EUDI Wallet

TypeQR Engagement

Completeness82%high

Overview

The EU Digital Identity Wallet (EUDI Wallet) is a citizen-held digital identity app mandated by Regulation (EU) 2024/1183 ("eIDAS 2.0") [1]. It lets EU residents store government-issued identity (Person Identification Data, PID) and other attestations, and present them — online and in person — across all 27 member states with selective disclosure [1]. The EUDI Wallet is not itself a barcode standard; it is a credential-exchange framework in which a qr-code is the cross-device trigger that hands a verifier's request to the wallet [2].

Mechanically, when a verifier (relying party) wants attributes, it encodes an authorization request as a qr-code or deep link; the holder scans it with the wallet, which then returns a Verifiable Presentation over OpenID for Verifiable Presentations (OpenID4VP) [2]. The wallet is format-plural: it mandates the ISO/IEC 18013-5 mdoc format (the same mdoc used by the mobile-driving-licence) and SD-JWT VC, and optionally supports W3C Verifiable Credentials (VCDM 2.0) for non-qualified attestations [1].

History

The original eIDAS Regulation (EU 910/2014) of 2016 created EU electronic-identity and trust services but suffered from fragmented national schemes, narrow scope and a reliance on physical presence [1]. To fix these, the EU adopted Regulation (EU) 2024/1183 ("eIDAS 2.0") on 29 February 2024, establishing the European Digital Identity Wallet framework across all 27 member states [1].

The technical blueprint is the Architecture and Reference Framework (ARF) — non-binding design guidance (at version 2.8.0 as researched) that specifies how issuers, verifiers and wallet providers interact, while binding detail is set by Implementing Acts [1]. Implementation was de-risked through four large-scale pilots that concluded in 2025 — POTENTIAL (140+ partners, 19 states), EWC (80 partners, 24 countries), NOBID (34 partners, 6 countries) and DC4EU (99 institutions, 22 countries) — with two further pilots, APTITUDE and WE BUILD, launched in 2025 [1].

Technical specification

Credential / attestation types [1]:

PID (Person Identification Data) — the core government-issued digital identity (name, date of birth, place of birth, nationality) required to activate a wallet.
QEAA / PuB-EAA — qualified, and public-authority, Electronic Attestations of Attributes (e.g. diplomas, residence permits, company documents) from qualified trust service providers or public bodies.
EAA — non-qualified electronic attestations from any business (memberships, certificates, etc.).

Mandatory credential formats [1]:

SD-JWT VC — mandatory for PID, PuB-EAA and QEAA; selective disclosure via hash-based salting.
ISO/IEC 18013-5 mdoc — mandatory; the CBOR-based mdoc format (shared with the mobile-driving-licence) supports offline/proximity use.
W3C VC 2.0 (VCDM) — optional, and only for non-qualified EAAs.

Exchange protocols [1]:

OpenID4VCI (with the HAIP profile) — credential issuance into the wallet.
OpenID4VP (with HAIP) — credential presentation to verifiers.
ISO/IEC TS 18013-7 — remote mdoc verification.

QR-initiated presentation (OpenID4VP). The cross-device presentation flow is [2]:

The verifier builds an authorization request and encodes it as a qr-code or deep link.
The holder scans the code with the EUDI Wallet.
The wallet parses the request and shows the requested attributes, requiring explicit consent (biometric or PIN).
The wallet builds a Verifiable Presentation (VP / vp_token) and sends it to the verifier's response endpoint.

The format chosen follows the use case: SD-JWT VC for remote/online verification, mdoc/mDL for proximity/in-person flows (CBOR-encoded) [2]. As with the mobile-driving-licence, the qr-code carries the request/engagement, not the identity data itself [2].

Capabilities. Beyond credential presentation, the wallet supports authentication to online services (including Strong Customer Authentication), creation of qualified electronic signatures with EU-wide legal effect, and pseudonyms where identification is not legally required [1].

Use cases

Cross-border eID — proving identity to any public or private service across the 27 member states [1].
Age / attribute proof — "this person is over 18" returned over OpenID4VP after scanning a checkout qr-code [2].
KYC / account opening, SCA — strong authentication and identity verification for banks and regulated services [1].
Qualified e-signatures and pseudonymous login [1].
Sectoral attestations — diplomas, professional qualifications, residence and company documents as (Q)EAAs [1].

Implementations

The reference implementation lives under the eu-digital-identity-wallet GitHub organization (EUPL/Apache-licensed) [3]:

eudi-app-android-wallet-ui — Kotlin, EUPL-1.2. The reference EUDI Wallet prototype for Android. ~207 stars; actively maintained (last pushed 2026) [4].
eudi-app-ios-wallet-ui — the iOS reference wallet prototype [3].
eudi-lib-android-verifier-core — Kotlin, Apache-2.0. Android verifier SDK compliant with ISO 18013-5 [5].
eudi-app-multiplatform-verifier-ui and eudi-srv-wallet-provider (an OpenID4VCI 1.0 wallet-provider service) round out the issuer/verifier toolchain [3].

Comparison

Versus the mobile-driving-licence (ISO/IEC 18013-5): the mDL is a single credential type built purely on the ISO mdoc/CBOR model; the EUDI Wallet is a container and framework that mandates the mdoc format as one of two required formats (alongside SD-JWT VC) and adds the W3C-VC / OpenID web-credential approach on top [1]. So mDL is a building block of EUDI, not a rival — an mDL can be one of the credentials held in an EUDI Wallet [6].

Versus iata-bcbp / aamva-dl: those are static, cleartext data-in-a-barcode formats; the EUDI Wallet inverts the model — the qr-code carries only the verifier's request, and the response is a cryptographically signed, selectively-disclosed presentation, never a static dump of attributes [2].

The defining technical choice within EUDI is the dual-stack approach: the ISO mdoc lineage (proximity, offline, CBOR) coexists with the OpenID4VP + SD-JWT VC / W3C-VC lineage (web, JSON, online), so the wallet can serve both an in-person traffic stop and an online checkout [1, 2].

Status

Rolling out on a fixed legal timetable. Under eIDAS 2.0, all 27 member states must offer at least one certified EUDI Wallet to citizens by the end of 2026, and from the end of 2027 key private sectors (banks, telecoms, energy, transport) must accept it [1]. The four large-scale pilots concluded in 2025, the ARF has reached version 2.8.0, and the reference-implementation repositories are under active development [1, 3, 4].

Sources

What Is the EUDI Wallet? A Complete Guide — walt.id
Understanding OpenID4VP: The Protocol Behind EU Digital Identity Wallets — eIDAS Pro
European Digital Identity — GitHub organization — EU, 2026
eudi-app-android-wallet-ui — EUDI Wallet Prototype — EU Digital Identity Wallet (GitHub), 2026
eudi-lib-android-verifier-core — ISO 18013-5 verifier SDK — EU Digital Identity Wallet (GitHub), 2025
ISO 18013-5 Standard: What It Is And How It Works — Dock Labs

Deployments

No country reports mention this standard by name.