallet as their own wallet app – with their own name, logo, colours and store listing, and with their issuers, documents and services preconfigured. The technology, updates and maintenance come from Aloaha Limited in Malta. Write to info@aloaha.com with the subject “CodeB Wallet white label”. ### Can I sign in to websites with my Maltese eID card and my phone? Yes, at phone.codeb.io: choose **Sign in with eID card**, scan the QR code with your phone, enter the card access number (CAN), hold the card to the phone and enter the card’s authentication PIN. CodeB Wallet lets the card sign a one-time challenge; the PIN and the card’s key never leave the card, and your browser is signed in. Only the Maltese eID card is supported for now. ### What happens if I lose my phone with CodeB Wallet? Your documents are protected by your phone’s screen lock and the app’s own PIN. If you were signed in to your CodeB account in the app, this phone’s wallet is linked to your account: open your account page on phone.codeb.io and revoke it. phone.codeb.io then no longer trusts that wallet and withdraws the documents it issued to it. ### Can a reader write to an NFC memory card in CodeB Wallet? Only if the issuer allows it for that card. Then a reader can write to the card while you hold the phone to it with the card open. What a reader writes stays on your phone only; the card shows when it was written, the last writes, and **Restore issued content**. Content written by a reader is not confirmed by the issuer. ### Can my phone act as an NFC tag? Yes. With an NFC memory card from your organisation, CodeB Wallet makes your Android phone answer as a standard NFC tag (NFC Forum Type 4, NDEF) – read-only, or writable so a reader can store new content on your phone. Details: [read-only NFC tag](read-only-nfc-tag.html) and [writable NFC tag](writable-nfc-tag.html). ### Can organisations verify ID documents remotely with CodeB Wallet? Yes. The person holds their passport or ID card to the phone; phone.codeb.io reads the chip itself through an end-to-end encrypted channel and checks the issuing country’s signature and that the chip is no copy. It proves a genuine document was present – face matching is planned. See [remote ID verification](remote-id-verification.html). ## Would you like to test CodeB Wallet? CodeB Wallet for Android is available on Google Play by invitation – write to info@aloaha.com. Issuers and services that want to accept EUDI credentials are welcome to get in touch too. E-mail: info@aloaha.com ### More from the CodeB family - [CodeB eForms Server](https://www.form-provider.com/) – Electronic forms - [ZUGFeRD Pro](https://www.zugferdpro.com/) – E-invoicing with ZUGFeRD - [CodeB Credential Provider](https://www.codeb.io/products.html#cp-v2) – Windows logon with NFC, smartcard or TOTP ## How signing works – with your signature card or the CodeB signing service Source: https://myeuid.app/en/sign-pdf.html CodeB Wallet signs PDF documents on your Android phone. For every signature you choose how: with your own signature card over NFC – such as the Maltese eID, a D-Trust card or a German health professional card – or with the CodeB signing service, a server-based remote signature that only needs your free CodeB account. Either way you get a PAdES signature with a trusted timestamp, and your PDF stays on your phone. CodeB Wallet itself is not certified. ### The signing workflow at a glance The workflow is the same for every PDF – your own document or one that someone else asks you to sign. Only one step differs: how you confirm the signature. You decide that every time you sign, so you can use your card for a contract and the signing service for a quick form. 1. **Choose and check the PDF** – Sign → Select document; every page in the preview 2. **Choose how to sign** – Your signature card or the CodeB signing service – for every signature 3. **Confirm** – Card: CAN and signature PIN · Service: sign in and confirm in the browser 4. **Signed PDF** – PAdES signature with trusted timestamp – save or share ### Signature card or signing service – you choose for every signature On the review screen you see both buttons: **Sign with signature card** uses your own card over NFC, **Sign document** uses the CodeB signing service. Both create a PAdES signature with a trusted timestamp. Signature card and CodeB signing service compared: | | Your signature card | CodeB signing service | |---|---|---| | How it works | Your own smart card signs over NFC; the key never leaves its chip | Server-based remote signature: your signing key is kept by the CodeB signing service on phone.codeb.io | | Signature level | What the card’s certificate states – qualified (QES) with the Maltese eID, D-Trust cards and the HBA; advanced with the eGK | Advanced electronic signature (AdES) | | What you need | The card, its card access number (CAN), your signature PIN and a phone with NFC | A free CodeB account – sign in with password, passkey or your EU Wallet | | Browser and account | Neither – the card and your PIN are enough | You confirm twice in your browser: once to sign in, once for exactly this document | | Your PDF | Stays on your phone; only a fingerprint of the signature goes to the timestamp service | Stays on your phone; only its fingerprint (hash) goes to the signing service | | Good for | Contracts and forms that need a qualified electronic signature; professionals with a D-Trust card or HBA | Everyday documents without a card – 5 of your own documents a day with the free guest account | If a website asks for a qualified electronic signature, only a card whose certificate states a qualified signature can be used for it. ### How to sign your own PDF 1. On the home screen tap **Sign**, then **Select document** and pick a PDF on your phone – or tap myeuid.app/open/sign on your phone. 2. Check the document: swipe through the pages and see the signing service and the signature type. 3. Choose how to sign: **Sign with signature card** or **Sign document** (CodeB signing service). 4. **With your card:** enter the 6-digit card access number (CAN) printed on the card, hold the card flat against the back of the phone and enter your signature PIN. The card signs. 5. **With the signing service:** your browser opens – sign in with your CodeB account, choose your signing certificate if you have more than one, and confirm that you want to sign exactly this document. 6. The app adds a trusted timestamp. You see “Document signed” – tap **Save to phone** or **Share**. ### Signing with your signature card Your own signature card makes the signature – the key never leaves its chip, and no browser and no account are needed. Supported: the [Maltese eID and Maltese residence cards](maltese-eid.html), the [D-Trust Card 5 signature and seal cards](d-trust.html), and the [German health professional card (HBA) and electronic health card (eGK)](german-health-cards.html). Phone and card first build an encrypted, authenticated connection with the card access number (PACE, the protocol of European ID cards). Your signature PIN reaches the chip only over this connection; the app never stores it and never retries a wrong PIN by itself. When it is done, the app shows which card signed and whether its certificate states a qualified electronic signature. ### Signing with the CodeB signing service (remote signature) The CodeB signing service on phone.codeb.io keeps your signing key on the server – a server-based remote signature. Your phone sends only the document’s fingerprint (hash); the PDF itself never leaves your phone. You confirm every signature twice in your browser: once to sign in with your CodeB account – with password, passkey or your EU Wallet – and once for exactly this document. This way nobody can sign in your name. You need a [free CodeB account](free-account.html). You open it in the app with your passport or ID card in about two minutes. Signatures from the CodeB signing service are advanced electronic signatures (AdES). The free guest account signs 5 of your own documents a day; documents others ask you to sign do not count. ### When someone asks you to sign A website – or a colleague on [phone.codeb.io/sign-request](https://phone.codeb.io/sign-request.html) – can ask one or more people to sign the same PDFs one after another. Each person signs in CodeB Wallet by scanning a QR code or tapping the link in the invitation mail, and each one chooses again: signature card or signing service. 1. **Request** – PDFs uploaded on phone.codeb.io/sign-request, signers chosen 2. **QR code or link** – Scan in CodeB Wallet – or tap the link in the invitation mail 3. **Check and choose** – Who asks, every document; card or signing service 4. **Signed PDF back** – The next person gets an e-mail; at the end everyone gets the PDF The wallet shows who asks – with “Verified” when the request is signed with that organisation’s certificate – and every document. Then you tap **Sign document**, **Sign with signature card** or **Decline**. Every signer signs the PDF exactly as the previous one left it, so earlier signatures stay valid. When a request asks for a qualified signature, only a card with a qualified certificate can be used. Step by step: [sign a document from a website](manual.html#sign-request). ### What you get: a PAdES signature CodeB Wallet signs in the PAdES format (PDF Advanced Electronic Signatures, ETSI EN 319 142). The signature is embedded in the PDF; it is invisible on the page, and common PDF readers show it in their signature panel. A trusted timestamp records when the document was signed. If no timestamp service can be reached, the document is still signed – without the timestamp. Earlier signatures in the PDF stay valid. PDFs up to 40 MB can be signed; password-protected PDFs cannot. CodeB Wallet uses Aloaha’s own PDF signing technology. Aloaha has been active in PDF development and digital signatures since 2003. ### Advanced or qualified – what the difference means Under the EU eIDAS regulation, a qualified electronic signature (QES) has the same legal effect as a handwritten signature. It needs a qualified certificate on a qualified signature creation device – for example a signature card. An advanced electronic signature (AdES) is uniquely linked to the signer and shows any later change to the document. It is enough for many everyday documents, but not where the law requires a qualified signature. CodeB Wallet shows what the certificate states. Signatures from the CodeB signing service are AdES. CodeB Wallet itself is not certified. ### Security and privacy Your PDF stays on your phone, whichever way you sign. The signing service receives only the document’s fingerprint (hash); with a card, only a fingerprint of the signature goes to the timestamp service. Every signature needs your own fresh confirmation: your card’s signature PIN, or signing in and confirming the document in your browser. With a card the signing key never leaves the chip. The app never stores your signature PIN. ### Questions about signing **Can I choose between my signature card and a remote signature?** Yes – for every signature. On the review screen CodeB Wallet offers “Sign document” (the CodeB signing service, a server-based remote signature) and “Sign with signature card” (your own card over NFC). Signing requests from websites offer the same choice. **Which signature cards can I use?** The Maltese eID and Maltese residence cards, the D-Trust Card 5 signature and seal cards, the German health professional card (HBA) and the German electronic health card (eGK). You need the card access number (CAN) printed on the card and your signature PIN. **What is a remote signature?** With a remote signature your signing key is kept by a signing service on a server instead of on a card in your hand. You authorise every single signature yourself: in CodeB Wallet you sign in to the CodeB signing service and confirm exactly this document in your browser. The PDF stays on your phone – only its fingerprint (hash) is sent. **Do I need an account to sign?** Only for the CodeB signing service. You open the free CodeB account in the app with your passport or ID card in about two minutes. Signing with your own signature card needs no account and no browser. **Is the signature a qualified electronic signature (QES)?** That depends on the certificate used. With a card whose certificate states a qualified electronic signature – such as the Maltese eID, a D-Trust card or the HBA – the app shows the signature as qualified. Signatures from the CodeB signing service are advanced electronic signatures (AdES). CodeB Wallet itself is not certified. **Does my PDF leave my phone?** No. The signature is added to the PDF on your phone. The signing service receives only the document’s fingerprint (hash); with a card, only a fingerprint of the signature goes to the timestamp service. **Can several people sign the same PDF?** Yes, with a signing request on phone.codeb.io/sign-request: up to 5 invited people sign one after another (guest accounts: 2). Each of them signs in CodeB Wallet and chooses again between signature card and signing service. Earlier signatures stay valid. **How do others check my signature?** The signature is a PAdES signature embedded in the PDF. Common PDF readers show it in their signature panel, with the signer, the time from the trusted timestamp and whether the document was changed afterwards. ## Sign PDFs with your Maltese eID or residence card Source: https://myeuid.app/en/maltese-eid.html With CodeB Wallet your Android phone becomes the card reader for your Maltese identity card (eID). Hold the card to the phone and sign PDFs with the qualified signature certificate on the card – no computer, no USB card reader, no browser plug-in. The same works with Maltese residence cards that carry a signature certificate. CodeB Wallet itself is not certified. ### What you need Your Maltese eID card (the identity card with chip), its card access number (CAN) – the 6 digits printed on the card – and your signature PIN. An Android phone with NFC and CodeB Wallet. ### Maltese residence cards Maltese residence cards with a signature certificate work the same way as the Maltese eID: the same chip, the same card access number (CAN) printed on the card and the same signature PIN. The app recognises them by their certificate. ### How to sign a PDF with the Maltese eID card 1. On the home screen tap **Sign**, then **Select document** and pick a PDF on your phone. 2. Check the document, then tap **Sign with signature card**. 3. Enter the 6-digit card access number (CAN) printed on the card. The app offers the last number that worked. 4. Hold the card flat against the back of your phone and leave it there until signing is finished. 5. Enter your PIN. The card signs the document, and the app adds a trusted timestamp. 6. You see “Document signed”, with the card used and whether its certificate states a qualified electronic signature. Tap **Save to phone** or **Share**. ### A qualified electronic signature The Maltese eID card holds a qualified certificate for electronic signatures, and the card itself creates the signature – the key never leaves the chip. CodeB Wallet reads the certificate and shows you whether it states a qualified electronic signature (QES). Under eIDAS, a qualified electronic signature has the same legal effect as a handwritten signature. CodeB Wallet embeds the signature in the PDF as PAdES (ETSI EN 319 142) with a trusted timestamp, so it can be checked in common PDF readers. CodeB Wallet itself is not certified. ### Security: your card, your PIN, your document Phone and card first build an encrypted, authenticated connection with the card access number (PACE, the protocol of European ID cards). Your PIN reaches the chip only over this connection, and the chip checks it. The app never stores your PIN. A wrong PIN is never retried automatically. The PDF stays on your phone. Only a fingerprint (hash) of the signature is sent to the CodeB timestamp service for the trusted timestamp. No account, no tracking. ### Tips Hold the card flat against the back of the phone and keep it still until signing is finished. On Android 14 and later the app shows where your phone’s NFC antenna is. If the card is moved away too early, nothing is signed – just hold it to the phone again; the app continues without asking for the card access number again. A blocked PIN is explained before anything is sent. Maltese eID PINs are reset by Identity Malta. ### Questions about the Maltese eID card **Can I sign PDFs with my Maltese ID card on my phone?** Yes. CodeB Wallet signs PDFs over NFC with the Maltese eID card on Android phones: enter the card access number (CAN), hold the card to the phone and enter your signature PIN – the card creates the signature. **Does it work with a Maltese residence card?** Yes. Maltese residence cards with a signature certificate sign the same way as the Maltese eID: enter the card access number (CAN), hold the card to the phone and enter your signature PIN. **Is it a qualified electronic signature?** The signature is made with the qualified signature certificate on your Maltese eID card, and the app shows whether the certificate states a qualified electronic signature. CodeB Wallet itself is not certified. **Where do I find the card access number (CAN)?** The CAN is the 6-digit number printed on your Maltese eID card. It only opens the encrypted connection to the chip; signing always needs your signature PIN as well. **Do I need a card reader or a computer?** No. An Android phone with NFC is the card reader. Nothing else needs to be installed. **What if my PIN is blocked or I forgot it?** CodeB Wallet cannot reset PINs. Maltese eID PINs are reset by Identity Malta. **Is my Maltese eID stored in the wallet as a digital ID?** No. The card is only used to sign; nothing from it is stored as a document in the wallet. Your digital ID (PID) is a separate credential issued by a PID provider. ## D-Trust signature and seal cards on your phone Source: https://myeuid.app/en/d-trust.html CodeB Wallet signs PDFs with D-Trust cards that have an NFC interface – straight from your Android phone, without a card reader. CodeB Wallet itself is not certified. ### What you need A D-Trust Card 5 with NFC – signature card or seal card – its card access number (CAN) printed on the card, and its PIN. An Android phone with NFC and CodeB Wallet. ### Which D-Trust cards work **D-Trust Card 5.1** – signature card for a person: qualified electronic signature. **D-Trust Card 5.4** – seal card for an organisation: qualified electronic seal. Both in the Standard (RSA) and Multi (ECC) variants. D-Trust cards of generation 4 have no contactless interface; the app recognises them and tells you that they need a card reader on a computer. ### How to sign a PDF with a D-Trust card 1. On the home screen tap **Sign**, then **Select document** and pick a PDF on your phone. 2. Check the document, then tap **Sign with signature card**. 3. Enter the 6-digit card access number (CAN) printed on the card. The app offers the last number that worked. 4. Hold the card flat against the back of your phone and leave it there until signing is finished. 5. Enter your PIN. The card signs the document, and the app adds a trusted timestamp. 6. You see “Document signed”, with the card used and whether its certificate states a qualified electronic signature. Tap **Save to phone** or **Share**. ### Qualified signatures and seals The card creates the signature or seal with the key on its chip – the key never leaves the card. CodeB Wallet reads the card’s certificate and shows whether it is qualified. Signatures and seals are embedded in the PDF as PAdES (ETSI EN 319 142) with a trusted timestamp. CodeB Wallet itself is not certified. ### Security: your card, your PIN, your document Phone and card first build an encrypted, authenticated connection with the card access number (PACE). Your PIN reaches the chip only over this connection, and the chip checks it. The app never stores your PIN. The signing key never leaves the card. A wrong PIN is never retried automatically. The PDF stays on your phone. Only a fingerprint (hash) of the signature is sent to the CodeB timestamp service for the trusted timestamp. No account, no tracking. ### PIN and transport PIN A new D-Trust card comes with a transport PIN. Set your own PIN first with your card issuer’s tools; CodeB Wallet tells you if the card still has its transport PIN and sends nothing. A wrong PIN is never retried automatically. ### Tips for a stable connection Hold the card flat against the back of the phone and keep it still until signing is finished. Remove thick phone cases. On Android 14 and later the app shows where your phone’s NFC antenna is. If the connection drops, the app continues by itself as soon as the card is back – the card access number is not asked again. ### Questions about D-Trust cards **Can I sign with my D-Trust card on an Android phone?** Yes, with the D-Trust Card 5.1 and 5.4, which have an NFC interface. Enter the card access number (CAN), hold the card to the phone and enter your PIN – the card signs the PDF. **Can an organisation seal PDFs with the D-Trust seal card?** Yes. With the D-Trust Card 5.4 an organisation applies its qualified electronic seal to PDFs from a phone. CodeB Wallet itself is not certified. **My D-Trust card is not recognised – why?** D-Trust cards of generation 4 have no contactless interface and need a card reader on a computer. If a generation 5 card is not found, check the card access number and hold the card still at the phone’s NFC antenna. **Do I need an account or a browser plug-in?** No. The app talks to the card directly over NFC. The PDF stays on your phone; only a fingerprint (hash) of the signature is sent to the CodeB timestamp service for the trusted timestamp. **What about my PIN?** The app shows the remaining tries; a wrong PIN is never retried automatically. Change a transport PIN or unblock a PIN with your card issuer’s tools. **Where do I find the card access number (CAN)?** On the D-Trust card itself: a 6-digit number printed on the card. The app asks for it before you hold the card to the phone and keeps it encrypted on your phone so it can offer it again. **What if my PIN is blocked or I forgot it?** Unblock it with the PUK from your PIN letter using your card issuer’s tools, or contact D-Trust. CodeB Wallet never retries a wrong PIN automatically and shows the remaining tries. ## German health cards on your phone: HBA and eGK Source: https://myeuid.app/en/german-health-cards.html CodeB Wallet signs PDFs with the German health professional card (elektronischer Heilberufsausweis, HBA) and the electronic health card (elektronische Gesundheitskarte, eGK) over NFC – straight from your Android phone, without a card reader. The HBA G2.1 creates a qualified electronic signature with its QES certificate; an eGK without a signature certificate signs with its authentication certificate (advanced electronic signature). CodeB Wallet itself is not certified. ### What you need A health professional card (HBA) G2.1 or an electronic health card (eGK) G2.1 with NFC, its card access number (CAN) printed on the front, and the PIN the app asks for. An Android phone with NFC and CodeB Wallet. ### Which cards work **Health professional card (HBA) G2.1** – for doctors, dentists, pharmacists, psychotherapists and other health professionals: qualified electronic signature with the card’s QES certificate. **Electronic health card (eGK) G2.1** – the health insurance card. Most cards carry no signature certificate, so CodeB Wallet signs with the card’s authentication certificate. The result is an advanced electronic signature, not a qualified one. Both need the contactless interface (NFC) and the card access number (CAN) printed on the card. Institution cards (SMC-B) are not used to sign documents. ### How to sign a PDF with the HBA or eGK 1. On the home screen tap **Sign**, then **Select document** and pick a PDF on your phone. 2. Check the document, then tap **Sign with signature card**. 3. Enter the 6-digit card access number (CAN) printed on the front of the card. 4. Hold the card flat against the back of your phone and leave it there until signing is finished. 5. Enter the PIN the app asks for: on the HBA the PIN of the signature application (PIN.QES); on the eGK the PIN of your health card (PIN.CH). 6. You see “Document signed”, with the card used and whether its certificate states a qualified electronic signature. Tap **Save to phone** or **Share**. ### Qualified or advanced signature With the HBA, the card creates the signature with the key of its QES certificate – the key never leaves the card. CodeB Wallet reads the certificate and shows that it states a qualified electronic signature. Most eGKs have no signature certificate. CodeB Wallet then uses the card’s authentication certificate: the signature is an advanced electronic signature (AdES) – bound to the card and its PIN, but not qualified. The app never shows it as qualified. Signatures are embedded in the PDF as PAdES (ETSI EN 319 142), with a trusted timestamp when the timestamp service answers. CodeB Wallet itself is not certified. ### Security: your card, your PIN, your document Phone and card first build an encrypted, authenticated connection with the card access number (PACE). Your PIN reaches the chip only over this connection, and the chip checks it. The app never stores your PIN. The signing key never leaves the card. A wrong PIN is never retried automatically. The PDF stays on your phone. Only a fingerprint (hash) of the signature is sent to the CodeB timestamp service for the trusted timestamp. No connector, no TI, no tracking. ### Which PIN? **HBA:** the PIN of the qualified signature application (PIN.QES). If an HBA has no usable signature certificate, the app signs with its authentication certificate and asks for the card holder PIN (PIN.CH). **eGK:** the PIN of your health card (PIN.CH), which you receive from your health insurance. Change a transport PIN first with your card issuer’s tools. A wrong PIN is never retried automatically, and the app shows the remaining tries. ### Tips for a stable connection Hold the card flat against the back of the phone and keep it still until signing is finished. Remove thick phone cases. On Android 14 and later the app shows where your phone’s NFC antenna is. If the connection drops, the app continues by itself as soon as the card is back. ### Questions about the HBA and eGK **Can I sign PDFs with my Heilberufsausweis (HBA) on an Android phone?** Yes, with an HBA G2.1 with NFC. Enter the card access number (CAN), hold the card to the phone and enter your signature PIN – the card creates a qualified electronic signature. **Can I sign with my electronic health card (eGK)?** Yes, with an eGK G2.1 with NFC. Most health cards carry no signature certificate, so the card signs with its authentication certificate – an advanced electronic signature, not a qualified one. Enter the CAN printed on the card and the PIN of your health card. **Is a signature with the eGK the same as a handwritten signature?** No. In the EU only a qualified electronic signature has the legal effect of a handwritten signature (eIDAS). The eGK signature is an advanced electronic signature: it shows which card signed and that the document was not changed afterwards. For qualified signatures use the HBA or another QES card. **Do I need a card reader, a connector or the telematics infrastructure (TI)?** No. The app talks to the card directly over NFC. The PDF stays on your phone; only a fingerprint (hash) of the signature is sent to the CodeB timestamp service for the trusted timestamp. **Which PIN do I need?** HBA: the signature PIN (PIN.QES). eGK: the PIN of your health card (PIN.CH) from your health insurance. The app shows the remaining tries; a wrong PIN is never retried automatically. **Where do I find the card access number (CAN)?** On the front of the HBA or eGK: a 6-digit number printed on the card. The app asks for it before you hold the card to the phone. **What if my PIN is blocked or I forgot it?** HBA: unblock it with the PUK from your PIN letter or contact the trust service provider that issued your card. eGK: your health insurance helps. CodeB Wallet never retries a wrong PIN automatically and shows the remaining tries. ## Free CodeB account – opened with your passport or ID card Source: https://myeuid.app/en/free-account.html Create your account on phone.codeb.io directly in CodeB Wallet: hold your passport or ID card to your Android phone, confirm your e-mail address with a code, and the account is ready – free, in about two minutes. phone.codeb.io reads the chip itself and checks that the document is genuine, so no spam account can be opened. CodeB Wallet itself is not certified. ### What the account is for **Signing your own PDFs** with the CodeB signing service – 5 documents a day. Documents that someone else asks you to sign (for example from a website’s QR code) do not count. Signatures from the signing service are advanced electronic signatures (AdES). **Test PID and Photo ID:** right after opening, the app offers both test credentials for your wallet. **Signing in on phone.codeb.io** – to see and download documents you signed, and to answer signing requests. Showing and checking IDs in person, and signing with your own signature card, work without an account. ### How to open your free account 1. On the home screen tap the three lines at the top left, then **Settings**, and tap **Create a free CodeB account** in the section “CodeB account” – or tap the link myeuid.app/open/account on your phone. You need no other card in your wallet. 2. Read what is checked and kept, then tap **Agree and continue**. 3. ID card: tap **Enter the card access number (CAN)** and type the 6 digits printed on the front of the card. Passport, or no CAN on your card: tap **No CAN? Use the machine-readable zone** and hold the camera over the two or three lines of letters and numbers at the bottom of the photo page. 4. Hold the document flat on the back of your phone, near the camera, and do not move it until the bar is full – a few seconds. If nothing happens, move the document slowly over the back of the phone and remove a thick case. 5. Your document is genuine: type your e-mail address and tap **Send code**. 6. Open the mail from phone.codeb.io, type the 6-digit code and tap **Open account**. 7. Your account is ready. Tap **Add my documents (PID and Photo ID, test)** and then **Accept**: your test PID is added. Back on the home screen the Photo ID follows by itself – tap **Accept** again. 8. Last step: open the mail and set your password with the link. You need it to sign in on phone.codeb.io. ### Straight from a link On your Android phone, the link https://myeuid.app/open/account opens the account screen in CodeB Wallet directly. It also works right after installing: set up your wallet PIN, and the app continues with the account. Without the app, the link shows how to get it. The link only opens the screen – it carries no data and never skips your PIN. ### What is checked – and why phone.codeb.io reads the chip of your document through your phone and checks its issuing country’s signature (passive authentication) and that the chip is not a copy (chip or active authentication). An expired document cannot open an account. Your phone also shows that it runs the genuine CodeB Wallet from Google Play on a genuine Android phone. Each document and each phone can open one account; the number of new accounts per network and day is limited. Your face is not compared. The account therefore shows that a genuine document was held to a genuine phone – it is a **document-checked guest account**, not an official identity. ### What is kept Your name, date of birth, nationality, the document’s expiry date, the chip photo and your e-mail address. The CAN, the machine-readable zone and the raw chip data are never kept. You can have the account deleted at any time. In the app, Settings → “CodeB account” opens your account on phone.codeb.io. ### If something goes wrong **No mail?** Check your spam folder, or tap **Send a new code**. A code is valid for 10 minutes. **“This document already has an account”:** nothing new is opened, and that account’s address gets a notice. Sign in there, or set a new password with “Forgot password” on phone.codeb.io. **“This phone cannot be verified”:** the account needs a phone that passes Android’s and Google Play’s checks, with the app installed from Google Play. **The chip cannot be read:** hold the document still at the phone’s NFC antenna and remove thick cases; check the CAN, or use the machine-readable zone. ### Questions about the free account **Is the CodeB account really free?** Yes. It is a guest account on phone.codeb.io with which you can sign 5 of your own PDFs a day with the CodeB signing service and get the test PID and Photo ID. Signing documents that others ask you to sign does not count towards the limit. **Which documents can I use?** Any passport or ID card with a chip that is not expired – from any country. You need the card access number (CAN) printed on the card, or the machine-readable zone of the passport. **Do I need another card in my wallet first?** No. Creating the account works on a freshly installed app with an empty wallet. **Why does an account need my passport or ID card?** To keep spam and bots out. phone.codeb.io checks the chip of a genuine document; each document and each phone can open only one account. **Is the account an official identity or a qualified signature?** No. It is a document-checked guest account: it shows that a genuine document was held to a genuine phone. Signatures from the CodeB signing service are advanced electronic signatures (AdES). CodeB Wallet itself is not certified. **Can I open the account from a link?** Yes. On your Android phone, https://myeuid.app/open/account opens the account screen in CodeB Wallet directly – also right after installing. **Can I delete the account?** Yes, at any time. In the app, Settings → “CodeB account” opens your account on phone.codeb.io. ## Passkeys with pseudonyms – sign in without a password or your name Source: https://myeuid.app/en/passkeys.html CodeB Wallet is a passkey provider for Android 14 and newer. On every website that supports passkeys, it creates a separate pseudonym – a key pair made for that website only. You sign in with your fingerprint, face or screen lock; the website never gets a password, your name or anything from your documents, and different websites cannot link your pseudonyms. This is the pseudonym function that the EU Digital Identity Wallet architecture (ARF 3.0, Topic 11) describes. CodeB Wallet itself is not certified. ### What a pseudonym is A **passkey** replaces the password: your phone makes a key pair, the website keeps the public key, and you sign in by confirming on your phone. CodeB Wallet makes a **new key pair for every website** and keeps no name, e-mail address or document data in it – that is what makes it a **pseudonym**. Because each website gets a different random identifier and a different key, two websites cannot find out that the same person is behind them – not even if they compare their data. A pseudonym signs you in again and again as the same person on that one website. It does not say who you are. When a website needs to know that – for example your age or your name – you share it from your PID, separately and only with your consent. ### How to set it up and sign in 1. Install CodeB Wallet on an Android phone with Android 14 or newer and set up your wallet PIN. 2. Open the menu → **Pseudonyms (passkeys)** and tap **Turn on in Android settings**. In “Passwords, passkeys and accounts”, switch CodeB Wallet on. 3. On a website that offers “Create a passkey”, choose **CodeB Wallet** in the window Android shows, and confirm with your fingerprint, face or screen lock. 4. Next time, tap “Sign in with a passkey”, pick your pseudonym and confirm – no password. 5. Manage your pseudonyms in the app: give one your own name, or delete it. ### Make CodeB Wallet your passkey service Android decides which app offers passkeys. Switch CodeB Wallet on once – the menu names differ slightly between phones and Android versions: 1. In CodeB Wallet, open the menu → **Pseudonyms (passkeys)** and tap **Turn on in Android settings**. This opens the right Android page directly. Or open it yourself: 2. **Pixel and most phones (Android 14 or newer):** Settings → **Passwords, passkeys & accounts** (on some phones “Passwords & accounts”). 3. **Samsung Galaxy:** Settings → **General management** → **Passwords, passkeys and autofill**. 4. **Make it the default:** tap **Preferred service**, choose **CodeB Wallet** and confirm. Android then offers CodeB Wallet first when a website asks for a passkey. Google Password Manager stays available. 5. **Or keep Google as default:** under **Additional services** (or “Additional providers”), switch **CodeB Wallet** on. CodeB Wallet then appears in the list next to Google whenever you create or use a passkey. 6. Back in CodeB Wallet, the Pseudonyms screen says “CodeB Wallet is switched on for passkeys on this phone”. CodeB Wallet does not fill in passwords. If your phone asks you to choose one service for passwords, passkeys and autofill together, you can keep your password manager as preferred service and switch CodeB Wallet on as an additional service instead. ### Try it on our test page Our test page phone.codeb.io/pseudonym-test.html lets you try a pseudonym safely: tap **Create pseudonym** and choose CodeB Wallet, then tap **Sign in with a pseudonym**. The page only ever sees a random identifier and a public key. When you are done, delete the pseudonym on the page and in the app. Since version 2026.10.33 the app has a button for this test as well: menu → Pseudonyms (passkeys) → **Try it on the CodeB test page**. ### Secure by design **Hardware key.** Each pseudonym is a key in your phone’s secure hardware (StrongBox where the phone has it). It never leaves the phone and is not copied to a cloud. **Only after you confirm.** Every sign-in needs your fingerprint, face or screen lock. **Bound to the website.** A pseudonym works only on the website it was made for, so a fake look-alike website cannot use it. CodeB Wallet accepts the website address only from browsers it knows, refuses addresses that no single website owns, and lets other apps use a website’s pseudonyms only when that website allows the app (Digital Asset Links). **No tracking.** CodeB Wallet sends no device attestation, so websites cannot recognise your phone. Creating, using and deleting a pseudonym is recorded in the app’s History. ### Standards Standards behind CodeB Wallet pseudonyms: | Standard | What CodeB Wallet does | |---|---| | W3C WebAuthn (passkeys) | Creates and uses discoverable passkeys with user verification; attestation “none” | | Android Credential Manager | Registered as a passkey provider (Android 14 or newer) | | EUDI Wallet ARF 3.0, Topic 11 | One pseudonym per website, no personal data in it, not linkable between websites | | Digital Asset Links | Lets an app use a website’s pseudonyms only when the website allows that app | ### If CodeB Wallet is not offered **“Sign in” shows only other accounts:** a pseudonym appears only after you have created one on that website. Use “Create a passkey” (on our test page: “Create pseudonym”) first. **CodeB Wallet is not in the list at all:** check that the phone runs Android 14 or newer and that CodeB Wallet is switched on in Android’s “Passwords, passkeys and accounts” settings. Use an up-to-date Chrome or another browser that supports passkey providers. **“No screen lock”:** pseudonyms need a screen lock, so that only you can use them. ### Questions about passkeys and pseudonyms **Is a pseudonym the same as a passkey?** Technically, yes: it is a passkey (W3C WebAuthn). CodeB Wallet uses it the way the EU wallet architecture describes pseudonyms – one per website, with no personal data in it, so websites cannot link you. **Does the website learn my name or e-mail address?** No. The website gets a random identifier and a public key. The account name you see in the app is the one the website chose; CodeB Wallet adds nothing from your documents. **Which websites work?** Any website that offers passkeys and lets Android choose the passkey provider. Try it on our test page: https://phone.codeb.io/pseudonym-test.html **Do I need a CodeB account or a document in the wallet?** No. Pseudonyms work without an account and without any document in your wallet. **What happens if I lose my phone?** The keys never leave the phone and are not copied to a cloud, so they cannot be stolen from a server – but they are not restored either. Sign in to the website another way, delete the old passkey there and create a new pseudonym on your new phone. **Can apps use my pseudonyms?** Only when the website allows that app in its public Digital Asset Links file. Browsers pass the website address they checked. ## Your phone as a smart card for Windows sign-in Source: https://myeuid.app/en/phone-smart-card.html With CodeB Wallet your Android phone acts as a contactless PKI smart card. Hold it to the PC’s NFC reader, enter the card PIN – and Windows signs you in, exactly as with a plastic smart card. Your organisation issues the card to your wallet; the key is made in your phone’s secure hardware and never leaves it. ### What you need An Android phone with NFC, CodeB Wallet, and a PKI card issued to your wallet by your organisation (link, QR code or e-mail). A Windows PC with a contactless (NFC) smart card reader, set up by your organisation for smart card sign-in. ### Two kinds of PKI card **Read/write PKI card:** Windows itself stores your sign-in certificate on the phone, as on any smart card. Its key is made in your phone’s secure hardware and never leaves it. Signing in at Windows with it works today. **Read-only PKI card:** carries your organisation’s signing certificate, put on the card by its server right after you add it, so programs on the PC can sign with it. ### How to sign in at Windows 1. Open the PKI card in CodeB Wallet. The first time, choose the card PIN. 2. At the PC, tap **Use at PC**. 3. Hold your phone to the PC’s NFC reader and keep it unlocked. A light shows the connection: grey while it waits, green while connected. 4. Windows sees a smart card. Choose it and enter the card PIN. ### How your card is protected Every use needs the card PIN, which you choose (read/write: 4 to 16 characters; read-only: 6 to 8 digits, with an unblock code, PUK). After too many wrong PINs the card is blocked. Only the card you chose answers – only while its screen is open, the phone is at the reader and unlocked. It never interferes with door access, payment apps or your other cards. ### Several cards, PIN change, removing certificates You can hold several PKI cards side by side; each shows the name from its certificate. In the app you change the card PIN, unblock a read-only card with its PUK, and remove a certificate Windows put on a read/write card. ### Questions about the phone as a smart card **Can I use my Android phone as a smart card for Windows logon?** Yes. With a PKI card in CodeB Wallet your phone acts as a contactless PKI smart card at a Windows PC with an NFC reader: hold it to the reader and enter the card PIN. Your organisation issues the card and sets up the PC for smart card sign-in. **Does the private key leave my phone?** No. The read/write card’s key is made in your phone’s secure hardware and never leaves it. The read-only card’s signing key comes from your organisation’s server and is kept in your phone’s secure hardware. **Do I need a special reader?** A contactless (NFC) smart card reader on the PC. The phone answers only while you hold it there with the card screen open and the phone unlocked. **What if I forget the card PIN?** A read-only card is unblocked with the PUK you noted when the card arrived. A blocked read/write card is unblocked or re-issued by your organisation. **Does it interfere with my payment cards or door access?** No. Only the card you chose answers, only while its screen is open and the phone is unlocked. ## Read and check passports and ID cards with NFC Source: https://myeuid.app/en/passport-nfc.html CodeB Wallet reads the chip of an electronic passport or ID card with your Android phone’s NFC – name, date of birth, nationality, document number, expiry date and the photo – and checks that the document is genuine: the issuing country must have signed the data, and the chip must prove that it is not a copy. Everything happens on your phone. ### What you need An Android phone with NFC and a document with a chip – passports show a chip symbol on the cover, newer ID cards have the chip inside. Reading documents works on every Android phone with NFC. Organisations can also check documents remotely – see [remote ID verification](remote-id-verification.html). ### How to read a document 1. On the home screen tap **ID card**. 2. Open the chip with the card access number (CAN) – the 6 digits on the front of many ID cards – or let the camera read the machine-readable zone (the two or three lines at the bottom of the photo page). You can also type the data. 3. Hold the document flat against the back of your phone and keep it still until the reading is complete. If no chip is found, move the phone slowly and remove a thick case. 4. You see the result: whether the document is genuine, the issuing country, and the chip data with the photo. Tap **Save on this phone** to keep an encrypted copy. ### What the check means The chip’s data must carry a valid signature of the issuing country, checked against the country certificates, and the chip must prove that it is not a copy. CodeB Wallet shows clearly whether both checks passed. ### Your data stays on your phone Nothing is sent anywhere when you read a document this way. If you save it, the copy is encrypted on your phone and appears as its own card on the home screen; you can delete it at any time. A saved copy is not an EU digital identity document and cannot be shown to others with the wallet. ### More from your passport or ID card With your passport or ID card you can also open a free CodeB account and receive a test PID and a Photo ID in your wallet – see the guide to the free CodeB account. ### Questions about reading passports and ID cards **Can my Android phone read the chip in my passport?** Yes, if the phone has NFC. CodeB Wallet opens the chip with the card access number (CAN) or the machine-readable zone, reads the data and the photo and checks that the passport is genuine. **How does CodeB Wallet know a document is genuine?** The chip’s data must carry a valid signature of the issuing country, checked against the country certificates, and the chip must prove that it is not a copy. **Is my passport data uploaded anywhere?** No. Reading a document this way happens only on your phone; nothing is sent anywhere. A saved copy is encrypted on your phone. **Where do I find the CAN?** On many ID cards the card access number (CAN) is the 6-digit number printed on the front. Passports and cards without a CAN are opened with the machine-readable zone. **The chip is not found – what can I do?** Hold the document flat and still on the back of the phone, move it slowly to find the antenna, try the front cover and then the photo page of a passport, and remove a thick case. ## Remote ID document verification with the NFC chip Source: https://myeuid.app/en/remote-id-verification.html Instead of a photo of a passport or ID card, the person holds the document to their Android phone. The **chip** inside is read through CodeB Wallet – by **your server**, not by the phone – and checked against the issuing country’s signature. You learn whether the document is genuine and receive its data and photo, signed by the country that issued it. This works with passports from more than a hundred countries and with every EU ID card issued since August 2021. ### Why the chip and not a photo of the document Photos and video calls of ID documents are easy to fake: edited images, printed copies, deepfakes and injection attacks that feed a fake camera picture into the app. Optical checks of holograms on a screen keep getting harder. The chip is different. Every passport and modern ID card (an **eMRTD**, electronic machine-readable travel document, ICAO Doc 9303) stores the holder’s data and photo, **digitally signed by the issuing country**. A changed name or photo breaks the signature, and a copied chip cannot answer the chip’s own key test. That is why the French and German cyber-security agencies (ANSSI and BSI) recommend prioritising chip reading for remote identity proofing. ### How remote verification works 1. **Invitation.** Your organisation sends the person a link or QR code from phone.codeb.io – for example from the user list, or inside a sign-up. 2. **Consent.** The link opens CodeB Wallet (it can be installed first). The wallet shows who is asking and what will be read; the person continues or declines. 3. **Unlock the chip.** The person enters the 6-digit card access number (CAN) or lets the camera read the machine-readable zone (MRZ). 4. **Read.** The person holds the document to the back of the phone. The server of phone.codeb.io acts as the **reader**: it talks to the chip through an end-to-end encrypted and authenticated channel (PACE, Chip Authentication, Secure Messaging). The phone only passes the messages on – it cannot read or change them, so a manipulated app cannot invent a result. 5. **Result.** The server checks the document and records the result. Your organisation sees the verdict, the data and the chip photo. ### MRZ and CAN: the key to the chip The chip does not answer just anyone. Before it releases data, the reader must prove that it has seen the document: with the **MRZ** – the two or three lines at the bottom of the photo page (document number, date of birth, expiry date) – or with the **CAN**, the 6-digit card access number printed on the front of many ID cards. From this key, reader and chip set up an encrypted connection (**PACE**, or the older BAC on some passports). This protects against skimming: nobody can read a document in a bag from a distance. CodeB Wallet reads the MRZ with the camera, or the person types the CAN. ### What is checked **Passive Authentication:** the data on the chip must carry a valid signature of the issuing country’s document signer, which must chain to that country’s CSCA certificate from the German BSI master list – and the certificates must not be revoked (CRLs). Country, signer and data must match. **Chip Authentication or Active Authentication:** the chip must prove with its own secret key that it is the original and not a copy. Attempts to hide these functions to skip the test count as a copy. **Genuine app on a genuine phone:** CodeB Wallet proves to the server with Android Key Attestation and Google Play Integrity that it is the unmodified app on a real device. **Evidence:** every reading is stored as a hash-chained evidence record – method, algorithms, certificates, revocation state and the result. ### What your organisation receives The verdict (genuine or not, with reasons) and the data printed on the document: name, date of birth, nationality, sex, document type and number, issuing country, expiry date and the chip photo. Fingerprints are never read: they are protected by Extended Access Control and only available to border authorities. The person sees what is read before it happens. ### Which documents are supported Every document with a chip that follows ICAO Doc 9303: **passports** with the chip symbol on the cover, **ID cards** with a chip and many **residence permits**. Whether a document can be confirmed as **genuine** depends on its country certificate. The BSI master list we use (October 2026) holds 609 country signing certificates of **115 countries** plus the EU and the UN – including all EU member states, the United Kingdom, Switzerland, Norway, the USA, Canada, Australia, Japan, India and Brazil. Together these countries issue several hundred million chip documents. In the EU, every ID card issued since **2 August 2021** must have a chip (Regulation (EU) 2019/1157), and older cards without one are being phased out. Documents of countries outside the list can still be read, but not confirmed as genuine. Confirmed in our tests, among others: the Maltese passport. Newly added – feedback welcome: ID cards of Finland, Portugal and Spain. ### Who needs remote ID verification **Banks, payment and fintech companies** – customer due diligence (KYC, anti-money-laundering) when opening an account online. **Crypto-asset service providers** – customer identification before trading. **Telecom operators** – SIM card and contract registration where the law requires an ID check. **Car rental, car sharing and mobility** – identity before the first ride (the driving licence is checked separately). **Online gambling and age-restricted goods** – identity and age at sign-up. **Notaries, lawyers and trust service providers** – identity before signatures, powers of attorney and certificates. **Employers and staffing agencies** – identity and right-to-work checks for remote hires. **Hotels, short stays and travel** – guest registration before arrival. **Healthcare, telemedicine and pharmacies** – the right patient behind an online consultation. **Marketplaces and platforms** – identifying traders and sellers. **Public sector, universities and associations** – enrolment and membership without a counter visit. Which checks your sector needs, and whether chip reading alone is enough, depends on your regulator. ### What it does not prove – yet Chip reading proves that a **genuine document** was held to the phone. It does not prove that the person holding the phone is the person in the photo. For that, a face comparison with liveness detection against the chip photo is needed; we plan to add it through a certified external provider. Until then a reading is a **document check**, not a verified identity, and not eIDAS level of assurance “high”. Remote verification needs a phone with NFC – keep another way for people without one. ### How organisations start Organisations on phone.codeb.io send identity checks to their members from the user list, or let people check their own document when they open an account. Contact [info@aloaha.com](mailto:info@aloaha.com) to set it up for your organisation. For people: see [reading your own passport or ID card](passport-nfc.html) and the [free CodeB account](free-account.html). ### Questions about remote ID verification **What is remote ID verification with NFC?** The person holds their passport or ID card to their phone; the chip is read and its data checked against the issuing country’s digital signature. It replaces photos and video calls of the document. **Why is chip reading safer than a photo of the ID?** The chip data is signed by the issuing country and the chip proves it is not a copy. A photo can be edited, printed or generated; a signed chip cannot be faked without breaking the signature. **What are MRZ and CAN?** The MRZ is the machine-readable zone at the bottom of the photo page; the CAN is a 6-digit card access number on the front of many ID cards. Either one unlocks the chip, so it cannot be read from a distance without the document. **How many ID documents are supported?** Every ICAO 9303 chip document can be read. It can be confirmed as genuine for 115 countries plus EU and UN documents in the BSI master list we use (October 2026), including all EU member states; every EU ID card issued since August 2021 has a chip. **Can a manipulated app fake the result?** No. The server reads the chip itself through an end-to-end encrypted channel; the phone only forwards messages it cannot read or change. The server also checks that it talks to the genuine app on a real phone. **Does it prove that the person is the document holder?** Not yet. It proves that a genuine document was present. A face comparison with liveness detection is planned through a certified external provider. **Which industries use it?** Banks and fintechs (KYC/AML), crypto-asset services, telecom operators, car rental and car sharing, online gambling, notaries and trust services, employers, hotels, healthcare, marketplaces and the public sector. ## Prove your age – without showing your birthday Source: https://myeuid.app/en/age-verification.html When a shop, an event or a website only needs to know that you are over 18, CodeB Wallet shares exactly that – “over 18: yes” – and nothing else: not your birthday, not your name, not your address. It works in person, phone to phone, and online on websites and apps. And CodeB Wallet can check someone else’s age, too. ### Why your birthday stays private Your EU digital identity (PID) carries age statements such as “over 18”. CodeB Wallet shows you exactly which details are asked for and shares only those you confirm, with your PIN or biometrics. A request for “over 18” never reveals your date of birth. ### How to show that you are over 18 in person 1. Tap **Show ID** and choose **In person**. 2. The other person scans the QR code with their wallet or reader app – or starts the connection with an NFC tap. 3. Your phone shows exactly what is asked for – for example only “over 18”. Check it. 4. Confirm with your PIN or biometrics. The answer goes directly from phone to phone over Bluetooth – no internet needed. ### Online: websites and apps Websites and apps can ask your wallet for “over 18” with the standard online protocol (OpenID4VP). CodeB Wallet opens, shows who is asking and what they want, and you decide. In person, the standard is ISO/IEC 18013-5. ### Checking someone else’s age Tap **Verify**, choose only “over 18” and scan the other person’s QR code. CodeB Wallet shows a clear verdict – trusted, look closer or do not accept – after checking the issuer’s signature, that the data is unchanged, the validity and whether the document has been revoked. Nothing is kept on your phone. ### What you need A PID in CodeB Wallet – for testing you get one with the free CodeB account, opened with your passport or ID card. The person checking needs an EU wallet or a reader app. ### Questions about proving your age **Can I prove I am over 18 without showing my date of birth?** Yes. CodeB Wallet shares only the statement “over 18” from your EU digital identity when that is all that is asked for – your birthday, name and address stay private. **Does age verification work online?** Yes. Websites and apps can ask your wallet for “over 18” with OpenID4VP; you see who asks and decide. In person, it works phone to phone with ISO/IEC 18013-5. **Can I check someone else’s age with CodeB Wallet?** Yes. Tap Verify, ask only for “over 18” and scan their QR code. The app checks the issuer’s signature, the validity and the revocation status and shows a clear verdict. Nothing is stored. **Who sees that I am over 18?** Only the shop, person or website you confirm the request for. Your wallet shows every request first and shares nothing without your PIN or biometrics. **Where do I get a PID for the age check?** For testing, open the free CodeB account with your passport or ID card – you receive a test PID in your wallet. ## Your phone as a door and PC access card Source: https://myeuid.app/en/door-access.html With CodeB Access your organisation gives you an access card in CodeB Wallet. Choose it, hold your phone to a door or PC reader – and the door opens. The reader checks the card offline; the phone answers with the card’s signed data and a fresh signature from a key that never leaves the phone’s secure hardware. ### What you need An Android phone with NFC, CodeB Wallet, and an access card your organisation issues through phone.codeb.io (link, QR code or e-mail). ### How to open a door 1. Open the invitation from your organisation and collect the CodeB Access card. It appears on your home screen. 2. Before you reach the door or PC, open the card and tap **Use at reader**. 3. Hold your phone to the reader and keep it unlocked. 4. The reader checks the card offline and opens the door or signs you in. Tap Stop if you no longer need it – leaving the screen ends it as well. ### What the reader learns The reader receives only a pseudonymous card number, your sites and access groups and the validity – never your name. Every use is listed under History. ### Only when you choose Only the card you chose answers, for a short time after you choose it, and only while your phone is unlocked. At all other times your phone does not answer any access reader – and it never interferes with payment apps or your other cards. ### PKOC door readers Door readers of the open PKOC standard (Public Key Open Credential, PSIA) work as well. Your organisation enrols the PKOC card ID shown on the card; tap Copy card ID to send it. The ID is a public key – the matching private key never leaves your phone’s secure hardware. ### Lost your phone? Your organisation revokes the card and can give you a new one on your new phone. ### Questions about the phone as an access card **Can my Android phone replace my access badge?** Yes, with a CodeB Access card from your organisation: open it in CodeB Wallet, tap Use at reader and hold the phone to the door or PC reader. **Does it work without internet?** Yes. The reader checks the card offline; the phone answers with the card’s signed data and a fresh signature. **Does the reader learn my name?** No. It receives only a pseudonymous card number, your sites and access groups and the validity. **Does it work with PKOC readers?** Yes. Door readers of the open PKOC standard (PSIA) work: your organisation enrols the card ID shown on the card, a public key whose private key never leaves your phone. **Can it interfere with contactless payment?** No. Only the card you chose answers, for a short time and only while your phone is unlocked; at all other times your phone does not answer access readers. ## Your phone as an NFC tag – read-only or writable Source: https://myeuid.app/en/nfc-memory-card.html An NFC memory card turns your phone into a standard NFC tag. A **read-only** card holds what your organisation put on it – a link, a text or an ID – and any NFC reader or phone can read it. A **writable** card lets a reader write to it, for example a check-in desk or a smart-home reader. Only the card you choose answers, and only for five minutes. Details: [read-only NFC tag](read-only-nfc-tag.html) · [writable NFC tag](writable-nfc-tag.html). ### What you need An Android phone with NFC, CodeB Wallet and an NFC memory card your organisation issues through phone.codeb.io – read-only or writable. ### How to use it 1. Collect the NFC memory card from your organisation. It appears in your wallet. 2. Open the card and tap **Use at reader** – or tap **Hold to reader** when the card is in front on the home screen. 3. Hold your phone to the reader or the other phone and keep it unlocked. 4. Tap Stop when you are done – leaving the screen ends it as well. ### What can read it Anything that reads standard NFC tags (NFC Forum Type 4 tag with NDEF content), for example: another Android phone or an iPhone, NFC apps such as NFC Tools, the Home Assistant app, check-in and visitor terminals, and USB or industrial NFC readers that support Type 4 tags. **Home Assistant:** put a Home Assistant tag link (https://www.home-assistant.io/tag/…) on the card – or, with a writable card, let the Home Assistant app write it. An Android phone or wall tablet with the Home Assistant app reads the tag, and an automation can switch lights, start a scene, unlock a smart lock or switch a **Shelly** relay that opens an electric door strike, a gate or a garage door. **Not every reader reads phones:** ESPHome readers (PN532, PN7150) and many simple card readers read only plastic tags such as NTAG213, NTAG215, NTAG216 or MIFARE – they do not read the tag on a phone. For Home Assistant use the Home Assistant app on an Android tablet at the door. ### Smart locks Smart locks do not read NFC tags from a phone directly. We checked the manufacturers’ documentation: **Nuki** opens with its app and Bluetooth (Nuki Keypad 2 NFC uses the Aliro standard), **Yale** and **August** with their app, Bluetooth, a PIN or their own key tags, **igloohome** with PIN codes, Bluetooth and its own RFID tags, **TTLock** locks with the app, a PIN or IC cards, **Aqara** and **SwitchBot** with their own NFC cards or MIFARE Classic cards, and **dormakaba Oracode** with time-limited PIN codes. Their card readers recognise a plastic card’s chip and fixed serial number, which a phone cannot imitate. **With Home Assistant it works:** connect the lock to Home Assistant – for example Nuki, Yale, August or SwitchBot, or any Matter, Zigbee or Z-Wave lock – put an Android tablet with the Home Assistant app at the door, and let an automation unlock the door when your phone’s tag is read. Doors with an electric strike, gates and turnstiles open the same way through a Shelly relay. Keep in mind: whoever reads a tag can copy its content. For doors that need real security use the [CodeB Access card](door-access.html) – it answers with a fresh signature from a key in the phone’s secure hardware and works with PKOC door readers. ### Writable cards With a writable card a reader – or another phone with an NFC app – writes its content to your phone. CodeB Wallet stores it encrypted on your phone, lists every write and lets you restore the original content. ### Only when you choose Only the card you chose answers, for five minutes, and only while your phone is unlocked. While the card is ready your phone acts only as this tag: it does not offer your ID and does not read other phones. It never interferes with payment apps or your other cards. ### Questions about the phone as an NFC tag **Can my phone act as an NFC tag?** Yes. With an NFC memory card in CodeB Wallet your Android phone answers as a standard NFC tag (NFC Forum Type 4, NDEF) – a link, a text or an ID. **What is the difference between read-only and writable?** A read-only card always shows what your organisation put on it. A writable card lets a reader write new content, which CodeB Wallet keeps encrypted on your phone; you can see every write and restore the original. **Can it open my Nuki, Yale, igloohome or TTLock lock?** Not directly – these locks do not read NFC tags from phones. With Home Assistant it works: an Android tablet with the Home Assistant app at the door reads the tag and an automation unlocks the lock. For secure door access use the CodeB Access card. **Does it work with Home Assistant?** Yes. Put a Home Assistant tag link on the card or let the Home Assistant app write it to a writable card; the Home Assistant app on an Android phone or tablet then reports the tag to your automations. ESPHome readers (PN532) read only plastic tags, not phones. **Does it work with a Shelly relay?** Yes, through Home Assistant: when the Home Assistant app reads the tag, an automation switches the Shelly relay that opens an electric door strike, a gate or a garage door. **Can someone copy it?** Whoever reads the tag can copy its content, as with any NFC tag. Use it for convenience; for security-relevant doors use the CodeB Access card. ## Your phone as a read-only NFC tag Source: https://myeuid.app/en/read-only-nfc-tag.html A **read-only NFC memory card** makes your Android phone answer like a standard NFC tag – for example a sticker or key fob. It holds what your organisation put on it: a link, a text, a contact card or other data. Any phone or NFC reader can read it. No reader can change it. ### What is a read-only NFC tag? An NFC tag is a small piece of memory that a phone or reader reads when you hold it close – think of the stickers on posters or the tags on hotel key fobs. The content is stored in the open **NDEF** format of the NFC Forum, so every NFC phone understands it. With CodeB Wallet your phone acts as such a tag (an NFC Forum **Type 4 tag**). **Read-only** means the content is fixed: readers can read it, but every attempt to write is refused. Only your organisation can change it, by issuing the card again. ### What it can hold Up to four entries, together up to about 4 KB: a **link** (for example a web page or a booking), a **text** (a number, a code, a short message), a **contact card** (vCard) or **other data** that a special reader expects. You see the content in the card in CodeB Wallet before you use it. Good uses: a welcome page for guests, a link to a menu or a manual, a member or ticket number for a check-in terminal, a contact card to share at an event. ### What you need An Android phone with NFC and CodeB Wallet, and a read-only NFC memory card from your organisation. Organisations create it on phone.codeb.io as a card template with the function “NFC memory card” and send you an invitation. ### How to use it 1. Accept the invitation from your organisation. The NFC memory card appears in your wallet. 2. Open the card and check its content. Tap **Use at reader** – or **Hold to reader** when the card is in front on the home screen. 3. Hold the back of your phone to the reader or the other phone and keep the phone unlocked. 4. Done. Tap **Stop** – leaving the screen ends it as well. ### What can read it Another Android phone or an iPhone, NFC apps such as NFC Tools, the Home Assistant app, check-in and visitor terminals, and USB or industrial NFC readers that support Type 4 tags. Simple card readers that only know plastic tags (NTAG, MIFARE) – for example ESPHome readers with a PN532 – do not read a tag on a phone. See [smart locks and readers](nfc-memory-card.html#locks). ### Only when you choose Your phone answers as the tag only after you tap **Use at reader** (or **Hold to reader** on the home screen), for at most five minutes, and only while the phone is unlocked. Only the card you chose answers. Meanwhile your phone does not offer your ID and does not read other phones. Payment apps and your other cards are never affected. Like any NFC tag, whoever reads it can copy its content. Do not use it as a key. For doors use the [CodeB Access card](door-access.html), which answers with a fresh signature every time. ### Questions about the read-only NFC tag **Can my Android phone act as an NFC tag?** Yes. With an NFC memory card in CodeB Wallet your phone answers as a standard NFC Forum Type 4 tag with NDEF content – a link, a text, a contact card or other data. **Can a reader change a read-only tag?** No. Every write is refused. Only your organisation can change the content, by issuing the card again. **Does an iPhone read it?** Yes. An iPhone reads NDEF tags, so it can open a link or show a text from your phone’s tag. **Is it safe to put a password on it?** No. Whoever reads an NFC tag can copy it. Use it for links, numbers and contact details – for doors use the CodeB Access card. **What is the difference to a writable NFC tag?** A read-only tag always shows what your organisation issued. A [writable NFC tag](writable-nfc-tag.html) lets a reader store new content on your phone. ## Your phone as a writable NFC tag Source: https://myeuid.app/en/writable-nfc-tag.html A **writable NFC memory card** makes your Android phone a standard NFC tag that readers can also **write** to – a check-in desk, a smart-home reader or another phone with an NFC app. What is written stays on your phone, encrypted. You see every write and can go back to the original content at any time. ### What is a writable NFC tag? Like a rewritable NFC sticker, but in your phone: readers read the content in the open **NDEF** format of the NFC Forum and can store new content with the standard NFC write procedure (NFC Forum **Type 4 tag**). Your organisation decides how much fits (from 128 bytes to about 4 KB) and whether the card starts empty or with content, for example a link. ### What it is good for A reception desk writes your room or locker number, an event entrance writes a stamp, a workshop machine writes the last setting, or a smart-home setup writes a tag ID – and the next reader reads it back from your phone. Any NFC app that writes standard tags works too, for example **NFC Tools** on another phone: choose Write and hold the phones together. ### What you need An Android phone with NFC and CodeB Wallet, and a writable NFC memory card from your organisation. Organisations create it on phone.codeb.io as a card template with the function “NFC memory card” and the write option “readers may write”. ### How to use it 1. Accept the invitation from your organisation. The writable NFC memory card appears in your wallet. 2. Open the card and tap **Use at reader** – or **Hold to reader** when the card is in front on the home screen. 3. Hold your phone to the reader or the other phone and keep it unlocked while it reads or writes. 4. Check the result in the card: what was written, when, and the list of recent writes. Tap **Restore issued content** to go back. ### Where the written content goes What a reader writes is kept **only on your phone**, encrypted with a key in the phone’s secure hardware. It is not sent to your organisation or to us. The card then shows **Written by a reader** with the date, the content, and the note that the issuer has not confirmed it. Under **Recent writes** you see the last 20 writes with time and size. **Restore issued content** throws away what readers wrote; the card answers with the original content again. Deleting the card removes the written content as well. ### Only when you choose Readers can read and write only after you tap **Use at reader** (or **Hold to reader**), for at most five minutes, and only while your phone is unlocked. At all other times nobody can read or write. Payment apps and your other cards are never affected. A write larger than the card’s size is refused and leaves the content unchanged. Whoever reads the tag can copy it – do not store passwords on it. ### Questions about the writable NFC tag **Can a reader write to my phone over NFC?** Only to a writable NFC memory card in CodeB Wallet, only while you have chosen it with Use at reader, and only while your phone is unlocked. Nothing else on your phone can be written. **Where is the written content stored?** Only on your phone, encrypted with a key in its secure hardware. It is never sent to your organisation or to CodeB. **How much can a reader write?** As much as your organisation allowed for the card – between 128 bytes and about 4 KB. Larger writes are refused. **Can I write to it with NFC Tools?** Yes. Any app that writes standard NFC tags (NDEF) works: choose Write in the app on another phone and hold the two phones together while the card is ready. **How do I undo a write?** Open the card and tap Restore issued content. The card answers with the content your organisation issued again. ## One-time codes for two-step sign-in (authenticator) Source: https://myeuid.app/en/authenticator.html Many websites ask for a six-digit code from an authenticator app when you sign in – two-step sign-in, also called two-factor authentication (2FA) or TOTP. CodeB Wallet has an authenticator built in: the codes are made on your phone, also without internet, and are kept apart from your documents. ### How to add an account 1. On the website, turn on two-step sign-in (often called “authenticator app” or “2FA”). It shows a QR code. 2. In CodeB Wallet open the menu → **One-time codes** → **Scan QR code** and scan it. No QR code? Tap **Enter key** and type the key the website shows. 3. Type the six-digit code shown in CodeB Wallet on the website to finish. From now on, tap the account to copy its current code. ### Made for long lists Pin the accounts you use most to the top; the rest are sorted A–Z by service. Put accounts into groups such as Work or Family. From six accounts a search field appears. In the last five seconds of a code the next one is already shown, so you never type a code that is about to expire. ### Move codes to a new phone Tap **Transfer all accounts**: CodeB Wallet shows the accounts as QR codes, several per code. Scan them on the other phone in CodeB Wallet or with the import of another authenticator app. The other way round works too: scan the transfer QR codes of another authenticator app in CodeB Wallet. ### Safe by design A copied code is removed from the clipboard after 30 seconds. A tapped “add to authenticator” link (otpauth://) opens CodeB Wallet after your PIN; the app always shows which accounts would be added and asks first. Your one-time code accounts are included in “Back up to a file”, protected by your backup password. ### Two-step sign-in for your CodeB account Signed in to your CodeB account in the app? Turn on two-step sign-in there with one tap – the app adds the account to its one-time codes and confirms it for you. ### Questions about one-time codes **Can CodeB Wallet replace Google Authenticator or another authenticator app?** Yes, for websites that use standard six-digit codes (TOTP). Scan the website’s QR code, or move your accounts over with the transfer QR codes of your old authenticator app. **Do the codes work without internet?** Yes. The codes are made on your phone from the key you added; no internet connection is needed. **How do I move my codes to a new phone?** Tap Transfer all accounts: CodeB Wallet shows the accounts as QR codes. Scan them on the new phone in CodeB Wallet or in another authenticator app. **Are my one-time codes backed up?** Yes, in “Back up to a file”, protected by your backup password. When restoring you choose whether to add them. **What is TOTP?** Time-based one-time password: a six-digit code that changes every 30 seconds, computed from a secret shared once with the website. It is the most common form of two-factor authentication. ## CodeB Wallet touchpoint guide Source: https://myeuid.app/en/touchpoint-guide.html For organisations that ask people for proof, issue cards or request signatures with CodeB Wallet: one button per action, one QR frame and one reader sticker, all in CodeB’s own look. The same rules apply on a website, at a counter, on paper and at a door or PC. ### Five principles 1. **Offer it where the decision is made** – next to the form, checkout step or sign-in it replaces, never hidden in a menu. 2. **Say what you ask for and why, before the tap** – one line under the button, for example “We check that you are over 18. We do not see your name or date of birth.” 3. **The person starts it** – nothing opens the wallet or shows a QR code until the person taps the button or asks the staff. 4. **Always a way back and a way around** – people without CodeB Wallet or without their phone get another route on the same page. 5. **Every result in plain words** – success, cancel and failure each get a short sentence and a next step, never an error code alone. ### Four actions, fixed labels Pick the action; never write your own label. The button opens the matching app link of CodeB Wallet. Button labels per action and language: | Action | English | German | Maltese | |---|---|---|---| | Verify – proof of identity, age or a card (OpenID4VP) | Verify with CodeB Wallet | Mit CodeB Wallet nachweisen | Ivverifika b’CodeB Wallet | | Add – issue a card or document (OpenID4VCI) | Add to CodeB Wallet | Zu CodeB Wallet hinzufügen | Żid ma’ CodeB Wallet | | Sign – ask for a PDF signature | Sign with CodeB Wallet | Mit CodeB Wallet signieren | Iffirma b’CodeB Wallet | | Open – the page only opens a wallet screen (e.g. passport reading, account) | Open CodeB Wallet | CodeB Wallet öffnen | Iftaħ CodeB Wallet | ### The button Rounded rectangle, the round red CodeB mark on the left and one line of text. Navy #0B3A8A with white text on light backgrounds; white with navy text and outline on dark backgrounds. 56 px high, never below 48 px, with at least 28 px clear space on every side. Not allowed: other colours, a different label, the mark alone as a button, stretching, shadows, animation or your own logo inside the button. ### Online: phone and computer On a phone the button opens CodeB Wallet directly. On a computer it opens a dialog with the QR code, a typed link and “Open on this device”. In both cases the person sees in the wallet what is asked and confirms. The dialog shows three states in plain words: waiting (“Open CodeB Wallet and confirm”), done (“Thank you – confirmed”, the page continues by itself) and not completed (what happened in one sentence and a button to try again). Next to the button: “No CodeB Wallet? Get it on Google Play” and your other way to continue. ### In person and on paper: the QR frame At a counter, on a kiosk screen or on paper the QR code always sits in the CodeB frame: a header with the mark, the code on white and a typed link for people who cannot scan. The code is at least 30 mm wide on paper and 200 px on screens. Staff start a request only when the person asks, and the screen shows the result in words, for example “Age confirmed”. CodeB Wallet itself uses the same frame when you share the app with someone. ### Doors and PCs: the reader sticker Readers that accept CodeB cards over NFC – door readers and PCs for the read/write and read-only PKI cards – carry the round sticker “Hold CodeB Wallet here”, 40 or 60 mm, centred on the antenna. Its hint “Open the card, then tap” matters: a card answers only after the person chooses it in the app and only while the phone is unlocked. Next to another maker’s reader the sticker sits beside their symbol, never over it. ### Wording and accessibility Write “CodeB Wallet” (two words, capital C and B), call the cards by the names the app uses, and describe what the person shares (“your age”). Never call anything “official”, “certified” or “government-approved”, and never show an error code alone. Use a real button or link whose accessible name is the visible label, reachable by keyboard with a visible focus ring; contrast at least 4.5:1 (both variants meet it). In the QR dialog the focus stays inside, Escape closes it and status changes are announced to screen readers. The label language follows the page language. ### Asset kit Buttons (navy and white, English, German and Maltese – Spanish and Finnish to follow), QR frame templates for screens and print, and the reader sticker are available to CodeB customers and partners. [Ask us for the kit](mailto:info@aloaha.com?subject=CodeB%20Wallet%20touchpoint%20kit). ### Questions from partners **How do I add a “Verify with CodeB Wallet” button to my website?** Use the navy button (white on dark backgrounds) with the fixed label for your action and link it to your OpenID4VP request. On phones it opens CodeB Wallet directly; on computers show the QR frame with the typed link. Ask us for the asset kit. **Which protocols do the buttons start?** Verify starts an OpenID4VP presentation request, Add an OpenID4VCI credential offer, Sign a CodeB signing request and Open a wallet screen. CodeB Wallet also accepts the standard openid4vp://, haip-vp:// and haip:// links. **Can people use another EU wallet on my page?** Yes. Keep a small plain link to the standard request next to the CodeB button so people with another wallet are never excluded. **Do I need a CodeB reader for doors or PCs?** No. Any reader that accepts CodeB cards over NFC can carry the sticker; place it next to the reader maker’s own symbol, never over it. **Is CodeB Wallet certified or official?** Do not describe it as official, certified or government-approved. Describe what the person shares, for example “your age”. ## User manual Source: https://myeuid.app/en/manual.html This guide explains CodeB Wallet step by step, in plain words. You do not need any technical knowledge. The pictures show the real app. ### Before you start CodeB Wallet is an app for Android phones. It keeps your digital documents – for example your digital ID, your driving licence or a membership card – safely on your phone. CodeB Wallet is designed to comply with the rules for the EU Digital Identity Wallet. It has not been officially tested or certified. ### Set up your wallet When you open CodeB Wallet for the first time: New phone? On the first “Add document” screen tap **New phone? Restore from a backup**. 1. Read the welcome screen and tap **Continue**. 2. Choose a 6-digit PIN. Pick numbers that others cannot guess – not your birthday and not 123456. 3. Enter the same PIN again to confirm it. 4. You see “Your wallet is secured!”. Tap the button to go to your home screen. Tip: Your PIN never leaves your phone. Nobody at Aloaha can see it or reset it for you, so please remember it well. ### Your home screen At the top is one card in front – the card you used last, or the one you chose to keep in front. NFC cards (access, PKI and NFC memory cards) have **Hold to reader** right below: one tap opens the card and makes it ready for the reader. Other cards have **Open**. Swipe left or right on that card to browse through all your cards. All your other cards are shown as tiles below. Tap a tile to open the card; hold a tile to keep that card in front. With more than six cards they are grouped into Identity, Access & NFC cards and Memberships & other cards, and **View all** shows every card with a search field. Below the cards are four quick actions: **Show ID** – prove who you are, in person or online., **Sign** – sign a PDF document electronically., **Verify** – check another person’s ID., **ID card** – read the chip of your passport or ID card. Under “How it works” every function is explained again. Tap **Learn more** for details; at the end of each explanation there is a button to start right away. At the bottom you switch between **Home**, **Documents** (all your documents as a list) and **History** (when you shared what, and with whom). Tip: hold the app icon for shortcuts to Scan QR code, Verify someone and One-time codes. ### Pseudonyms: sign in with a passkey Full guide: [Passkeys with pseudonyms – sign in without a password or your name](passkeys.html) Many websites let you sign in with a **passkey** instead of a password. CodeB Wallet can be that passkey: it creates a new **pseudonym** for each website. A pseudonym contains no name, e-mail address or other personal data, and websites cannot link your pseudonyms with each other. Needs Android 14 or newer. 1. Open the menu → **Pseudonyms (passkeys)** and tap **Turn on in Android settings**. In “Passwords, passkeys and accounts”, switch CodeB Wallet on. 2. On a website that offers “Create a passkey” or “Sign in with a passkey”, choose **CodeB Wallet**. 3. Confirm with your fingerprint, face or screen lock. Next time, pick the pseudonym and confirm the same way – no password. 4. Want to try it first? Open our test page phone.codeb.io/pseudonym-test.html in Chrome, tap **Create pseudonym** and choose CodeB Wallet, then **Sign in with a pseudonym**. **Try it in the app.** Once CodeB Wallet is switched on for passkeys, the Pseudonyms screen shows **Try it on the CodeB test page**: it opens our test website in your browser – tap “Create pseudonym” first, then “Sign in with a pseudonym”. **Manage them in the wallet.** Pseudonyms are listed by website. Give one your own name (only you see it – it is never sent to the website) or delete it. Deleting removes the key from your phone; delete the pseudonym on the website as well. **Secure by design.** Each pseudonym is a key in your phone’s secure hardware, used only after you confirm. It never leaves the phone and is not copied to a cloud. Creating, using and deleting a pseudonym is recorded in the History. **Apps too.** Apps can use a website’s pseudonyms only if that website allows the app (Digital Asset Links); browsers pass the website address they checked. **CodeB Wallet is not offered?** “Sign in” only lists pseudonyms you have already created on that website – create one first. If CodeB Wallet is missing even then, check Android 14 or newer, switch it on again in “Passwords, passkeys and accounts” and use an up-to-date Chrome. More on the page [Passkeys with pseudonyms](passkeys.html). Tip: Pseudonyms follow the W3C WebAuthn standard (passkeys) as the EU Digital Identity Wallet architecture (ARF 3.0, Topic 11) describes. They are not copied to a new phone – create new ones there and remove the old ones on the websites. ### Make CodeB Wallet your passkey service Android decides which app offers passkeys. Switch CodeB Wallet on once – the menu names differ slightly between phones and Android versions: 1. In CodeB Wallet, open the menu → **Pseudonyms (passkeys)** and tap **Turn on in Android settings**. This opens the right Android page directly. Or open it yourself: 2. **Pixel and most phones (Android 14 or newer):** Settings → **Passwords, passkeys & accounts** (on some phones “Passwords & accounts”). 3. **Samsung Galaxy:** Settings → **General management** → **Passwords, passkeys and autofill**. 4. **Make it the default:** tap **Preferred service**, choose **CodeB Wallet** and confirm. Android then offers CodeB Wallet first when a website asks for a passkey. Google Password Manager stays available. 5. **Or keep Google as default:** under **Additional services** (or “Additional providers”), switch **CodeB Wallet** on. CodeB Wallet then appears in the list next to Google whenever you create or use a passkey. 6. **In Chrome:** ⋮ → **Settings** → **Autofill services** → **Autofill using another service**. Then close Chrome completely (swipe it away in recent apps) and open it again. Without this, Chrome uses only Google’s own passkeys. 7. Back in CodeB Wallet, the Pseudonyms screen says “CodeB Wallet is switched on for passkeys on this phone”. CodeB Wallet does not fill in passwords. If your phone asks you to choose one service for passwords, passkeys and autofill together, you can keep your password manager as preferred service and switch CodeB Wallet on as an additional service instead. **Chrome shows Google’s “Save passkey” sheet, or “More options” ends with “Either the device has received unexpected request parameters, or the device cannot support this request”?** Chrome is still set to Google’s own passkeys and never asks CodeB Wallet. Set Chrome’s **Autofill services** to **Autofill using another service** and restart Chrome – Android’s sheet then lists CodeB Wallet. ### Add a document There are two ways to get a document into your wallet. 1. Tap **Add** on the home screen (or the + on the Documents tab). 2. Choose the document you want, for example “Personal ID (PID)”, and tap the red **+**. 3. Your phone opens the sign-in page of the issuer (for example phone.codeb.io). Sign in there. 4. Check what will be added and confirm with your PIN. The document appears on your home screen. If an issuer gives you a QR code instead, tap the QR symbol at the top right of “Add document from list” and scan it. From the CodeB issuer you can currently add the Personal ID (PID), the German PID, the mobile driving licence and the CodeB membership card. Tip: Some documents exist in two formats: “SD-JWT” is used online, “ISO mdoc” is needed to show your ID in person. If you want to do both, add the document in both formats (shown as “SD-JWT + ISO mdoc”). ### Show your ID in person For example at a counter, a hotel reception or a car rental. Showing your ID to a private person who also has an EU wallet? Tap **Person-to-person mode** on the QR screen. Use it only with someone you trust – never for a shop, business or authority. It ends after 5 minutes. In this mode you first choose which details you offer; the other wallet can ask only for those, anything else is refused. 1. Tap **Show ID** and choose **In person**. 2. Your phone shows a QR code. The other person scans it with their wallet or reader app – or the reader starts the connection with an NFC tap. 3. Your phone shows exactly which details are asked for – for example only “over 18”. You decide what you share. 4. Confirm with your PIN or biometrics. The details are sent directly from phone to phone over Bluetooth Low Energy – no internet connection needed. Tip: Bluetooth must be switched on. CodeB Wallet uses Bluetooth in both directions (both roles) for broad reader compatibility. On Android 12 and older the app also asks for the location permission, because Android requires it for Bluetooth scanning; your location is not collected. Showing in person needs the ISO mdoc version of a document. ### Show your ID online Some websites let you sign in or prove your age with your wallet. 1. On the website, choose to sign in or verify with an EU wallet. 2. On a computer: tap **Show ID**, choose **Online** and scan the QR code on the screen. On the same phone: the website opens CodeB Wallet by itself. 3. Check who is asking and for which details. CodeB Wallet tells you if the website could not be verified. 4. Confirm with your PIN or biometrics. Only the selected details are shared. ### Check someone else’s ID Full guide: [Prove your age – without showing your birthday](age-verification.html) Use this when you need to check another person’s identity or age – for example in a shop, at an event or when you rent something out. 1. Tap **Verify** on the home screen. 2. Choose what you want to check, for example only “over 18”. Ask only for what you really need. 3. The other person opens their EU digital identity wallet and shows the QR code for sharing in person. Scan it. 4. Their phone asks them for permission and then sends the details to your phone over Bluetooth. 5. CodeB Wallet shows the result: green means trusted, amber means look more closely, red means do not accept it. CodeB Wallet checks the issuer’s signature, that the data is unchanged, the validity period and whether the document has been revoked. Which issuers are trusted is up to you: in **Settings → Trusted certificates for verifying** you manage the list. CodeB’s own issuer certificate is built in; you can import further certificates. While you verify, the app is in **verifier mode**: use it only for a person who is with you. After 5 minutes on the request or result screen the wallet returns to its start screen. So that “Verify” cannot be misused as a mass reader, CodeB Wallet sends at most 5 requests per hour, 20 per day and 50 per week; after that it tells you how long to wait. Nothing is kept on your phone: the details are deleted as soon as you close the result. ### Door and PC access with CodeB Access Full guide: [Your phone as a door and PC access card](door-access.html) Organisations can issue an access card to your wallet through phone.codeb.io. With it, your phone opens doors and signs you in at a PC with a contactless reader. 1. Open the invitation from your organisation (link, QR code or e-mail) and collect the **CodeB Access** card. It appears on your home screen. 2. Before you go to the door or PC, open the card and tap **Use at reader**. 3. Hold your phone to the reader while the countdown runs. Keep the phone unlocked. 4. The reader checks the card offline and opens the door or signs you in. Tap **Stop** if you no longer need it – leaving the screen ends it as well. Only the card you chose answers, for at most five minutes, and only while your phone is unlocked. At all other times your phone does not answer any access reader. Door readers of the open **PKOC** standard (Public Key Open Credential, PSIA) work as well. Your organisation enrols the **PKOC card ID** shown on the card; tap **Copy card ID** to send it. The ID is a public key – the matching private key never leaves your phone’s secure hardware. The reader receives only a pseudonymous card number, your sites and access groups and the validity – never your name. Every use is listed under History. Lost your phone? Your organisation revokes the card and can give you a new one on your new phone. Tip: Readers that do not see your card show a hint: open the card in CodeB Wallet, tap “Use at reader” and hold the phone to the reader again. ### Your phone as an NFC tag (NFC memory cards) Full guides: [read-only NFC tag](read-only-nfc-tag.html) · [writable NFC tag](writable-nfc-tag.html) · [readers and smart locks](nfc-memory-card.html) An NFC memory card lets your phone answer like a standard NFC tag (NDEF). It holds a link, a text, a contact card or other data from your organisation. There are two kinds: **read-only** – readers can only read it – and **writable** – readers can also store new content on it. 1. Accept the invitation from your organisation. The NFC memory card appears on your home screen. 2. Open the card. You see its content. Tap **Use at reader** – or **Hold to reader** when the card is in front on the home screen. 3. Hold your phone to the reader or the other phone while the countdown runs. Keep the phone unlocked. 4. Tap **Stop** when you are done – leaving the screen ends it as well. **Read-only card:** readers see exactly what your organisation issued. Nobody can change it; only a new issue does. **Writable card:** a reader or an NFC app (for example NFC Tools on another phone) can store new content, up to the size your organisation set. The card then shows **Written by a reader**, the content and the note that the issuer has not confirmed it. **Recent writes** lists the last 20 writes. **Restore issued content** brings back the original. Written content stays on your phone only, encrypted. Only the card you chose answers, for at most five minutes, and only while the phone is unlocked. Meanwhile the phone does not offer your ID and does not read other phones. Like any NFC tag, the content can be copied by whoever reads it – do not store passwords on it. For doors use CodeB Access. Tip: If a reader does not react, open the card again, tap “Use at reader” and hold the middle of the phone’s back to the reader for a moment. ### Sign in at a Windows PC with your phone as a PKI card Full guide: [Your phone as a smart card for Windows sign-in](phone-smart-card.html) Your phone can act as a contactless PKI smart card for signing in at a Windows PC with an NFC reader. 1. Your organisation issues the PKI card to your CodeB Wallet (link, QR code or e-mail). It appears as its own card on your home screen. With a **read/write PKI card**, Windows stores your sign-in certificate on the phone itself. A **read-only PKI card** receives your organisation’s signing certificate from the server right after you add it; the card page then says “Your organisation’s signing certificate is on this card”. 2. The first time you open the card, CodeB Wallet sets it up and asks you to choose the **card PIN** (read/write: 4 to 16 characters; read-only: 6 to 8 digits). For a read-only PKI card you also see your **unblock code (PUK)** once – note it down. 3. At the PC, open the card in CodeB Wallet and tap **Use at PC**. 4. Hold your phone to the PC’s NFC reader. A light on the card screen shows the connection: grey and pulsing while it waits, **green** while the phone is connected to the reader, red if the connection drops. The card stays ready until you take the phone away or close the screen. Keep the phone unlocked. 5. Windows sees a smart card. Choose it and enter the card PIN. Only the card you chose answers, only while its screen is open, the phone is at the reader and unlocked. It never interferes with door access, payment apps or your other cards. You can hold several PKI cards. Each card shows a name from its certificate – for a Windows sign-in certificate your sign-in name – or, before Windows has put a certificate on it, “Card …” with the last four characters of its card number. The card page lists the certificates on the card with their purpose, issuer and validity. To remove a certificate Windows put on a read/write PKI card, open the card, tap **Remove** next to the certificate and enter the card PIN. The certificate and its key are deleted from the card for good; Windows can no longer use them. To change the card PIN, open the card and tap **Change card PIN**: enter the current PIN and the new one twice, then confirm with your fingerprint, face or screen lock. A wrong current PIN counts as a wrong try, exactly as at the PC. If the read-only card’s PIN is blocked, tap **Unblock with PUK** and enter the PUK you noted when the card arrived. A blocked read/write card is unblocked or re-issued by your organisation. Every use needs the card PIN. The read/write card’s key is made in your phone’s secure hardware and never leaves it. The read-only card’s signing key is your remote-signing key from your organisation’s server, kept in your phone’s secure hardware; revoking the card stops the card, and your organisation revokes the signing certificate separately. After too many wrong PINs the card is blocked. For administrators: how to issue PKI cards and set up the Windows certificate authority (phone.codeb.io). ### Read your passport or ID card Full guide: [Read and check passports and ID cards with NFC](passport-nfc.html) CodeB Wallet can read the chip of your electronic passport or ID card and check that the document is genuine. You need an Android phone with NFC and a document with a chip – passports show a chip symbol on the cover, newer ID cards have the chip inside. 1. On the home screen tap **ID card**. 2. Choose how to open the chip: with the **card access number (CAN)** – the 6 digits printed on the front of many ID cards – or with the **machine-readable zone**. For the machine-readable zone the camera reads the two or three lines of characters at the bottom of the photo page; you can also type the data by hand. For a passport, hold the phone a little further away so that both lines fit across the whole frame; in poor light, switch on the **camera light**. 3. Hold the document flat against the back of your phone and keep it still until the reading is complete. If NFC is switched off, the app asks you to switch it on. If no chip is found after about 10 seconds, the app shows tips: move the phone slowly, for a passport try the front cover and then the photo page, and remove a thick case. 4. You see the result: whether the document is genuine, the issuing country, and the data from the chip with the photo. 5. Tap **Save on this phone** if you want to keep a copy. It is encrypted on your phone and appears as its own card on the home screen; tap the card to open it again. You can delete it at any time. What the check means: the chip’s data must carry a valid signature of the issuing country (checked against the country certificates), and the chip must prove that it is not a copy. Nothing is sent anywhere when you read a document this way. A saved copy is not an EU digital identity document and cannot be shown to others with the wallet. Tip: Take the phone out of a thick case and try different positions – the NFC antenna is usually in the middle or near the camera. ### Reading your ID card for the CodeB PID Provider When you add your Personal ID (PID) from the CodeB PID Provider, its sign-in page may offer to read your ID card or passport. This fills in your details directly from the chip. 1. On the sign-in page, choose to read your document with CodeB Wallet. On the same phone the wallet opens by itself; on a computer, scan the QR code with your phone. 2. The wallet shows who is asking and what will be read. Tap **Continue** – or **Decline** if you do not want this. 3. Enter the card access number or scan the machine-readable zone, then hold the document to your phone. 4. When the reading is finished, tap **Continue sign-in**. The sign-in continues in your browser, and then your PID is added to your wallet. Here the PID Provider’s server reads the chip itself. The chip and the server set up their own end-to-end encrypted and authenticated channel (PACE, Chip Authentication, Secure Messaging): your phone only passes these messages on – it cannot read or change them, and neither can anyone in between; at most the reading can be interrupted. Your phone keeps no copy, and it also shows the server that it runs the genuine CodeB Wallet (Android and Google Play checks). This also works right after installing the app: set your PIN, and the reader opens on its own – you need no other card in your wallet. If you installed the app from the sign-in page, go back to that page and tap “Open in CodeB Wallet” again. ### Create a free CodeB account Full guide: [Free CodeB account – opened with your passport or ID card](free-account.html) Many functions of CodeB Wallet use an account on phone.codeb.io: signing your own PDFs with the CodeB signing service and the test PID and Photo ID. You can create this account in the app – free, in about two minutes, with your passport or ID card. To keep spam out, the account opens only with a genuine document: phone.codeb.io reads its chip through your phone and checks that it is genuine. It is a **document-checked guest account**: one account per document and per phone. You can sign 5 of your own documents a day; signing documents someone else asks you to sign does not count. **What you need:** an Android phone with NFC switched on, your passport or ID card with a chip, your e-mail address – and about two minutes. 1. On the home screen tap the three lines at the top left, then **Settings**, and tap **Create a free CodeB account** in the section “CodeB account”. You need no other card in your wallet. 2. Read what is checked and kept, then tap **Agree and continue**. 3. ID card: tap **Enter the card access number (CAN)** and type the 6 digits printed on the front of the card. Passport, or no CAN on your card: tap **No CAN? Use the machine-readable zone** and hold the camera over the two or three lines of letters and numbers at the bottom of the photo page. 4. Hold the document flat on the back of your phone, near the camera, and do not move it until the bar is full – a few seconds. If nothing happens, move the document slowly over the back of the phone and remove a thick case. 5. Your document is genuine: type your e-mail address and tap **Send code**. 6. Open the mail from phone.codeb.io, type the 6-digit code and tap **Open account**. 7. Your account is ready. Tap **Add my documents (PID and Photo ID, test)** and then **Accept**: your test PID is added. Back on the home screen the Photo ID follows by itself – tap **Accept** again. 8. Last step: open the mail and set your password with the link. You need it to sign in on phone.codeb.io. **No mail?** Check your spam folder, or tap **Send a new code**. A code is valid for 10 minutes; after 5 wrong codes, start again. **“This document already has an account”:** nothing new is opened. That account’s e-mail address gets a notice – sign in there, or set a new password with “Forgot password” on phone.codeb.io. **Lost your password or got a new phone?** Set a new password on phone.codeb.io with the address you used. Your account stays the same. **“This phone cannot be verified”:** the account needs a phone that passes Android’s and Google Play’s checks, with the app installed from Google Play. **The chip cannot be read:** hold the document still at the phone’s NFC antenna and remove thick cases; check the CAN, or use the machine-readable zone. An expired document cannot open an account. **Too many tries:** to keep spam out, only a limited number of accounts can be opened per network and day, and one per phone and document. Try again later. **What is kept:** your name, date of birth, nationality, the document’s expiry date, the chip photo and your e-mail address. The CAN, the machine-readable zone and the raw chip data are never kept. You can have the account deleted at any time; in Settings, “CodeB account” opens your account on phone.codeb.io. On your Android phone, the link https://myeuid.app/open/account opens the account screen in CodeB Wallet directly. It also works right after installing: set up your wallet PIN, and the app continues with the account. Tip: The account proves that a genuine document was held to a genuine phone. It is not an official identity and not a qualified signature – signatures from the CodeB signing service are advanced electronic signatures (AdES). ### Your CodeB account in the app Sign in to your CodeB account on phone.codeb.io right in the app – with your password, a passkey or your EU Wallet. Then you can ask other people to sign PDFs, check the signatures of any PDF, turn on two-step sign-in with the app’s own one-time codes, add your membership card and keep an encrypted copy of your backup on your account. The sign-in page of phone.codeb.io opens in your browser; the app keeps the sign-in only on this phone. When phone.codeb.io ends the session (after some hours), the app asks you to sign in again. 1. Open **Settings** and tap **Sign in to your CodeB account** (or tap the link myeuid.app/open/codeb-account on your phone). 2. Tap **Sign in**. phone.codeb.io’s sign-in page opens in your browser – sign in as usual. 3. Tap **Open CodeB Wallet** on the page that follows. The account screen shows that you are signed in. **Signing requests.** Tap **Signing requests** → **New signing request**, choose up to 10 PDFs, the signature level (advanced, or qualified with a certificate that states it), whether you sign first, and the people who sign after you, in order. Each person gets an e-mail and signs with their own EU Wallet or signature card. You follow every step in the app, send a reminder, withdraw the request, save the signed PDF or check its signatures. **Check a signed PDF.** Choose any PDF on your phone: you see who signed, when, in which format and whether the document was changed afterwards. phone.codeb.io checks it and keeps nothing. The certificates are not checked against the EU trusted lists; “qualified” is shown as the certificate states it. **Two-step sign-in.** Tap **Turn on with One-time codes**: the app adds your account to its own one-time codes and confirms it at once. Write down the recovery codes it shows – they are shown only once. **Backup copy on your account.** Tap **Save a copy now** and choose a backup password: the copy is encrypted on your phone; phone.codeb.io cannot read it. On a new phone, sign in and tap **Restore from the copy**. **Membership card.** When your account details are complete, **Membership card** adds your CodeB membership card to the wallet. **This phone’s wallet.** While you are signed in, the app links this phone’s wallet to your account. If you lose the phone, open your account page on phone.codeb.io and revoke it there: it then gets no new documents, and the documents phone.codeb.io issued to it are withdrawn. You can also tap **Revoke this wallet** in the app – this cannot be undone. Tip: The account features need a CodeB account on phone.codeb.io. No account yet? Create a free one with your passport or ID card (see above). ### Your cards from phone.codeb.io and the sign-in card On [phone.codeb.io/member-card.html](https://phone.codeb.io/member-card.html) (“My wallet credentials”) you see the cards phone.codeb.io has for you and add them to CodeB Wallet. Sign in on phone.codeb.io first. 1. Open [phone.codeb.io/member-card.html](https://phone.codeb.io/member-card.html) and sign in. 2. Choose a card and add it: on the phone with CodeB Wallet, tap the button; on a computer, scan the QR code with CodeB Wallet. 3. Confirm in CodeB Wallet. The card appears on your home screen. **Sign-in card.** Tap **Add a sign-in card to my wallet**. Afterwards you sign in to phone.codeb.io without a password: choose **Sign in with my CodeB sign-in card** and confirm in CodeB Wallet. The sign-in card holds only a random sign-in number for your account. It shows that you hold the card – not who you are. The same page lists your sign-in cards. If you lose your phone, revoke the card there; it then no longer works. ### Sign in with your eID card Sign in to phone.codeb.io with your Maltese eID card. The sign-in page shows a QR code; CodeB Wallet reads the card over NFC, the card signs a one-time challenge with its authentication key, and your browser is signed in. Your PIN and the card’s key never leave the card. Only the Maltese eID card is supported for now. 1. On the sign-in page of phone.codeb.io choose **Sign in with eID card**. A QR code appears. 2. Scan the QR code with your phone’s camera (or tap the link on the phone). CodeB Wallet opens and shows who asks you to sign in – tap **Continue**. 3. Enter the 6-digit card access number (CAN) printed on the front of the card. 4. Hold the card flat against the back of your phone and leave it there. 5. Enter the card’s authentication PIN. The card signs, and the app sends the answer to phone.codeb.io. 6. You see “You are signed in”. Go back to your browser – it continues by itself. **The first time** phone.codeb.io may ask you in the browser to confirm the name on the card and link the card to your account. **Only one PIN try left?** CodeB Wallet never uses the last try, to protect your card. **“This sign-in has expired”:** the QR code is valid for a few minutes. Start again in the browser. ### Sign a PDF document With CodeB Wallet you sign PDF documents on your phone with an advanced electronic signature (AdES) via the CodeB signing service. The signature is a PAdES signature with a trusted timestamp. Overview of both ways to sign – your signature card or the CodeB signing service, chosen for every signature: [How signing works](sign-pdf.html). 1. On the home screen tap **Sign**, then **Select document** and pick a PDF on your phone. 2. Check the document on the review screen: swipe or use the arrows to go through the pages. You also see the signing service and the signature type. 3. Tap **Sign document**. Your browser opens: sign in with your CodeB account – with password, passkey or your EU Wallet. 4. Back in the app, CodeB Wallet prepares the document. If you have more than one signing certificate, choose the one you want to use. 5. The browser opens again: confirm that you want to sign exactly this document. 6. The app signs the document and adds a trusted timestamp. 7. You see “Document signed”. Tap **Save to phone** (and choose a folder), **Share** or **Done**. If you cancel or something goes wrong, the app tells you why – with the signing service’s own message, for example that you first need to link your EU Wallet or set up a passkey. Limits: PDFs up to 40 MB can be signed. Password-protected PDFs cannot be signed. The signature is invisible on the page; PDF readers show it in their signature panel. Earlier signatures in the PDF stay valid. Your PDF stays on your phone; the signature is added to the document on your phone. CodeB Wallet uses Aloaha’s own PDF signing technology – the same technology Aloaha uses on its servers. Aloaha has been active in PDF development and digital signatures since 2003. Signatures from the CodeB signing service are advanced electronic signatures (AdES), not qualified electronic signatures (QES). To sign with your own signature card instead, see the next section. **Signing request from a website:** see [Sign a document from a website (QR code)](#sign-request). Tip: For every signature you have to confirm again that it is really you. This is required by law, so that nobody can sign in your name. ### Sign a document from a website (QR code) A website can ask you to sign one or more PDFs – for example a contract that several people sign one after another. On [phone.codeb.io/sign-request](https://phone.codeb.io/sign-request.html) anyone with a CodeB account (a guest account too) uploads the PDFs, and CodeB Wallet signs them by scanning a QR code. The PDF never has to be e-mailed around. 1. **On the website:** sign in on phone.codeb.io/sign-request, upload 1–10 PDFs (each up to 40 MB) and choose **Advanced** (signature card or CodeB signing service) or **Qualified** (only a signature card whose certificate states a qualified signature). 2. Choose who signs: **I sign as well (first)** and up to 5 people invited by e-mail (guest accounts: 2), in the order set with the arrows. Then tap **Release for signing**. 3. When it is your turn, the page shows a QR code. In CodeB Wallet open the **QR scanner** and scan it – or, on the same phone, tap **Open in CodeB Wallet**. 4. The wallet shows who asks for the signature – with “Verified” when the request is signed with that organisation’s certificate – and every document. Check them. 5. Sign with your signature card over NFC or with the CodeB signing service – or decline. 6. The website shows the progress live. When everyone has signed, the signed PDF can be viewed and downloaded there. **Invited by e-mail?** You get the mail “Please sign: …” when it is your turn. The link opens the page with the QR code and “Open in CodeB Wallet”; you need no account on the website. At the end everyone gets a link to the signed PDF. Every signer signs the PDF exactly as the previous signer left it (incremental update), so earlier signatures stay valid. The website checks each signature and shows the PAdES level. “Qualified” is shown only when the signer’s certificate says so. Signatures from the CodeB signing service are advanced electronic signatures (AdES). Your own turn stays open for 24 hours, an invited person’s turn for 72 hours. Requests are kept for 30 days after they close, or until you delete them. Guest accounts sign 5 of their own documents a day; signing as an invited person does not count. Tip: Designed to follow the EU Architecture and Reference Framework (ARF) 3.0, topic 16, and the signing request of ETSI TS 119 432. Not certified. ### Sign with your signature card (Maltese eID) Instead of the CodeB signing service you can sign with your own signature card over NFC – the Maltese eID or a Maltese residence card, a D-Trust Card 5, a German health professional card (HBA) or a German electronic health card (eGK). No browser and no account are needed: the card makes the signature, and the key never leaves the card. Overview of both ways to sign – your signature card or the CodeB signing service, chosen for every signature: [How signing works](sign-pdf.html). 1. On the home screen tap **Sign**, then **Select document** and pick a PDF on your phone. 2. Check the document, then tap **Sign with signature card**. 3. Enter the 6-digit card access number (CAN) printed on the card. The app offers the last number that worked. 4. Hold the card flat against the back of your phone and leave it there until signing is finished. 5. Enter your signature PIN. The card signs the document, and the app adds a trusted timestamp. 6. You see “Document signed”, with the card used and whether its certificate states a qualified electronic signature. Tap **Save to phone** or **Share**. A wrong PIN is never retried by the app: you see how many tries are left, check the PIN and hold the card to the phone again. If the card access number does not match the card, the app asks for it again – then take the card away and hold it to the phone again. A wrong CAN uses up nothing. If the card is moved away too early, nothing is signed – just hold it to the phone again. If a website asks for a qualified electronic signature, only a card with a qualified signature certificate is used. A blocked PIN, or a card that still has its transport PIN, is explained before anything is sent. Maltese eID PINs are reset by Identity Malta. The document stays on your phone. Only for the trusted timestamp is a fingerprint (hash) of the signature sent to the CodeB timestamp service. The app shows what the card’s certificate states; CodeB Wallet itself is not certified. ### History Tap **History** in the bar at the bottom of the screen to see everything you added, shared and signed. Tap an entry to see the details. The history is kept only on your phone. It is not sent anywhere. ### Keeping your documents up to date CodeB Wallet checks the status of your documents automatically. If an issuer has revoked a document, the wallet shows it. Where the issuer supports it, the wallet can renew your documents automatically before they expire, so they stay valid. ### Menu and PIN Tap the three lines at the top left of the home screen to open “My CodeB Wallet”. There you can: 1. **Change PIN** – enter your current PIN, then the new one twice. 2. **Settings** – see below. 3. **One-time codes** – sign-in codes for websites with two-step sign-in (see below). 4. **Pseudonyms (passkeys)** – sign in to websites without a password or your name (see the chapter above). 5. **About CodeB Wallet** – version, legal information and licences. ### One-time codes (two-step sign-in) Full guide: [One-time codes for two-step sign-in (authenticator)](authenticator.html) Many websites ask for a six-digit code from an authenticator app when you sign in (two-step sign-in, also called two-factor authentication or 2FA; TOTP). CodeB Wallet has one built in: open the menu and tap **One-time codes**. The codes are made on your phone, also without internet, and are kept apart from your documents. 1. On the website, turn on two-step sign-in (often called “authenticator app” or “2FA”). It shows a QR code. 2. In CodeB Wallet open the menu → **One-time codes** → **Scan QR code** and scan it. No QR code? Tap **Enter key** and type the key the website shows. 3. Type the six-digit code shown in CodeB Wallet on the website to finish. From now on, tap an account to copy its current code – it is removed from the clipboard after 30 seconds. **Groups for long lists.** Put accounts into groups such as Work or Family: tap the three dots → **Move to a group**, or choose a group when you enter a key. Groups appear A–Z below the pinned accounts and open or close with a tap – the app remembers which ones you closed. The pencil next to a group renames it or removes it (its accounts stay). The search looks through all groups. **Made for long lists.** Pin the accounts you use most to the top (bookmark symbol), the rest are sorted A–Z by service. From six accounts a search field appears. In the last five seconds of a code the next one is already shown, so you never type a code that is about to expire. **Move codes to another phone.** Tap **Transfer all accounts** at the top: CodeB Wallet shows the accounts as QR codes, several per code. On the other phone scan each code in CodeB Wallet (One-time codes → Scan QR code) or with the import of another authenticator app. A single account: hold its row or tap ⋮ → **Show as QR code**. The other way round works too: scan the transfer QR codes of another authenticator app here. **Links.** A tapped “add to authenticator” link (otpauth://) opens CodeB Wallet after your PIN; the app always shows which accounts would be added and asks first. On Android, myeuid.app/open/authenticator opens the one-time codes directly. **In the backup.** “Back up to a file” includes your one-time code accounts, protected by the backup password; when restoring you choose whether to add them. Tip: The QR codes of an account contain its secret key – anyone who scans them can create your codes. Show them only to scan them with your own phone. CodeB Wallet blocks screenshots on this screen. Counter-based codes (HOTP) are not supported. ### Settings **Authenticate with biometrics** – unlock the wallet with your fingerprint instead of the PIN. **Document issuers** – choose which issuers appear when you add a document. CodeB is switched on; the EU test issuers are switched off because they only issue test documents. **Trusted certificates for verifying** – which issuer certificates CodeB Wallet trusts when you check someone else’s ID. CodeB’s own issuer certificate is built in; you can import further certificates. **Back up to a file** – saves a password-protected file with the list of your documents, who issued them and your history (none of the data inside the documents and no document keys; if you use one-time codes, their accounts are included) where you choose: on the phone, an SD card or a cloud drive. With “Keep this file up to date” it is updated after every change. **Restore from a backup** – on a new phone: choose the file, enter its password, then choose whether to restore the history and which documents to add again. Each issuer issues the document again to the new phone, the PID first. “Continue restoring” shows what is left. Documents from another wallet that are not tied to a phone come back directly and are listed under **Documents from a backup**. **Offer my documents to websites and apps** – on by default. When a website or app asks for a document through Android’s Digital Credentials API, Android can offer yours; nothing is shared without your approval. Switch it off and Android no longer offers your documents. **Delete wallet** – removes all documents, the history, your settings and all keys from this phone. You confirm with your wallet PIN; after too many wrong PINs you have to wait. The app then closes; when you open it again it starts as new. Your accounts with issuers and signing services are not deleted. **Changelog** – what is new in each version (opens this website). **Retrieve logs** – creates a technical log file you can send to us if something does not work. ### Links that open the app These links open a place in CodeB Wallet directly – handy in e-mails, chats, on a website or as a QR code. They work on an Android phone with CodeB Wallet 2026.10.27 or later; on a freshly installed app they open after you have set up your PIN. Without the app, the link shows how to get it. The links carry no data and never skip your PIN. The links: **Create a free CodeB account** – myeuid.app/open/account **Sign a PDF** – myeuid.app/open/sign **Scan a signing QR code** – myeuid.app/open/sign-qr **Scan a QR code to sign in or share** – myeuid.app/open/scan **Add a document** – myeuid.app/open/add-document **Check someone’s ID** – myeuid.app/open/verify **Settings** – myeuid.app/open/settings **Your CodeB account** – myeuid.app/open/codeb-account ### Your data and your safety Your documents and your history are stored only on your phone, protected by your PIN or biometrics. The keys are kept in the phone’s secure hardware. Nothing is shared without your consent. Before anything leaves your phone, you see exactly what is asked for and who is asking. When you sign with your own signature card, the key stays on the card. Your PIN is never stored; the card access number (CAN) is kept encrypted on your phone only to offer it again. CodeB Wallet contains no advertising, no tracking and no analytics. To remove everything from this phone at once, use **Settings → Delete wallet**. If you lose your phone, contact the issuer of your documents so they can cancel (revoke) them. You can then add them again on your new phone. ### Problems and help **“Issuance blocked”** – the wallet could not confirm that the issuer is genuine, so it stopped for your protection. Try again later or contact the issuer. **Showing in person does not connect** – check that Bluetooth is switched on on both phones and that they are close to each other. **“Something went wrong”** – the screen shows the reason. If it does not help, go to Settings → Retrieve logs and send the file to [info@aloaha.com](mailto:info@aloaha.com) with a short description. **Nothing happens when I hold my ID card to the phone** – check that NFC is switched on, remove a thick case and hold the document still against the middle of the phone’s back. If it still does not work, tap **Send diagnostic log** on the screen and send the log to us. **“The card access number is not correct”** – check the 6-digit card access number on the front of your ID card, or use the machine-readable zone instead. ## Changelog (latest) Source: https://myeuid.app/en/changelog.html ### Version 2026.10.68 – 20 October 2026 (test on Google Play) • Home: swipe left or right on the card in front to browse through all your cards. • Updating a card that needs you to sign in again now opens the sign-in instead of an error. • The quick start for a first Photo ID is shown only in a new, empty wallet. • New guides: your phone as a read-only or writable NFC tag. --- © 2026 Aloaha Limited, Malta. CodeB is a brand of Aloaha Limited. All rights reserved. CodeB Wallet website — Copyright (c) 2026 Aloaha Limited