Help – all questions about CodeB Wallet

CodeB Wallet is an Android app that stores digital documents – such as your Person Identification Data (PID), mobile driving licence or CodeB membership card – and presents them in person or online. It can also check other people’s IDs and sign PDF documents. It is built for the European Digital Identity (EUDI) framework under eIDAS 2.0, Regulation (EU) 2024/1183, by Aloaha Limited, Malta.

No. “d-you” is Germany’s official EUDI wallet, provided by the federal government from early 2027 – according to the federal guidance for municipalities from 2 January 2027 (eudi-wallet.gov.de). CodeB Wallet is a private wallet by Aloaha Limited, Malta, built on the EU wallet rules; it is not a certified EUDI wallet. You can use both on the same phone.

No. Your physical ID card and passport stay valid and you still need them. CodeB Wallet is an additional way to show details from your documents digitally – and only the details you choose.

Every request names who is asking. CodeB Wallet checks the relying party’s certificate and registration, shows the purpose, and warns you if data is requested that the relying party has not registered. You decide what you share – often a single detail is enough, for example “over 18” without your date of birth.

Yes. Tap Verify in CodeB Wallet and scan the other person’s QR code: their wallet sends the details phone to phone over Bluetooth, and CodeB Wallet checks the issuer’s signature, that nothing was changed, the validity and the revocation status. Nothing is stored on your phone. In Germany, the federal checking app for in-person checks will not be available when d-you starts.

Yes – EU wallets are certified against EU-wide security and data-protection rules before they are recognised, and according to German federal guidance wallets from private providers can be added from 2028. CodeB Wallet is not certified today, and we do not claim it is.

“The wallet replaces my ID card” – no, physical documents stay valid. “From 2027 everything only works with the wallet” – no, it is introduced step by step, using it is voluntary and the existing ways remain. “Without a smartphone I am excluded” – no, all existing ways stay open. Source: German federal guidance for municipalities, 19 Oct 2026.

With the card access number (CAN) printed on the front, CodeB Wallet reads the travel-document part of the chip – name, date of birth, nationality, document number, expiry date and the photo – and checks that the card is genuine (signature of the issuing state and chip authentication). With it you can also open a free CodeB account and receive a test PID and a Photo ID.

No. The online ID function with your six-digit PIN may only be used by services that hold a state authorisation certificate (Berechtigungszertifikat) and run an eID server; CodeB Wallet reads only the travel-document part with the CAN and never asks for your eID PIN. For the online ID function use the AusweisApp; Germany’s official digital ID in an EU wallet is set up from it in the state wallet d-you. The fingerprints on the chip can only be read by authorities – CodeB Wallet never reads them.

No. The signature function of the German ID card can only be used with a special state signature-terminal certificate, so CodeB Wallet cannot sign with it. To sign PDFs in CodeB Wallet, use a signature card such as the D-Trust Card 5, the German health professional card (HBA) or the Maltese eID, or the CodeB signing service.

Yes – passwordless sign-in with a passkey, on Android 14 or newer: switch CodeB Wallet on as a passkey provider (menu → Pseudonyms → Turn on in Android settings) and choose CodeB Wallet when a website offers a passkey. You get a separate pseudonym for every website – without your name – confirmed with your fingerprint, face or screen lock. In Chrome, set Settings → Autofill services to “Autofill using another service” so that Chrome passes passkeys to CodeB Wallet.

A card in CodeB Wallet that lets you sign in to phone.codeb.io without a password. Add it on https://phone.codeb.io/member-card.html (“My wallet credentials”) after signing in; then choose “Sign in with my CodeB sign-in card”. It holds only a random sign-in number for your account – it shows that you hold the card, not who you are. You can revoke it on the same page, for example after losing your phone.

Showing and checking IDs works without an account. For the CodeB signing service and the test PID and Photo ID you need a free account on phone.codeb.io, which you create in the app: Settings → Create a free CodeB account. You hold your passport or ID card to the phone, confirm your e-mail address with a code, and the document-checked guest account is ready – with 5 signatures of your own documents a day. Or tap myeuid.app/open/account on your phone – it opens the account screen directly.

Yes. Sign in to your CodeB account in the app (Settings → CodeB account), open Signing requests and choose your PDFs, the signature level and the people who sign, in order. Each person gets an e-mail and signs with their own EU Wallet or signature card; you follow every step and save the signed PDF in the app.

Sign in to your CodeB account in the app (Settings → CodeB account) and tap “Check a signed PDF”. Choose any PDF on your phone: for each signature you see who signed, when, in which format (for example PAdES) and whether the document was changed afterwards. phone.codeb.io checks the PDF and keeps nothing. The certificates are not checked against the EU trusted lists; “qualified” is shown as the certificate states it.

Yes. On phone.codeb.io/sign-request someone uploads the PDFs and chooses who signs. You scan the QR code with the QR scanner in CodeB Wallet – or tap “Open in CodeB Wallet” – check who asks and every document, and sign with your signature card or the CodeB signing service. Invited people get an e-mail when it is their turn, and at the end everyone gets a link to the signed PDF. The manual chapter “Sign a document from a website (QR code)” shows every step.

CodeB Wallet is developed by Aloaha Limited, a company based in Malta. Aloaha has been active in PKI, PDF development and digital signatures since 2003 and makes the CodeB product family, including CodeB eForms Server and ZUGFeRD Pro.

The app is available in English, German, French, Maltese, Spanish and Finnish; this website in English, German, French and Maltese. The app uses your phone’s language automatically – English for all other languages – and you can choose a different language under Settings → Language.

eIDAS 2.0 (Regulation (EU) 2024/1183) introduces European Digital Identity Wallets: apps in which people can store identity data and other attestations and share them securely with public and private services. The technical rules are described in the EU Architecture and Reference Framework (ARF).

PID means Person Identification Data: your core identity – name, date of birth, nationality and a few more details. It is issued by your country or by a body it authorises, and it is the digital counterpart of your ID card. A PID answers one question: who are you? The PID you get with the free CodeB account is a test PID, not an official one.

An Electronic Attestation of Attributes (EAA) proves something else about you: a degree, a professional licence, a membership, your employment, an age. A qualified one (QEAA) comes from a qualified trust service provider; a PuB-EAA comes from a public body that runs the official register for that information. QEAA and PuB-EAA have the same legal effect as the paper certificate; any other EAA may not be refused just because it is electronic. An attestation answers: what can you prove about yourself?

It decides who may issue a credential (the state or its delegate for the PID; trust service providers, public bodies or anyone for attestations), how much a website or shop can rely on it, and how organisations design onboarding and checks. CodeB Wallet shows the issuer of every document and checks its signature and trust status. The attestations from the CodeB issuer – Photo ID, membership and access cards – are ordinary, non-qualified EAAs.

Person Identification Data (PID, test credentials) including the German PID, a mobile driving licence in SD-JWT VC and ISO/IEC 18013-5 mdoc format, and the CodeB membership card – all from the CodeB issuer (phone.codeb.io). You add them from the issuer list in the app or by scanning an issuer’s QR code. A Photo ID from your passport or ID card – you get it with a free CodeB account.

eMRTD stands for electronic Machine Readable Travel Document: a passport or ID card with a contactless chip, built to the international standard ICAO Doc 9303. You recognise an ePassport by the chip symbol on its cover. The chip stores the same details as the printed data page – name, date of birth, nationality, document number, expiry date – plus your photo, digitally signed by the issuing country so that any change would be noticed. The chip only opens with a key taken from the document itself – the card access number (CAN) or the machine-readable zone (MRZ), the two or three lines of characters at the bottom of the data page – so it cannot be read without access to the document.

Electronic passports and ID cards that follow ICAO Doc 9303 – in practice most passports issued in recent years and the chip ID cards of the EU and EEA countries. According to ICAO, more than one billion ePassports are in circulation, issued by over 140 states and organisations. 29 EEA countries now issue ID cards with an ICAO-compliant chip; we estimate that well over 200 million of them are in use in Europe. Older cards without a chip cannot be read. CodeB Wallet checks the issuing country’s signature using the country certificates the states publish (CSCA master list). The country certificate list we use (BSI master list, October 2026) covers 115 countries plus the EU and the UN, including all EU member states – see remote ID verification.

Open the photo page flat, hold the phone a little further away so that both lines of letters and numbers fit across the whole frame, and keep it still. In poor light, switch on the camera light on the scan screen. Avoid reflections from the laminate by tilting the passport slightly. If scanning still does not work, you can type the document number, date of birth and expiry date by hand.

Yes – at the CodeB PID Provider. When you add your Personal ID (PID), its sign-in page can ask your phone to read your ID card or passport. The provider’s server reads and checks the chip itself over an end-to-end encrypted, authenticated channel; your phone only passes the messages on, cannot read or change them and keeps no copy, and your details are filled in from the chip. It works right after installing the app, without any other document in your wallet.

No. When the CodeB PID Provider reads your ID card or passport, the chip and the server build their own end-to-end encrypted and authenticated connection (PACE and Chip Authentication with Secure Messaging, ICAO Doc 9303). Your phone and the internet only carry these protected messages: neither your phone nor a man in the middle can read them or change them without the chip or the server noticing – at most the reading can be interrupted. In addition, the server checks the issuing country’s digital signature over the data (Passive Authentication), so altered data would be rejected.

A Photo ID is a standard EU wallet document (ISO/IEC TS 23220-4) with your name, date of birth and photo, issued from a passport or ID card that has been checked. A Digital Travel Credential (ICAO DTC type 1) is a copy of your passport chip’s data that a verifier can check against the issuing country’s signature. CodeB Wallet carries the DTC inside the Photo ID – only if you agree – and not as a separate document.

Yes. CodeB Wallet signs PDFs with an advanced electronic signature (AdES) in PAdES format, with a trusted timestamp, via the CodeB signing service. You confirm every signature, and the PDF stays on your phone. CodeB Wallet uses Aloaha’s own PDF signing technology; Aloaha has been active in PDF development and digital signatures since 2003. Signatures from the signing service are not qualified electronic signatures (QES). You can also sign with your own signature card, such as the Maltese eID.

CodeB Wallet signs PDFs over NFC with the Maltese eID and Maltese residence cards, the D-Trust Card 5, the German health professional card (HBA) and the German electronic health card (eGK). Newly added – feedback welcome: the ID cards of Finland, Portugal (Cartão de Cidadão issued from June 2024) and Spain (DNIe 3.0 and 4.0). Enter the 6-digit card access number (CAN) printed on the card, hold the card to your phone and enter your signature PIN. The card itself makes the signature – the key never leaves the card – and CodeB Wallet adds it to the PDF as a PAdES signature with trusted timestamp. The app shows whether the card’s certificate states a qualified electronic signature; CodeB Wallet itself is not certified.

Yes. CodeB Wallet works as an ISO/IEC 18013-5 reader. With “Verify” you choose what you need – for example only “over 18” – and scan the QR code shown in the other person’s wallet. After they agree, the data arrives over Bluetooth. CodeB Wallet checks the issuer’s signature against your list of trusted issuer certificates (CodeB’s own certificate is built in, and you can import more), that the data is unchanged and belongs to the presenting phone, the validity period and the revocation status. You get a clear verdict – trusted, look closer or do not accept – and the data is deleted as soon as you close the result. Wallet and verifier come in one app – many wallet solutions need a separate app for checking IDs.

Yes. In person, you start with a QR code or an NFC tap and the data is sent over Bluetooth Low Energy according to ISO/IEC 18013-5 – no internet connection needed. Both Bluetooth roles are supported for broad reader compatibility. Online, websites and apps request data via OpenID4VP, and you confirm every request with your PIN or biometrics.

Selective disclosure lets you share only the information a service needs. For example, you can confirm that you are over 18 without revealing your date of birth. The SD-JWT VC and ISO mdoc formats support this.

Your documents and your history are stored only on your phone. Cryptographic keys are kept in the phone’s secure hardware, the wallet is protected by PIN and optionally biometrics, and nothing is shared without your confirmation. The app has no ads, no tracking and no analytics.

CodeB Wallet is built for the EU Digital Identity framework, which applies in all EU member states. Our first focus is Malta, Germany and Austria. Which documents you can use depends on the issuers available to you.

No. CodeB Wallet is not an official government wallet and it has not been certified. It is developed by Aloaha Limited and designed to comply with eIDAS 2.0 and the EU Architecture and Reference Framework (ARF). We will only call it certified once a certification has actually been completed.

In Settings you choose which issuers the wallet uses – currently the EU reference issuers and the CodeB issuer. Issuers are checked against EU trusted lists (ETSI).

On the old phone go to Settings → Back up to a file and choose a password. On the new phone install CodeB Wallet, set your PIN and tap “New phone? Restore from a backup”. The history comes back and each issuer issues your documents again – the file never contains the data inside your documents or their keys. One-time code accounts come along too. Signed in to your CodeB account, you can also keep an encrypted copy of the backup on your account (Settings → CodeB account → Save a copy now) – only your backup password opens it.

Yes – CodeB Wallet has a built-in authenticator app for two-factor authentication (2FA). Open the menu → One-time codes and scan the QR code the website shows when you turn on two-step sign-in. CodeB Wallet creates the six-digit codes (TOTP, RFC 6238) on your phone, also offline. The keys stay on your phone, apart from your documents, and are never shared with a website or verifier.

Yes. In One-time codes, tap the three dots next to an account → “Move to a group”, or choose a group when you enter a key. Groups such as Work or Family appear A–Z below your pinned accounts and open or close with a tap; the pencil next to a group renames or removes it, and the search looks through all groups. Groups come along when you move your codes to a new phone.

Either include them in “Back up to a file” and restore that file on the new phone, or open One-time codes → Transfer all accounts and scan the QR codes with the new phone – in CodeB Wallet or another authenticator app. Codes from another authenticator app come in the same way: scan its transfer QR codes in CodeB Wallet.

Since version 2026.10.32 the button opens CodeB Wallet’s page in the Play Store when Google Play cannot finish the update itself (for example right after a phone update). With older versions: open the Play Store, search for CodeB Wallet and tap Update.

Open Settings → Delete wallet and confirm with your wallet PIN. All documents, the history, your settings and the keys are removed from your phone. Accounts with issuers or signing services are separate – for services of Aloaha Limited write to info@aloaha.com.

CodeB Wallet for Android is available on Google Play by invitation – write to info@aloaha.com.

Yes, with a CodeB Access card from your organisation. Open the card, tap “Use at reader” and hold your phone to the reader. The reader checks the card offline: the issuer’s signature, the validity, your sites and groups, and a fresh signature from a key that stays in your phone’s secure hardware.

No. CodeB Wallet answers access readers only for the card you chose, for at most five minutes and only while your phone is unlocked. At all other times its access function is switched off, so payment apps, other wallets and your other cards work exactly as before.

Readers set up for CodeB Access (ISO/IEC 18013-5 data, checked offline) and readers of the open, royalty-free PKOC standard (Public Key Open Credential, PSIA). For PKOC your organisation enrols the card ID shown on your access card.

Yes, with a read/write PKI card in CodeB Wallet and a PC with a contactless (NFC) reader: Windows puts your sign-in certificate on the card itself, and you sign in with the card PIN. A read-only PKI card carries your organisation’s signing certificate for signing on the PC. Every use needs the card PIN, and the read/write card’s key never leaves your phone’s secure hardware.

Yes. Open the PKI card in CodeB Wallet and tap Change card PIN: enter the current PIN and the new one twice, then confirm with your fingerprint, face or screen lock. A wrong current PIN counts as a wrong try, exactly as at the PC. If a read-only card’s PIN is blocked, tap Unblock with PUK. You can also change the PIN from Windows as with any smart card. The PIN never leaves your phone.

After Use at PC, a light on the card screen shows the connection: grey and pulsing while the phone waits, green while it is connected to the reader (it flickers when data goes through), red if the connection drops – then hold the phone to the reader again.

Yes, on a read/write PKI card: open the card, tap Remove next to the certificate and enter the card PIN. The certificate and its key are deleted from the card for good.

On Xiaomi phones (MIUI) open Settings → Connection & sharing → NFC and set Secure element position to HCE Wallet. With “SIM wallet” or “eSE wallet” the phone passes the reader’s commands to the SIM or its secure chip instead of to CodeB Wallet, and Windows reports a card that needs a driver. Then open the card in CodeB Wallet, tap Use at PC and hold the back of the phone (near the camera) on the reader.

Yes. Organisations can offer CodeB Wallet as their own wallet app – with their own name, logo, colours and store listing, and with their issuers, documents and services preconfigured. The technology, updates and maintenance come from Aloaha Limited in Malta. Write to info@aloaha.com with the subject “CodeB Wallet white label”.

Yes, at phone.codeb.io: choose Sign in with eID card, scan the QR code with your phone, enter the card access number (CAN), hold the card to the phone and enter the card’s authentication PIN. CodeB Wallet lets the card sign a one-time challenge; the PIN and the card’s key never leave the card, and your browser is signed in. Only the Maltese eID card is supported for now.

Your documents are protected by your phone’s screen lock and the app’s own PIN. If you were signed in to your CodeB account in the app, this phone’s wallet is linked to your account: open your account page on phone.codeb.io and revoke it. phone.codeb.io then no longer trusts that wallet and withdraws the documents it issued to it.

Only if the issuer allows it for that card. Then a reader can write to the card while you hold the phone to it with the card open. What a reader writes stays on your phone only; the card shows when it was written, the last writes, and Restore issued content. Content written by a reader is not confirmed by the issuer.

Yes. With an NFC memory card from your organisation, CodeB Wallet makes your Android phone answer as a standard NFC tag (NFC Forum Type 4, NDEF) – read-only, or writable so a reader can store new content on your phone. Details: read-only NFC tag and writable NFC tag.

Yes. The person holds their passport or ID card to the phone; phone.codeb.io reads the chip itself through an end-to-end encrypted channel and checks the issuing country’s signature and that the chip is no copy. It proves a genuine document was present – face matching is planned. See remote ID verification.