CodeB Walletby Aloaha Limited
Join the Android beta
EN DE FR MT

Key facts, standards and security

Everything about CodeB Wallet in short – the facts, the standards it follows and how it protects your data.

In short

  • What: CodeB Wallet is an Android wallet app for the European Digital Identity (EUDI) framework – eIDAS 2.0, Regulation (EU) 2024/1183.
  • Who: developed by Aloaha Limited, Malta – active in PKI, PDF development and digital signatures since 2003, maker of the CodeB product family.
  • Brand: CodeB is a brand of Aloaha Limited, Malta. CodeB Wallet is developed and provided by Aloaha Limited.
  • Made in Malta: designed and developed in Malta by Aloaha Limited.
  • Small download: about 17 MB – the CodeB Wallet universal APK 2026.10.77 is 17.3 MB; the public demo APK of the EU reference wallet (version 2026.09.42) is 363 MB (as of 19.10.2026).
  • Documents: Person Identification Data (PID, test credentials) including the German PID, mobile driving licence (test credential; SD-JWT VC and ISO/IEC 18013-5 mdoc) and the CodeB membership card – issued by the CodeB issuer (phone.codeb.io) via OpenID4VCI. Also: a Photo ID from your passport or ID card, optionally with the Digital Travel Credential (ICAO DTC type 1).
  • ID cards and passports: reads the chip of electronic passports and ID cards (eMRTD, ICAO Doc 9303) and checks it against the issuing country’s certificates. By our estimate that covers well over a billion documents worldwide: ICAO counts more than one billion ePassports from over 140 issuing states and organisations, and chip ID cards in Europe add, by our estimate, well over 200 million more. The chip can also be used to sign up for your PID at the CodeB PID Provider – right after installing the app. When the CodeB PID Provider reads the chip, the chip and the server set up their own end-to-end encrypted and authenticated channel (PACE, Chip Authentication, Secure Messaging): your phone only forwards messages that nobody in between can read or change unnoticed.
  • Sharing: online via OpenID4VP; in person via QR code or NFC tap, with the data sent over Bluetooth Low Energy (ISO/IEC 18013-5) – works offline. Selective disclosure, for example only “over 18”.
  • Wallet and verifier in one: the same app that holds your ID also checks someone else’s ID or age as an ISO/IEC 18013-5 reader, including a revocation check – no separate verifier app needed.
  • PDF signing: advanced electronic signatures (AdES) in PAdES format with trusted timestamp via the CodeB signing service, using Aloaha’s own PDF signing technology. The document stays on your phone. Signatures from the signing service are not qualified electronic signatures (QES). Also: signing with your own signature card over NFC – the Maltese eID or residence card, D-Trust Card 5, a German health professional card (HBA) or a German electronic health card (eGK). The key stays on the card, and the app shows whether the card’s certificate states a qualified electronic signature. CodeB Wallet itself is not certified.
  • Privacy: documents and history stay on your phone; keys in secure hardware; no ads, no tracking, no analytics.
  • Languages: this website is available in English, German, French and Maltese; the app in English, German, French, Maltese, Spanish and Finnish. The app follows your phone’s language, and you can also choose it under Settings → Language.
  • Not an official government wallet and not certified – designed to comply with eIDAS 2.0 and the EUDI Wallet Architecture and Reference Framework (ARF).

Standards

Built on open European and international standards

CodeB Wallet follows the EU Architecture and Reference Framework (ARF) and is designed to comply with eIDAS 2.0. It is not certified and it is not an official government wallet.

Standards profile

ARF
  • Architecture and Reference Framework (ARF)EU framework
  • eIDAS 2.0 – Regulation (EU) 2024/1183Regulation
  • OpenID for Verifiable Credential Issuance (OpenID4VCI)Issuance
  • OpenID for Verifiable Presentations (OpenID4VP)Online
  • ISO/IEC 18013-5 – QR code, NFC, Bluetooth Low Energy (both roles)In person
  • SD-JWT VC (Selective Disclosure JWT Verifiable Credentials)Format
  • ISO mdoc (mobile document)Format
  • PAdES baseline B-T (ETSI EN 319 142) – PDF signatures with trusted timestampSigning
  • ETSI trusted listsIssuer trust
  • ICAO Doc 9303 – electronic passports and ID cards (eMRTD): PACE, BAC, Chip and Active Authentication, Passive AuthenticationChip reading
  • ISO/IEC TS 23220-4 Photo ID with ICAO Digital Travel Credential (DTC type 1)Photo ID
  • ETSI TS 119 461 v2.1.1 – identity proofing: reading for the PID Provider is designed to follow it (extended LoIP); not certifiedIdentity proofing
  • Signature cards over NFC – ISO/IEC 7816-4/-8, PACE (BSI TR-03110), CAdES/PAdES (ETSI EN 319 122 / 319 142), qcStatements (ETSI EN 319 412-5)NFC
  • OpenID4VC High Assurance Interoperability Profile (HAIP) – followedIssuance and online presentation
  • OAuth 2.0 DPoP (RFC 9449), Pushed Authorization Requests (RFC 9126), PKCE (RFC 7636)Issuance security
  • OAuth 2.0 attestation-based client authentication – wallet instance attestationWallet provider
  • Android Key AttestationGenuine app on a verified phone
  • IETF Token Status List (JWT and CWT), W3C Bitstring Status ListRevocation
  • ISO/IEC 18013-7 – mdoc online presentationOnline
  • W3C Digital Credentials API – through Android’s Credential Manager, Android 14+Online
  • OpenID Federation 1.0Trust discovery
  • ETSI TS 119 475 – registration certificatesRelying-party registration
  • ETSI TS 119 411-8 – access certificatesRelying parties
  • EU PID RulebookPID
  • Cloud Signature Consortium API v2Remote signing
  • W3C WebAuthn – passkeys and pseudonymsPseudonyms

Security & privacy

Privacy by design – your data stays with you

Security is Aloaha’s core business: we have worked on PKI, PDF and digital signatures since 2003. What stays on your phone: your documents, their keys and showing them in person. What goes through phone.codeb.io: reading a passport or ID card chip for an account, issuing documents, and signing with the CodeB signing service – which receives only a fingerprint (hash) of your PDF.

Keys in secure hardware

Cryptographic keys are kept in your phone’s secure hardware.

Protects itself while it runs

CodeB Wallet checks itself every time you open it: if it was changed, or another program is inspecting it (a debugger or a hooking tool), it stops and does not use your keys or documents until that is gone. These checks are our own code, without third-party libraries, and nothing about them is sent anywhere. For the same reason CodeB Wallet does not run on rooted phones, and it needs a phone with the Google Play Store.

Proves it is genuine with your phone’s security chip

When you add a card from the CodeB issuer, CodeB Wallet proves to our own wallet provider that it is the genuine app on a phone with a locked, verified system: the phone’s security chip certifies a fresh key for every request (Android Key Attestation). Google’s Play Integrity check is used as well, but issuing can keep working when Google’s service is unavailable. Only key certificates are sent – never your documents.

PIN and biometrics

The wallet is locked with a PIN and, if you wish, biometrics. Every share and every signature needs your confirmation.

End-to-end protected chip reading

When the PID Provider’s server reads your ID card or passport, the chip and the server set up their own encrypted, authenticated channel (PACE, Chip Authentication, Secure Messaging). Your phone only forwards the messages: neither the phone nor anyone in between can read them or change them unnoticed – at most the reading can be interrupted. The server also checks the issuing country’s signature on the data (Passive Authentication).

Your signature card stays in charge

When you sign with your own card, the key never leaves the card and every signature needs your PIN.

Trusted issuers

Issuer trust is checked against EU trusted lists (ETSI) and your list of trusted issuer certificates.

Status checks

Document status is checked automatically, so revoked documents are recognised. Where the issuer supports it, documents can be renewed automatically before they expire.

On your device

Your documents and your history are stored on your phone, not in a CodeB cloud.

No ads, no tracking

The app shows no advertising and contains no tracking and no analytics.

Our servers protect themselves too

Every server endpoint watches itself while it runs: anomaly detection, rate limits and refusal when in doubt.

Files instead of a database

Server state lives in encrypted, access-restricted files per customer, with a full restore from a single backup – a design choice for simple operation and a small attack surface, not a certification.

No tracking on our servers either

No third-party analytics and no tracking on the server side.

This website does not track you

No analytics, no cookies, no external requests. Fonts and images are served from this site itself.