Skip to content
barcoder

Standards/esim-activation-code

eSIM Activation Code

TypeQR Data Format
Completeness84%high

Overview

An eSIM activation code is a short text string, carried in a QR Code or typed by hand, that tells a device where to download a mobile operator's SIM profile. GSMA's SGP.22 specification defines the string as 1$<SM-DP+ address>$<matching ID>, and requires the prefix LPA: when it is put in a QR code, which gives the familiar LPA:1$… form 1.

The code does not contain the profile. It names the provisioning server (the SM-DP+) and a matching ID that identifies a pending order on that server; the device's Local Profile Assistant (LPA) then fetches a profile cryptographically tied to that device's eUICC 1. A real activation code works as a live credential for that pending order, so this page shows only the specification's published samples.

History

GSMA published SGP.22 Version 1.0 on 13 January 2016, and the Activation Code section was already in it: the same $-delimited layout, the AC_Format value 1, the 255-character limit and the LPA: prefix for QR codes 2. The document history of Version 2.7 lists the releases that followed, including V1.1 (14 April 2016), V2.0 (July 2016), V2.1 (January 2017), V2.2 (31 August 2017), V2.2.2 (5 June 2020), V2.3 (30 June 2021), V2.4 (28 October 2021) and V2.5 (26 May 2023) 1.

The field for the server's certificate identity changed name along the way: V1.0 called it SMDPid, the "Subject Identifier" of the SM-DP+ certificate, and later versions call it the SM-DP+ OID 2 1. Version 3.1 (1 December 2023) added two further optional fields, covered below 3.

Device adoption, according to Wikipedia: the Samsung Gear S2 Classic 3G (February 2016) was the first device to implement an eSIM, the Google Pixel 2 (October 2017) the first phone, and the Apple Watch Series 3 (September 2017) Apple's first eSIM device. iPhone followed in 2018 with the XS and XR, and the US iPhone 14 models of 2022 dropped the SIM tray 25. Wikipedia also says the eSIM "was released in March 2016", which does not fit its own February date for the Gear S2 25.

No source fetched for this page names the individual who designed the format.

Technical specification

Carrier. SGP.22 requires a QR code according to ISO/IEC 18004, and the normative reference is the 2015 edition 1. It sets no error-correction level, symbol version or print size for the Activation Code; those choices are left to whoever generates the code 1.

Structure. The string is a concatenation of fields separated by $ 1:

Field Presence Content
AC_Format Mandatory Always 1; a device treats any other value as invalid
SM-DP+ address Mandatory Server FQDN, limited to the QR alphanumeric character set, without $
AC_Token Mandatory, may be empty The matching ID
SM-DP+ OID Optional OID from the server's authentication certificate
Confirmation Code Required Flag Optional 1 if a Confirmation Code is needed, otherwise absent

The whole string may run to 255 characters, and SGP.22 advises keeping user experience in mind when choosing the length 1. The LPA: prefix belongs to the QR form only: for manual entry the string is used without it 1.

Published samples (the specification's own; LPA: added for the QR form) 1:

LPA:1$SMDP.GSMA.COM$04386-AGYFT-A74Y8-3F815
LPA:1$SMDP.GSMA.COM$04386-AGYFT-A74Y8-3F815$$1
LPA:1$SMDP.GSMA.COM$04386-AGYFT-A74Y8-3F815$1.3.6.1.4.1.31746$1
LPA:1$SMDP.GSMA.COM$04386-AGYFT-A74Y8-3F815$1.3.6.1.4.1.31746
LPA:1$SMDP.GSMA.COM$$1.3.6.1.4.1.31746

In order: no optional fields; the Confirmation Code flag with an empty OID slot, which is why $$ appears; both optional fields; the OID alone; and an OID with an empty matching ID 1.

Matching ID. It is set up between the operator and the SM-DP+ to identify a specific order. When not empty it must be unique for that operator and server, and the SM-DP+ processes only matching IDs it already knows. It may contain only 0-9, A-Z and -, a choice the specification says allows more compact alphanumeric QR encoding and suits manual entry 1. Either the operator or the SM-DP+ may generate it 1.

Forward compatibility. A device must ignore a delimiter and any parameters beyond those it knows, so new optional fields can be added without breaking older devices 1. SGP.22 V3.1 uses this to append two more fields 3:

  • eSIM CA RootCA Public Key indicator: an even number of upper-case hex characters, possibly truncated, which may contain - for readability.
  • Delete Notification for Device Change: a hex-encoded signed record of the profile deleted from the old device, used only when moving to a new device. With this field the code may exceed 255 characters.

V3.1 also changes the sample host to SMDP.EXAMPLE.COM and adds the sample 1$SMDP.EXAMPLE.NET$KL14XA-8C7RLY$1.3.6.1.4.1.31746$$A14D8-971, which has an empty flag slot before the key indicator 3.

Symbol size

Every character of the uppercase samples is in QR's 45-character alphanumeric set, which includes $, :, - and . but no lowercase letters 21. Lowercase forces byte mode, which has lower capacity at each version 20.

Worked examples, computed with bwip-js 4.11.1 and consistent with the published capacity table 20:

Payload Length L M Q H
First sample above 43 V2 (25 × 25) V3 (29 × 29) V3 V4 (33 × 33)
Same text in lowercase 43 V3 V4 V4 V5 (37 × 37)
With OID and flag 63 V3 V4 V4 V5

What the device does with it

The LPA parses the string and stops with an error if the format is invalid 1. It then opens an HTTPS connection to the SM-DP+ and runs mutual authentication. If the code carried an OID, the LPA checks it against the OID in the server's certificate and stops on a mismatch 1. The matching ID is sent to the server, the user confirms, and the profile arrives as a Bound Profile Package, defined as cryptographically linked to one particular eUICC 1.

Confirmation Code. This optional second factor is a separate value given to the user apart from the Activation Code; it does not appear in the string, only a flag saying it is needed 1. The device sends a hash of it, computed as SHA256(SHA256(code) | TransactionID) 1. The SM-DP+ must limit both download attempts and Confirmation Code attempts. The operator sets the retry limit, and exceeding it ends the order 1.

Related QR formats in the same specification. The device's 32-digit EID can be shown as a QR code with the prefix EID:, in alphanumeric mode, and the same format should be used on device packaging 1. An optional Activation Code Retrieval procedure lets an LPA ask the server for a code for an installed profile, using a matching ID of the form ACR-0-<ICCID> 1.

Use cases

  • Consumer phones. On iPhone, the user scans the carrier's QR code during setup or with the Camera app. From iOS 17.4, a code in an email or browser can be touched and held to add the eSIM, and carriers may instead send details for manual entry 9. On Android, the LPA can open its QR scanner when an app sets USE_QR_SCANNER, and a carrier app can also pass a code to the LPA directly 8.
  • Travel eSIM. Apple's guidance for travellers notes that carriers provide activation digitally, such as with a QR code or carrier app, for prepaid plans bought online or at an airport kiosk or carrier store 10.
  • Enterprise fleets. Microsoft Intune imports up to 1,000 one-time-use codes per CSV file for Windows devices. The file holds the SM-DP+ address once and an ICCID and matching ID per row, so no LPA: string or QR code is involved. The feature is in public preview, and on Windows 11 Microsoft recommends an eSIM download server instead 7. The Microsoft Graph API exposes the same three fields 6.
  • Routers. LANCOM's documentation for the Rohde & Schwarz NC cellular router takes the full LPA:1$… string in a WEBconfig text field; a device with a camera can scan the QR code instead 12.
  • IoT. SGP.32 reuses the same Activation Code format, but a server delivers it to the device instead of a person scanning it (see below) 4.

SGP.32 (eSIM IoT)

SGP.32 covers provisioning for devices with constrained networks or user interfaces. Version 1.0 is dated 26 May 2023, and Version 1.2 (27 June 2024) defines "Activation Code" by reference to SGP.22, and states that the code is coded as in SGP.22 section 4.1 4.

The difference is the channel. An eIM, a remote management entity, sends a download trigger containing the Activation Code in an eIM Package, and the IoT Profile Assistant (IPA) on the device or eUICC parses it. Alternatively the eIM can keep the code and do the parsing itself, for an IPA that declares it does not handle download data 4. SM-DS results are also passed on as an SM-DP+ address and EventID "formatted as an Activation Code" 4. The word "QR" does not appear in SGP.32 V1.2 at all, so the LPA: prefix has no defined role there 4.

Security

  • Bearer risk. SGP.22 calls the matching ID a protection for the SM-DP+, and the Confirmation Code is the optional measure that protects a download order 1. A vendor explains the practical effect: codes are usually one-time, so if someone else installs first, the owner cannot use that code 23. Microsoft likewise describes activation codes as used once 7. SGP.22 itself mandates attempt limits and leaves the numbers to the operator, rather than fixing a single use 1.
  • Account takeover. In March 2024, BleepingComputer reported findings by the Russian firm F.A.C.C.T.: attackers who broke into a victim's carrier account generated a new eSIM QR code there and scanned it on their own device, moving the number and disabling the victim's SIM. The firm recorded more than a hundred attempts since autumn 2023 against the clients of one financial organisation. Its advice was strong unique passwords and two-factor authentication on the carrier account, and non-SMS factors for high-value accounts 22. The weakness there is the carrier's account, not the code format.

Implementations

There is no dedicated symbol encoder: any QR library that can produce alphanumeric mode will do, and the work is on the reading side, which the LPA does.

Project Lang Stars Last active Notes
estkme-group/lpac C ~744 2026-10 Command-line LPA, compatible with SGP.22 2.2.2 15; profile download -a takes the LPA:1$… string and overrides separate server and matching ID options, with -c for a Confirmation Code 14
estkme-group/openeuicc not shown ~1.1k 2026-10 Mirror of OpenEUICC, an open-source LPA for Android 16
creamlike1024/EasyLPAC not shown ~787 2026-08 GUI front end for lpac 17
nayuki/QR-Code-generator Java and five others ~6.8k 2026-10 General QR encoder in Java, TypeScript/JavaScript, Python, Rust, C++ and C 19

The "eUICC and eSIM Developer Manual" lists other LPAs, including NekokoLPA, LPAdesktop, lpa-gtk, Infineon LPA and Chromium OS's hermes daemon 18. Android's platform source does not include an LPA: the device maker supplies one by extending EuiccService 8.

Parsers should expect real-world variation. SGP.22 restricts the matching ID to upper case 1, but Microsoft's Graph regex also accepts lowercase 6. Similarly, the host is limited to a character set with no lowercase letters 1 21, yet V2.7's table gives smdp.gsma.com as its example and vendor documents use lowercase hosts 1 12 14. Telnyx also warns that some QR reader apps add a link or text before the string, and that iPhone-style forms want only the hostname in the address field, while single-field Android screens take the whole string 13.

Comparison

  • Activation Code vs SM-DS and Default SM-DP+. SGP.22 offers three ways to add a profile. A Default SM-DP+ uses an address configured on the device with an empty matching ID, and an SM-DS lets the device discover a pending event; both need no input from the user 1. The operator tells the user what triggers the download 1. Choose the Activation Code when the device is not known in advance or is already in the customer's hands. Discovery suits an order bound to a known device.
  • Activation Code vs carrier app. On Android a carrier app can fetch a code itself, including through a call that takes the EID so the profile can be pre-bound before download 8. Choose the app when the operator has one; choose the QR code when the only channel is print or email.
  • Consumer (SGP.22) vs M2M (SGP.02) vs IoT (SGP.32). According to Onomondo, SGP.02 pushes profiles from the service side over SMS, SGP.22 is pulled by a user on the device, and SGP.32 is started remotely through an eIM with no device interface 24. The QR code belongs to the user-driven model.
  • Activation Code vs WiFi QR. A WIFI: code holds the secret itself, in its P field 26, and can be read by anyone who sees it. An Activation Code points at a server, and the attempt limits, device binding and optional Confirmation Code all live on that side 1.

Fun facts

  • The sample matching ID 04386-AGYFT-A74Y8-3F815 appears in SGP.22 V1.0 of January 2016 and is unchanged in V2.7 of April 2026 2 1.
  • The $ delimiter and the : of LPA: are both in QR's alphanumeric set, so a fully uppercase code stays in that compact mode from end to end 21.

Status

Active. SGP.22 Version 2.7 is dated 24 April 2026, and its format section still defines AC_Format 1 1. GSMA's certification annex of 2025 lists SGP.22 V3.0 and V3.1 as active 5, so a 2.x and a 3.x line coexist. Both keep the same base format 1 3.

Platform support is current: Apple's setup guide, updated in October 2026, describes QR setup, manual entry and Confirmation Code prompts, and eSIM requires an iPhone XS, XR or later 9 10. Android's documentation covers the LPA and QR flows 8.

From iOS 17.4, Apple also offers a link alternative to a printed code, per a vendor article quoting Apple's release notes: https://esimsetup.apple.com/esim_qrcode_provisioning?carddata= followed by the LPA string 11. Apple's own documentation for that link was not fetched.

Sources

1 SGP.22 RSP Technical Specification, Version 2.7 — GSMA, 2026 2 SGP.22 RSP Technical Specification, Version 1.0 — GSMA, 2016 3 SGP.22 RSP Technical Specification, Version 3.1 — GSMA, 2023 4 SGP.32 eSIM IoT Technical Specification, Version 1.2 — GSMA, 2024 5 Annex C: eSIM Certification Applicability — GSMA, 2025 6 embeddedSIMActivationCode resource type — Microsoft Learn, accessed 2026 7 Enable eSIM data connections in Microsoft Intune — Microsoft Learn, 2026 8 Implement eSIM — Android Open Source Project, accessed 2026 9 Set up eSIM on iPhone — Apple Support, 2026 10 Use eSIM while traveling internationally with your iPhone — Apple Support, 2026 11 New Apple Universal Link for eSIM install — eSIM Access (vendor), 2024 12 eSIM configuration — LANCOM Systems, accessed 2026 13 SM-DP+ address — Telnyx (vendor), accessed 2026 14 lpac usage — estkme-group, accessed 2026 15 estkme-group/lpac — GitHub, accessed 2026 16 estkme-group/openeuicc — GitHub, accessed 2026 17 creamlike1024/EasyLPAC — GitHub, accessed 2026 18 Known LPA (Local Profile Assistant) Solutions — eUICC and eSIM Developer Manual, accessed 2026 19 nayuki/QR-Code-generator — GitHub, accessed 2026 20 Character Capacities by Version and Error Correction Level — Thonky.com, accessed 2026 21 Alphanumeric Table — Thonky.com, accessed 2026 22 SIM swappers hijacking phone numbers in eSIM attacks — BleepingComputer, 2024 23 Can an eSIM QR code be reused? — Nomad (vendor), accessed 2026 24 SGP.02 vs SGP.22 vs SGP.32 — Onomondo (vendor), 2026 25 eSIM — Wikipedia, accessed 2026 26 Barcode Contents — ZXing Wiki, accessed 2026

Deployments

No country reports mention this standard by name.

Regions / aggregations not mapped to a single country

  • Universal
source · content/standards/esim-activation-code/index.md