EU DCC

TypeQR Data Format

Completeness89%high

Overview

The EU Digital COVID Certificate (EU DCC) is a digitally signed health-credential data format issued by EU Member States during the COVID-19 pandemic to prove a holder's vaccination, test, or recovery status [1]. The data payload is carried in a qr-code and built on the Electronic Health Certificate Container Format ("HCERT"), a stack of open standards: a CBOR Web Token (CWT) signed with COSE, compressed with ZLIB/Deflate, encoded as ASCII with Base45, and prefixed with the context identifier HC1: [2].

The EU DCC entered application under Regulation (EU) 2021/953 on 1 July 2021 and became one of the largest-scale digital-credential deployments in history, with more than 2.3 billion certificates distributed across 51 countries on four continents [1, 3]. The EU-level legal basis expired on 30 June 2023, and on 1 July 2023 the World Health Organization adopted the system as the first building block of its Global Digital Health Certification Network (GDHCN) [1, 4].

History

2020–2021 — eHealth Network design. The technical work was carried out by the EU eHealth Network and partner Member States, who published the HCERT specification through the open ehn-dcc-development GitHub organization [2].

1 June 2021 — EU Gateway live. The central EU DCC Gateway, which distributes the public keys (Document Signing Certificates) needed to verify certificates across borders, went live, enabling cross-border verification without sharing personal data [3].

1 July 2021 — Regulation (EU) 2021/953 enters application. The regulation established the common framework for issuance, verification, and acceptance of interoperable vaccination, test, and recovery certificates [1, 5]. The accompanying Commission Implementing Decision (EU) 2021/1073 laid down the binding technical specifications [5].

2021–2023 — Mass rollout. More than 2.3 billion certificates were issued, and the framework was extended to 51 countries across four continents through equivalence decisions with non-EU states [1].

30 June 2023 — EU regulation expires. The legal basis for the EU DCC lapsed; the Commission committed to maintaining the EU Gateway for a transitional period until the end of December 2023 [1, 6].

1 July 2023 — WHO handover. The WHO took up the EU system to build a Global Digital Health Certification Network, signing a non-binding Administrative Arrangement with the European Commission to continue developing the framework globally [1, 4].

Technical specification

The HCERT container is a layered encoding pipeline [2]:

Layer	Standard	Role
Signed token	CBOR Web Token (CWT), RFC 8392	Structured payload + claims
Signature	COSE, RFC 8152 (`COSE_Sign1`)	Asymmetric digital signature
Serialization	CBOR, RFC 7049	Compact binary encoding
Compression	ZLIB (RFC 1950) + Deflate (RFC 1951)	Shrink payload for QR
Transport encoding	Base45 (draft-faltstrom-base45)	ASCII-safe for QR alphanumeric mode
Prefix	`HC1:` context identifier	Signals decoding scheme to verifiers
Carrier	qr-code (ISO/IEC 18004:2015, EC level Q ≈ 25 %)	2D barcode

Signature algorithms. Both ES256 (ECDSA with NIST P-256 and SHA-256) and PS256 (RSASSA-PSS, 2048-bit modulus, SHA-256) are mandatory to implement [2].

CWT claims [2]:

Claim	Key	Content
`iss`	1	Issuer — ISO 3166-1 alpha-2 country code (optional)
`iat`	6	Issued-at timestamp
`exp`	4	Expiry timestamp
`hcert`	-260	Health certificate object containing `eu_dcc_v1` per the DCC JSON schema

Key identifier (kid). The COSE header kid is the first 8 bytes of the SHA-256 fingerprint of the Document Signing Certificate (DSC) in DER form. Because the kid is truncated, collisions are possible and a verifier must try all DSCs matching a given kid [2].

PKI trust model. A two-tier hierarchy: each country operates a self-signed CSCA (Country Signing Certificate Authority) which issues short-lived DSCs for day-to-day signing. Public DSCs are distributed through the EU Gateway so any Member State can verify any other's certificates [2, 3].

Use cases

Cross-border travel within the EU/EEA — proof of vaccination, negative test, or recovery for free movement during the pandemic [1].
Domestic access control — many Member States used the DCC for entry to events, restaurants, and venues (national "COVID pass" schemes built on the same QR) [1].
Three certificate types — vaccination, test, and recovery certificates, each a distinct eu_dcc_v1 payload variant [1].
International equivalence — non-EU countries (e.g. UK, Switzerland, Israel, and others among the 51) connected to the Gateway so their certificates were recognized in the EU and vice versa [1].

Implementations

Specification (canonical) — ehn-dcc-development/eu-dcc-hcert-spec — 361★, last active 2023. The authoritative HCERT container specification (archived read-only July 2023) [2].
Payload schema — ehn-dcc-development/eu-dcc-schema — 162★, last active 2023. The JSON schema for the eu_dcc_v1 health-certificate object.
National apps — every Member State shipped issuer and verifier apps (e.g. Germany's CovPass, France's TousAntiCovid / TAC Verif) built against these specs; the ehn-dcc-development org also hosts reference validator code, value sets, and test data.
Third-party libraries — Base45/COSE/CWT support exists in many languages; e.g. Python's cwt library can verify EU DCCs [9].

Comparison

	EU DCC	smart-health-cards	divoc	icao-vds-nc
Data model	CWT / CBOR + COSE	W3C VC as JWS	W3C VC (JSON-LD / JSON-JWT)	CBOR-/JSON-based seal + COSE/ECDSA
Encoding	Base45 + ZLIB, `HC1:` prefix	numeric `shc:/`, Deflate	JSON-LD in QR	signed JSON in QR/Data Matrix
Signature	ES256 / PS256	ES256	RSA / Ed25519 (issuer-controlled)	ES256 / ES384
Governance	EU eHealth Network → WHO GDHCN	VCI consortium / HL7	eGov Foundation (India), MIT	ICAO (UN body)
Geography	EU + 51 countries	US states, Canada, others	India, Sri Lanka, Philippines	ICAO member states

The EU DCC's distinguishing technical choice is CBOR/COSE/Base45 (binary-compact, optimized to fit health data plus a signature in a single QR), versus SHC's JSON-Web-Signature-over-numeric-QR approach. Both EU DCC and VDS-NC reuse a state-level PKI (CSCA/DSC), reflecting their government-issuer origins, whereas SHC and DIVOC use issuer-published key endpoints or issuer-controlled keys [2, 7].

Fun facts

Base45 was invented for this. The EU DCC popularized Base45, a then-new IETF draft encoding chosen specifically because it maps cleanly onto QR Code's alphanumeric mode (45-character set), packing binary data more densely into a QR than Base64 would [2].

The kid is deliberately ambiguous. Truncating the DSC fingerprint to 8 bytes saves space in the COSE header but means verifiers occasionally have to test multiple candidate certificates for one kid — a rare design that trades a tiny QR-size win for verification complexity [2].

Status

The EU DCC's EU legal framework expired on 30 June 2023, and the EU Gateway was wound down at the end of December 2023 [1, 6]. The technical framework lives on through the WHO Global Digital Health Certification Network, which adopted the EU system on 1 July 2023 as the foundation for a global, standard for verifiable health documents beyond COVID-19 [1, 4]. The reference repositories are archived but remain the canonical description of the HCERT format, which continues to influence WHO SMART Trust and successor health-credential work [2].

Sources

Deployments

No country reports mention this standard by name.