By the VixQR team · published on · 2 min read
Digital Identity: Why Wallets Use QR, NFC and Bluetooth
Presenting digital identity is not the same as showing a photograph of a card on a screen. A trustworthy credential must be verifiable, minimise the data…
Presenting digital identity is not the same as showing a photograph of a card on a screen. A trustworthy credential must be verifiable, minimise the data shared and obtain the holder’s consent. Modern wallets combine several technologies to provide that experience.
Google describes digital IDs based on ISO/IEC 18013-5 that can begin through NFC or a QR code scan and continue over a secure channel. Use cases include mobile driving licences, age proof and identity verification.
The QR code starts the conversation
In an in-person scenario, the reader displays or scans a QR code containing device-engagement information, including an ephemeral public key. It lets the devices establish the session. It does not mean that all identity data is printed inside the square.
The devices then negotiate encrypted transport, often using Bluetooth Low Energy. The wallet receives a request listing the desired fields. The user reviews the request and decides whether to continue.
Selective disclosure changes the model
To check age, a merchant does not always need a full birth date. A credential can provide a statement such as “over 18” or “over 21.” This reduces collection and the risks created by retaining personal information.
A cryptographic signature lets the verifier check that the data came from a trusted issuer and was not altered. That is fundamentally different from a QR code containing a name and date as plain text.
Online and offline verification
Flows can operate:
- in person at a terminal or verifier app;
- online when a site requests proof from a compatible wallet;
- sometimes without an active Internet connection during presentation, if the required certificates and rules are available locally.
Organisations verifying identity become relying parties. They must define the minimum required attributes, manage trust in issuers and protect technical logs.
What an ordinary QR code cannot do
A QR code generated from text or a URL is not a verifiable identity. It can be copied, altered or presented by someone else. Adding an official-looking logo does not create cryptographic proof.
Do not place a document number, birth date or address directly inside a public QR code. VixQR can encode a link or reference for a non-sensitive badge. Official identity requires compliant infrastructure, a recognised issuer and a verification protocol.
Moving toward everyday use
Identity wallets are approaching daily situations such as car rental, event entry, public services and age-restricted purchases. The QR code plays a quiet but important role: it helps devices discover and engage with each other without becoming the identity document itself.