Keys in secure hardware
Cryptographic keys are kept in your phone’s secure hardware.
Key facts, standards and security
Everything about CodeB Wallet in short – the facts, the standards it follows and how it protects your data.
Certification
Not yet. CodeB Wallet is not an official government wallet and it has not been certified. It is built by Aloaha Limited to the EUDI Wallet Architecture and Reference Framework (ARF 3.0) and works with its protocols and formats: OpenID4VCI, OpenID4VP, SD-JWT VC, mdoc and ISO 18013-5. Certification is ahead of us. As of November 2026, the EU certification scheme for these wallets is still a draft, and no wallet has completed it yet. We will only call CodeB Wallet certified once a certification has actually been completed.
Tested against the standards
What does this mean? The CodeB issuer is the service that puts cards into your wallet – your digital ID, membership and sign-in cards. The verifier is the service that checks those cards when you sign in with them. So that issuers, wallets and services across Europe understand each other, they all have to follow the same rulebook – like a plug and a socket: if one side is built differently, nothing fits.
The official test lab checks exactly that. It plays the part of a wallet and runs more than 250 tests against our live service – whether every step follows the rulebook, and whether forged, tampered or replayed requests are refused. In November 2026 our issuer passed all four test plans for issuing cards, and our verifier passed both test plans for checking them, with no failed test.
We are proud of this. It shows what more than 20 years of development in PDF, smart cards and digital identity – and always building strictly to the standards – are worth: when the rulebook is followed from the first line, the tests confirm it.
For you this means: your cards speak the same language as every wallet and service that follows the European rulebook, instead of being locked to one app, and their protection has been tested, not just promised. Which cards a wallet or service accepts is still decided by certificates and trust lists.
Technically: OpenID4VCI 1.0 and OpenID4VP 1.0 with the HAIP 1.0 profile – the standards on which the EUDI wallets are built. The test plans are the same independent test suites that are used for the official certification of these protocols. These are tests of our servers on phone.codeb.io, not a certification of CodeB Wallet itself. Each result can be viewed read-only via its link.
| Test plan | Format | Result |
|---|---|---|
| Issuer: OpenID4VCI 1.0 + HAIP 1.0, wallet-initiated | SD-JWT VC | Passed · 63 tests, no failure · view results |
| Issuer: OpenID4VCI 1.0 + HAIP 1.0, wallet-initiated | mdoc | Passed · 63 tests, no failure · view results |
| Issuer: OpenID4VCI 1.0 + HAIP 1.0, issuer-initiated (credential offer) | SD-JWT VC | Passed · 63 tests, no failure · view results |
| Issuer: OpenID4VCI 1.0 + HAIP 1.0, issuer-initiated (credential offer) | mdoc | Passed · 63 tests, no failure · view results |
| Verifier: OpenID4VP 1.0 + HAIP 1.0, direct_post.jwt | SD-JWT VC | Passed · 14 tests, no failure · view results |
| Verifier: OpenID4VP 1.0 + HAIP 1.0, direct_post.jwt | mdoc | Passed · 7 tests, no failure · view results |
In short
- What: CodeB Wallet is an Android wallet app for the European Digital Identity (EUDI) framework – eIDAS 2.0, Regulation (EU) 2024/1183.
- Who: developed by Aloaha Limited, Malta – active in PKI, PDF development and digital signatures since 2003, maker of the CodeB product family.
- Brand: CodeB is a brand of Aloaha Limited, Malta. CodeB Wallet is developed and provided by Aloaha Limited.
- Made in Malta: designed and developed in Malta by Aloaha Limited.
- Small download: about 17 MB – the CodeB Wallet universal APK 2026.11.10 is 17.3 MB; the public demo APK of the EU reference wallet (version 2026.09.42) is 363 MB (as of 19.10.2026). Small because most of it is our own code, built on more than 20 years of PDF, smart card and identity provider work – few third-party libraries.
- Documents: Person Identification Data (PID, test credentials) including the German PID, mobile driving licence (test credential; SD-JWT VC and ISO/IEC 18013-5 mdoc) and the CodeB membership card – issued by the CodeB issuer (phone.codeb.io) via OpenID4VCI. Also: a Photo ID from your passport or ID card, optionally with the Digital Travel Credential (ICAO DTC type 1).
- ID cards and passports: reads the chip of electronic passports and ID cards (eMRTD, ICAO Doc 9303) and checks it against the issuing country’s certificates. By our estimate that covers well over a billion documents worldwide: ICAO counts more than one billion ePassports from over 140 issuing states and organisations, and chip ID cards in Europe add, by our estimate, well over 200 million more. The chip can also be used to sign up for your PID at the CodeB PID Provider – right after installing the app. When the CodeB PID Provider reads the chip, the chip and the server set up their own end-to-end encrypted and authenticated channel (PACE, Chip Authentication, Secure Messaging): your phone only forwards messages that nobody in between can read or change unnoticed.
- Sharing: online via OpenID4VP; in person via QR code or NFC tap, with the data sent over Bluetooth Low Energy (ISO/IEC 18013-5) – works offline. Selective disclosure, for example only “over 18”.
- Wallet and verifier in one: the same app that holds your ID also checks someone else’s ID or age as an ISO/IEC 18013-5 reader, including a revocation check – no separate verifier app needed.
- PDF signing: advanced electronic signatures (AdES) in PAdES format with trusted timestamp via the CodeB signing service, using Aloaha’s own PDF signing technology. The document stays on your phone. Signatures from the signing service are not qualified electronic signatures (QES). Also: signing with your own signature card over NFC – the Maltese eID or residence card, D-Trust Card 5, a German health professional card (HBA) or a German electronic health card (eGK). The key stays on the card, and the app shows whether the card’s certificate states a qualified electronic signature. CodeB Wallet itself is not certified.
- Privacy: documents and history stay on your phone; keys in secure hardware; no ads, no tracking, no analytics.
- Languages: this website is available in English, German, French and Maltese; the app in English, German, French, Maltese, Spanish and Finnish. The app follows your phone’s language, and you can also choose it under Settings → Language.
- Tested against the standards: in November 2026 the CodeB issuer and verifier on phone.codeb.io passed the official conformance test plans for OpenID4VCI 1.0 and OpenID4VP 1.0 with the HAIP 1.0 profile – all four issuer plans and both verifier plans, with no failed test. These are tests of our servers, not a certification of the app. Details and result links: Key facts.
- Not an official government wallet and not certified – built to the EUDI Wallet Architecture and Reference Framework (ARF 3.0) under eIDAS 2.0; certification is ahead of us. As of November 2026 the EU certification scheme for these wallets is still a draft and no wallet has completed it.
Standards
Built on open European and international standards
CodeB Wallet follows the EU Architecture and Reference Framework (ARF) and is designed to comply with eIDAS 2.0. It is not certified and it is not an official government wallet.
Standards profile
ARF- Architecture and Reference Framework (ARF)EU framework
- eIDAS 2.0 – Regulation (EU) 2024/1183Regulation
- OpenID for Verifiable Credential Issuance (OpenID4VCI)Issuance
- OpenID for Verifiable Presentations (OpenID4VP)Online
- ISO/IEC 18013-5 – QR code, NFC, Bluetooth Low Energy (both roles)In person
- SD-JWT VC (Selective Disclosure JWT Verifiable Credentials)Format
- ISO mdoc (mobile document)Format
- PAdES baseline B-T (ETSI EN 319 142) – PDF signatures with trusted timestampSigning
- ETSI trusted listsIssuer trust
- ICAO Doc 9303 – electronic passports and ID cards (eMRTD): PACE, BAC, Chip and Active Authentication, Passive AuthenticationChip reading
- ISO/IEC TS 23220-4 Photo ID with ICAO Digital Travel Credential (DTC type 1)Photo ID
- ETSI TS 119 461 v2.1.1 – identity proofing: reading for the PID Provider is designed to follow it (extended LoIP); not certifiedIdentity proofing
- Signature cards over NFC – ISO/IEC 7816-4/-8, PACE (BSI TR-03110), CAdES/PAdES (ETSI EN 319 122 / 319 142), qcStatements (ETSI EN 319 412-5)NFC
- OpenID4VC High Assurance Interoperability Profile (HAIP) – followedIssuance and online presentation
- OAuth 2.0 DPoP (RFC 9449), Pushed Authorization Requests (RFC 9126), PKCE (RFC 7636)Issuance security
- OAuth 2.0 attestation-based client authentication – wallet instance attestationWallet provider
- Android Key AttestationGenuine app on a verified phone
- IETF Token Status List (JWT and CWT), W3C Bitstring Status ListRevocation
- ISO/IEC 18013-7 – mdoc online presentationOnline
- W3C Digital Credentials API – through Android’s Credential Manager, Android 14+Online
- OpenID Federation 1.0Trust discovery
- ETSI TS 119 475 – registration certificatesRelying-party registration
- ETSI TS 119 411-8 – access certificatesRelying parties
- EU PID RulebookPID
- Cloud Signature Consortium API v2Remote signing
- W3C WebAuthn – passkeys and pseudonymsPseudonyms
Security & privacy
Security and privacy by design
Security is Aloaha’s core business: we have worked on PKI, PDF and digital signatures since 2003. What stays on your phone: your documents, their keys and showing them in person. What goes through phone.codeb.io: reading a passport or ID card chip for an account, issuing documents, and signing with the CodeB signing service – which receives only a fingerprint (hash) of your PDF.
Protects itself while it runs
CodeB Wallet checks itself every time you open it: if it was changed, or another program is inspecting it (a debugger or a hooking tool), it stops and does not use your keys or documents until that is gone. These checks are our own code, without third-party libraries, and nothing about them is sent anywhere. For the same reason CodeB Wallet does not run on rooted phones, and it needs a phone with the Google Play Store.
Proves it is genuine with your phone’s security chip
When you add a card from the CodeB issuer, CodeB Wallet proves to our own wallet provider that it is the genuine app on a phone with a locked, verified system: the phone’s security chip certifies a fresh key for every request (Android Key Attestation). Google’s Play Integrity check is used as well, but issuing can keep working when Google’s service is unavailable. Only key certificates are sent – never your documents.
PIN and biometrics
The wallet is locked with a PIN and, if you wish, biometrics. Every share and every signature needs your confirmation.
End-to-end protected chip reading
When the PID Provider’s server reads your ID card or passport, the chip and the server set up their own encrypted, authenticated channel (PACE, Chip Authentication, Secure Messaging). Your phone only forwards the messages: neither the phone nor anyone in between can read them or change them unnoticed – at most the reading can be interrupted. The server also checks the issuing country’s signature on the data (Passive Authentication).
Your signature card stays in charge
When you sign with your own card, the key never leaves the card and every signature needs your PIN.
Trusted issuers
Issuer trust is checked against EU trusted lists (ETSI) and your list of trusted issuer certificates.
Status checks
Document status is checked automatically, so revoked documents are recognised. Where the issuer supports it, documents can be renewed automatically before they expire.
On your device
Your documents and your history are stored on your phone, not in a CodeB cloud.
No ads, no tracking
The app shows no advertising and contains no tracking and no analytics.
Our servers protect themselves too
Every server endpoint watches itself while it runs: anomaly detection, rate limits and refusal when in doubt.
Files instead of a database
Server state lives in encrypted, access-restricted files per customer, with a full restore from a single backup – a design choice for simple operation and a small attack surface, not a certification. All CodeB server software runs on Windows Server with Microsoft IIS.
No tracking on our servers either
No third-party analytics and no tracking on the server side.
This website does not track you
No analytics, no cookies, no external requests. Fonts and images are served from this site itself.