D-Trust · signature and seal cards · NFC
D-Trust signature and seal cards on your phone
CodeB Wallet signs PDFs with D-Trust cards that have an NFC interface – straight from your Android phone, without a card reader. CodeB Wallet itself is not certified.
- Qualified signature (Card 5.1)
- Qualified seal (Card 5.4)
- RSA and ECC
The four steps in the app
1Enter the card access number (CAN) printed on your card. 
2Hold the card flat against the back of the phone. 
3Enter your card PIN – it goes only to the card. 
4Done: signed with the D-Trust card, qualified certificate shown.
What you need
A D-Trust Card 5 with NFC – signature card or seal card – its card access number (CAN) printed on the card, and its PIN.
An Android phone with NFC and CodeB Wallet.
Which D-Trust cards work
D-Trust Card 5.1 – signature card for a person: qualified electronic signature.
D-Trust Card 5.4 – seal card for an organisation: qualified electronic seal.
Both in the Standard (RSA) and Multi (ECC) variants. D-Trust cards of generation 4 have no contactless interface; the app recognises them and tells you that they need a card reader on a computer.
How to sign a PDF with a D-Trust card
- On the home screen tap Sign, then Select document and pick a PDF on your phone.
- Check the document, then tap Sign with signature card.
- Enter the 6-digit card access number (CAN) printed on the card. The app offers the last number that worked.
- Hold the card flat against the back of your phone and leave it there until signing is finished.
- Enter your PIN. The card signs the document, and the app adds a trusted timestamp.
- You see “Document signed”, with the card used and whether its certificate states a qualified electronic signature. Tap Save to phone or Share.
Qualified signatures and seals
The card creates the signature or seal with the key on its chip – the key never leaves the card. CodeB Wallet reads the card’s certificate and shows whether it is qualified.
Signatures and seals are embedded in the PDF as PAdES (ETSI EN 319 142) with a trusted timestamp. CodeB Wallet itself is not certified.
Security: your card, your PIN, your document
Phone and card first build an encrypted, authenticated connection with the card access number (PACE). Your PIN reaches the chip only over this connection, and the chip checks it. The app never stores your PIN.
The signing key never leaves the card. A wrong PIN is never retried automatically.
The PDF stays on your phone. Only a fingerprint (hash) of the signature is sent to the CodeB timestamp service for the trusted timestamp. No account, no tracking.
PIN and transport PIN
A new D-Trust card comes with a transport PIN. Set your own PIN first with your card issuer’s tools; CodeB Wallet tells you if the card still has its transport PIN and sends nothing.
A wrong PIN is never retried automatically.
Tips for a stable connection
Hold the card flat against the back of the phone and keep it still until signing is finished. Remove thick phone cases.
On Android 14 and later the app shows where your phone’s NFC antenna is. If the connection drops, the app continues by itself as soon as the card is back – the card access number is not asked again.
Questions about D-Trust cards
Can I sign with my D-Trust card on an Android phone?
Yes, with the D-Trust Card 5.1 and 5.4, which have an NFC interface. Enter the card access number (CAN), hold the card to the phone and enter your PIN – the card signs the PDF.
Can an organisation seal PDFs with the D-Trust seal card?
Yes. With the D-Trust Card 5.4 an organisation applies its qualified electronic seal to PDFs from a phone. CodeB Wallet itself is not certified.
My D-Trust card is not recognised – why?
D-Trust cards of generation 4 have no contactless interface and need a card reader on a computer. If a generation 5 card is not found, check the card access number and hold the card still at the phone’s NFC antenna.
Do I need an account or a browser plug-in?
No. The app talks to the card directly over NFC. The PDF stays on your phone; only a fingerprint (hash) of the signature is sent to the CodeB timestamp service for the trusted timestamp.
What about my PIN?
The app shows the remaining tries; a wrong PIN is never retried automatically. Change a transport PIN or unblock a PIN with your card issuer’s tools.
Where do I find the card access number (CAN)?
On the D-Trust card itself: a 6-digit number printed on the card. The app asks for it before you hold the card to the phone and keeps it encrypted on your phone so it can offer it again.
What if my PIN is blocked or I forgot it?
Unblock it with the PUK from your PIN letter using your card issuer’s tools, or contact D-Trust. CodeB Wallet never retries a wrong PIN automatically and shows the remaining tries.
Install the closed beta (Google Play) Closed beta: open only to invited testers signed in to Google Play with the e-mail address on our tester list. To join the beta, contact us at info@aloaha.com.