Every feature of CodeB Wallet with a full description. Each card links to the page or manual chapter with the details.
Security is built in from the first line, not added later: keys in your phone’s secure hardware, your confirmation for every share and every signature, self-protection while the app runs, end-to-end protected reading of passport and ID card chips – and mostly our own code with few third-party libraries.
Secure hardware · own codePrivacy comes first in everything we build. Your documents and your history stay on your phone. Before anything is shared you see exactly what is asked for and decide. An age check shares only your age, the signing service receives only a fingerprint (hash) of your PDF, and every website gets its own pseudonym. Our servers learn only what they need for the job.
Data minimisation · your choiceTwo people must not be able to combine their genuine cards into one person who does not exist. CodeB Wallet ties your cards together, so a service that asks for several of them at once sees that they belong to you – a weakness researchers named credential pooling (CRESTA). Built with standard EUDI formats, privacy kept.
Credential pooling · CRESTAAdd your Person Identification Data (PID, test credentials) – including the German PID – from the CodeB issuer (phone.codeb.io). Issuance uses OpenID4VCI; available as SD-JWT VC and ISO mdoc.
PID · OpenID4VCISign in to websites and apps with a passkey from CodeB Wallet: a new pseudonym for every website, kept in your phone’s secure hardware, confirmed with your fingerprint or screen lock. Your pseudonyms share no identifier between websites.
Passkeys · WebAuthn · ARF Topic 11The app notices when it was changed or is being inspected while it runs, and then refuses to use your keys and documents. Our own code – nothing is sent anywhere.
Runtime self-protectionKeep a mobile driving licence (mDL) on your phone – as SD-JWT VC for online use and as ISO/IEC 18013-5 mdoc for showing it in person. From the CodeB issuer as a test credential.
mDL · ISO/IEC 18013-5Add the CodeB membership card from the CodeB issuer and show it like any other document in your wallet.
AttestationChoose the issuer directly in the app, or scan the QR code an issuer gives you – the wallet then starts the issuance for you. Adding a card again replaces the older copy, so your wallet does not fill up with duplicates.
Issuer list · QR codeStart with a QR code or an NFC tap; the data then goes phone-to-phone over Bluetooth Low Energy. Both BLE roles are supported for broad reader compatibility, and it works offline.
ISO/IEC 18013-5 · NFC · BLESelective disclosure: confirm “over 18” without revealing your date of birth, or share just the details a service really needs.
Selective disclosureShow only that you are over 18 – online on websites and apps (OpenID4VP) and in person (ISO/IEC 18013-5). CodeB Wallet can also check someone’s age as a reader, and websites can use the online age check.
Over 18 · selective disclosureWebsites and apps request data via OpenID4VP. You see every request – who is asking and for what – and confirm with your PIN or biometrics.
OpenID4VPCodeB Wallet works as an ISO/IEC 18013-5 reader with a clear verdict – trusted, look closer or do not accept – including a revocation status check. Nothing is stored.
ISO/IEC 18013-5 readerNo QR code needed: hold the two phones back to back. The checking phone reads the other phone’s ID over NFC and Bluetooth – handy at a counter or between two CodeB Wallets.
NFC · ISO/IEC 18013-5Your organisation can give you an access card in CodeB Wallet. Choose it, tap “Use at reader” and hold your phone to a door or PC reader: the phone answers with the card’s signed data and a fresh signature from a key that never leaves the phone’s secure hardware. Only the card you chose answers, for up to five minutes, and only while your phone is unlocked – it never interferes with your other cards or payment apps. Works offline. Also works with door readers of the open PKOC standard (PSIA): the reader gets your phone’s public key, and the matching private key never leaves the phone’s secure hardware.
NFC · access card · ISO/IEC 18013-5 · PKOCYour organisation can issue PKI cards to CodeB Wallet, and your phone then acts as a contactless PKI smart card at a Windows PC with an NFC reader. A read/write PKI card is filled by Windows itself with your sign-in certificate; a read-only PKI card carries your organisation’s signing certificate, so programs on the PC can sign with it. Every use needs the card PIN. The read/write card’s key is made in your phone’s secure hardware and never leaves it; for the read-only card, your organisation’s server puts its signing key into your phone’s secure hardware. Only the card you chose answers, and only while your phone is unlocked. Several PKI cards can be held side by side; each shows the name from its certificate. A light on the card screen shows when the phone is connected to the PC’s reader. In the app you can change the card PIN, unblock a read-only card with its PUK, and remove certificates from a read/write card.
NFC · PKI card · smart card sign-inAn NFC memory card from your organisation turns your phone into a standard NFC tag: a link, a text or a contact card that any phone or NFC reader can read – read-only, or writable so a check-in desk or smart-home reader can store new content on your phone. Works with Home Assistant.
NFC · NDEF · Type 4 tagHold a chip ID card or an ePassport to your phone: CodeB Wallet reads the data on the chip – name, date of birth, nationality, document number, expiry date and the photo – and checks that the issuing country signed it and that the chip is not a copy. You open the chip with the card access number (CAN) or by scanning the machine-readable zone with the camera. Everything happens on your phone. If you save it, it appears as its own card on the home screen, encrypted on your phone. Scanning works for the two long lines of a passport as well as the three lines of an ID card; a switch turns on the camera light in poor light.
eMRTD · ICAO Doc 9303Organisations check a person’s passport or ID card remotely: the person holds the document to the phone, and the server reads the chip itself and checks the issuing country’s signature and that the chip is no copy – instead of photos or video calls of the document.
eMRTD · KYCWhen you add your Personal ID (PID) from the CodeB PID Provider, you can use the chip of your ID card or passport instead of typing your details: the provider’s server reads and checks the chip itself through your phone and fills in your details from it. This works right after installing the app – no other document needed. Your phone shows the server that it runs the genuine CodeB Wallet (Android Key Attestation and Play Integrity).
Onboarding · eMRTDCreate your CodeB account right in the app with your passport or ID card: phone.codeb.io checks that the chip is genuine, you confirm your e-mail address with a code, and you can sign 5 of your own PDFs a day and add the test PID and Photo ID. A document-checked guest account – no spam, no paperwork. The app links this phone’s wallet to your account – if the phone is lost, revoke it on your account page.
Account · passport or ID cardA Photo ID (ISO/IEC TS 23220-4, eu.europa.ec.eudi.photoid.1) issued from your checked passport or ID card. If you agree, it also carries the chip data as a Digital Travel Credential (ICAO DTC type 1), so a verifier can check the issuing country’s signature itself.
Photo ID · ICAO DTCManage the list of issuer certificates you trust when verifying. CodeB’s own issuer certificate is built in; you can import further certificates.
Trust listSign PDFs with a PAdES signature and trusted timestamp: advanced (AdES) via the CodeB signing service, or qualified (QES) with your own signature card holding a qualified certificate. Place your visible signature where you want it – drawn, the image from your ID document or your name. The PDF stays on your phone.
PAdES B-T · AdESPhotograph a paper document, get a clean PDF and sign it on the spot – with your signature card or the CodeB signing service, always with a trusted time stamp.
Scanner · PAdES · Time stampHold your signature card to the phone – the Maltese eID or a Maltese residence card, a D-Trust Card 5, a German health professional card (HBA) or a German electronic health card (eGK) – and sign PDFs with the key on the card: no browser, no account. You enter the card access number (CAN) and your signature PIN; the key never leaves the card. The app shows whether the card’s certificate states a qualified electronic signature.
Signature card · NFC · PAdESSign in to phone.codeb.io with the Maltese eID card: scan the QR code on the sign-in page, hold the card to your phone and enter the card’s authentication PIN. The card signs a one-time challenge; your PIN and the card’s key never leave the card, and the sign-in completes in your browser.
eID card · NFC · sign-inShare a PDF to CodeB Wallet, place a signature box for every signer, pick them from your contacts and send. Follow every step, remind, invite more – and save the signed PDF.
Signing requests · AdES · QESAn AI agent asks before it pays, orders or books, and it prepares signing requests. You see exactly what it wants and approve by code and screen lock; it can never sign.
SigningPhone in CodeB Wallet: dial or pick a contact, and the person you call sees your verified name while their phone rings. No phone numbers go to our server.
Verified calls · privacy firstYour bank asks, you see payee and amount first and confirm with fingerprint, face or screen lock – bound to exactly what you saw.
SCA · TS12A built-in authenticator: scan a website’s QR code and get six-digit sign-in codes (TOTP) on your phone, even offline. Pin, sort into groups such as Work or Family, search, and move all codes to a new phone with a few QR codes.
TOTP · RFC 6238A history of everything you added, shared and signed – with details – kept only on your phone.
On deviceEach document shows the recent times you shared it – who received it, when, and exactly which details. One tap opens the entry, where you can ask for deletion or report a verifier. Taken from the history on your phone; nothing is sent anywhere.
Transparency · GDPRThe wallet checks the status of your documents automatically and can renew them before they expire, where the issuer supports it.
Status · renewalCodeB Wallet tells you on your phone when a document is about to expire or could not be renewed automatically – one tap opens it to renew. The reminder is created on your phone; nothing is sent anywhere.
Local · no trackingBuilt with the European Accessibility Act in mind: works with the TalkBack screen reader, with very large text and with animations switched off – results, checks and steps are read out clearly, and card colours stay readable.
AccessibilityBuilt-in “Learn more” guides explain every function in plain words, and an in-app changelog shows what is new. Swipe through your cards on the home screen.
Help