# EU DCC

> Source: https://docs.barcoder.ai/docs/standards/eu-dcc
> research date 2026-06-03 · extracted at 2026-10-06
> Publisher: Barcoder — encyclopedia of QR, barcode and payment-code standards

Specifications:
- [Electronic Health Certificate Specification (HCERT) — ehn-dcc-development](https://github.com/ehn-dcc-development/eu-dcc-hcert-spec/blob/main/hcert_spec.md)
- [Commission Implementing Decision (EU) 2021/1073 — technical specifications for the EU DCC](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32021D1073)

## Overview

The **EU Digital COVID Certificate (EU DCC)** is a digitally signed health-credential data format issued by EU Member States during the COVID-19 pandemic to prove a holder's vaccination, test, or recovery status <sup>[1][1]</sup>. The data payload is carried in a **[QR Code](https://docs.barcoder.ai/docs/standards/qr-code)** and built on the **Electronic Health Certificate Container Format ("HCERT")**, a stack of open standards: a **CBOR Web Token (CWT)** signed with **COSE**, compressed with **ZLIB/Deflate**, encoded as ASCII with **Base45**, and prefixed with the context identifier **`HC1:`** <sup>[2][2]</sup>.

The EU DCC entered application under **Regulation (EU) 2021/953** on **1 July 2021** and became one of the largest-scale digital-credential deployments in history, with **more than 2.3 billion certificates** distributed across **51 countries on four continents** <sup>[1][1], [3][3]</sup>. The EU-level legal basis expired on 30 June 2023, and on **1 July 2023 the World Health Organization adopted the system** as the first building block of its **Global Digital Health Certification Network (GDHCN)** <sup>[1][1], [4][4]</sup>.

## History

**2020–2021 — eHealth Network design.** The technical work was carried out by the EU eHealth Network and partner Member States, who published the HCERT specification through the open **ehn-dcc-development** GitHub organization <sup>[2][2]</sup>.

**1 June 2021 — EU Gateway live.** The central **EU DCC Gateway**, which distributes the public keys (Document Signing Certificates) needed to verify certificates across borders, went live, enabling cross-border verification without sharing personal data <sup>[3][3]</sup>.

**1 July 2021 — Regulation (EU) 2021/953 enters application.** The regulation established the common framework for issuance, verification, and acceptance of interoperable vaccination, test, and recovery certificates <sup>[1][1], [5][5]</sup>. The accompanying **Commission Implementing Decision (EU) 2021/1073** laid down the binding technical specifications <sup>[5][5]</sup>.

**2021–2023 — Mass rollout.** More than **2.3 billion certificates** were issued, and the framework was extended to **51 countries across four continents** through equivalence decisions with non-EU states <sup>[1][1]</sup>.

**30 June 2023 — EU regulation expires.** The legal basis for the EU DCC lapsed; the Commission committed to maintaining the EU Gateway for a transitional period until the end of December 2023 <sup>[1][1], [6][6]</sup>.

**1 July 2023 — WHO handover.** The WHO took up the EU system to build a **Global Digital Health Certification Network**, signing a non-binding Administrative Arrangement with the European Commission to continue developing the framework globally <sup>[1][1], [4][4]</sup>.

## Technical specification

The HCERT container is a layered encoding pipeline <sup>[2][2]</sup>:

| Layer | Standard | Role |
|---|---|---|
| Signed token | **CBOR Web Token (CWT)**, RFC 8392 | Structured payload + claims |
| Signature | **COSE**, RFC 8152 (`COSE_Sign1`) | Asymmetric digital signature |
| Serialization | **CBOR**, RFC 7049 | Compact binary encoding |
| Compression | **ZLIB** (RFC 1950) + Deflate (RFC 1951) | Shrink payload for QR |
| Transport encoding | **Base45** (draft-faltstrom-base45) | ASCII-safe for QR alphanumeric mode |
| Prefix | `HC1:` context identifier | Signals decoding scheme to verifiers |
| Carrier | **[QR Code](https://docs.barcoder.ai/docs/standards/qr-code)** (ISO/IEC 18004:2015, EC level Q ≈ 25 %) | 2D barcode |

**Signature algorithms.** Both **ES256** (ECDSA with NIST P-256 and SHA-256) and **PS256** (RSASSA-PSS, 2048-bit modulus, SHA-256) are mandatory to implement <sup>[2][2]</sup>.

**CWT claims** <sup>[2][2]</sup>:

| Claim | Key | Content |
|---|---|---|
| `iss` | 1 | Issuer — ISO 3166-1 alpha-2 country code (optional) |
| `iat` | 6 | Issued-at timestamp |
| `exp` | 4 | Expiry timestamp |
| `hcert` | **-260** | Health certificate object containing `eu_dcc_v1` per the DCC JSON schema |

**Key identifier (`kid`).** The COSE header `kid` is the **first 8 bytes of the SHA-256 fingerprint** of the Document Signing Certificate (DSC) in DER form. Because the `kid` is truncated, collisions are possible and a verifier must try all DSCs matching a given `kid` <sup>[2][2]</sup>.

**PKI trust model.** A two-tier hierarchy: each country operates a self-signed **CSCA** (Country Signing Certificate Authority) which issues short-lived **DSCs** for day-to-day signing. Public DSCs are distributed through the **EU Gateway** so any Member State can verify any other's certificates <sup>[2][2], [3][3]</sup>.

## Use cases

- **Cross-border travel within the EU/EEA** — proof of vaccination, negative test, or recovery for free movement during the pandemic <sup>[1][1]</sup>.
- **Domestic access control** — many Member States used the DCC for entry to events, restaurants, and venues (national "COVID pass" schemes built on the same QR) <sup>[1][1]</sup>.
- **Three certificate types** — vaccination, test, and recovery certificates, each a distinct `eu_dcc_v1` payload variant <sup>[1][1]</sup>.
- **International equivalence** — non-EU countries (e.g. UK, Switzerland, Israel, and others among the 51) connected to the Gateway so their certificates were recognized in the EU and vice versa <sup>[1][1]</sup>.

## Implementations

- **Specification (canonical)** — [ehn-dcc-development/eu-dcc-hcert-spec][7] — 361★, last active 2023. The authoritative HCERT container specification (archived read-only July 2023) <sup>[2][2]</sup>.
- **Payload schema** — [ehn-dcc-development/eu-dcc-schema][8] — 162★, last active 2023. The JSON schema for the `eu_dcc_v1` health-certificate object.
- **National apps** — every Member State shipped issuer and verifier apps (e.g. Germany's CovPass, France's TousAntiCovid / TAC Verif) built against these specs; the `ehn-dcc-development` org also hosts reference validator code, value sets, and test data.
- **Third-party libraries** — Base45/COSE/CWT support exists in many languages; e.g. Python's `cwt` library can verify EU DCCs <sup>[9][9]</sup>.

## Comparison

| | **EU DCC** | **[SMART Health Cards](https://docs.barcoder.ai/docs/standards/smart-health-cards)** | **[DIVOC](https://docs.barcoder.ai/docs/standards/divoc)** | **[ICAO VDS-NC](https://docs.barcoder.ai/docs/standards/icao-vds-nc)** |
|---|---|---|---|---|
| Data model | CWT / CBOR + COSE | W3C VC as JWS | W3C VC (JSON-LD / JSON-JWT) | CBOR-/JSON-based seal + COSE/ECDSA |
| Encoding | Base45 + ZLIB, `HC1:` prefix | numeric `shc:/`, Deflate | JSON-LD in QR | signed JSON in QR/Data Matrix |
| Signature | ES256 / PS256 | ES256 | RSA / Ed25519 (issuer-controlled) | ES256 / ES384 |
| Governance | EU eHealth Network → WHO GDHCN | VCI consortium / HL7 | eGov Foundation (India), MIT | ICAO (UN body) |
| Geography | EU + 51 countries | US states, Canada, others | India, Sri Lanka, Philippines | ICAO member states |

The EU DCC's distinguishing technical choice is **CBOR/COSE/Base45** (binary-compact, optimized to fit health data plus a signature in a single QR), versus SHC's JSON-Web-Signature-over-numeric-QR approach. Both EU DCC and VDS-NC reuse a **state-level PKI** (CSCA/DSC), reflecting their government-issuer origins, whereas SHC and DIVOC use issuer-published key endpoints or issuer-controlled keys <sup>[2][2], [7][7]</sup>.

## Fun facts

**Base45 was invented for this.** The EU DCC popularized **Base45**, a then-new IETF draft encoding chosen specifically because it maps cleanly onto QR Code's alphanumeric mode (45-character set), packing binary data more densely into a QR than Base64 would <sup>[2][2]</sup>.

**The `kid` is deliberately ambiguous.** Truncating the DSC fingerprint to 8 bytes saves space in the COSE header but means verifiers occasionally have to test multiple candidate certificates for one `kid` — a rare design that trades a tiny QR-size win for verification complexity <sup>[2][2]</sup>.

## Status

The EU DCC's **EU legal framework expired on 30 June 2023**, and the EU Gateway was wound down at the end of December 2023 <sup>[1][1], [6][6]</sup>. The technical framework lives on through the **WHO Global Digital Health Certification Network**, which adopted the EU system on **1 July 2023** as the foundation for a global, standard for verifiable health documents beyond COVID-19 <sup>[1][1], [4][4]</sup>. The reference repositories are archived but remain the canonical description of the HCERT format, which continues to influence WHO SMART Trust and successor health-credential work <sup>[2][2]</sup>.

## Sources

[1]: https://commission.europa.eu/strategy-and-policy/coronavirus-response/safe-covid-19-vaccines-europeans/eu-digital-covid-certificate_en
[2]: https://github.com/ehn-dcc-development/eu-dcc-hcert-spec/blob/main/hcert_spec.md
[3]: https://www.consilium.europa.eu/en/policies/coronavirus-pandemic/eu-digital-covid-certificate/
[4]: https://www.who.int/news/item/05-06-2023-the-european-commission-and-who-launch-landmark-digital-health-initiative-to-strengthen-global-health-security
[5]: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32021D1073
[6]: https://www.consilium.europa.eu/en/press/press-releases/2023/06/27/towards-a-global-digital-health-certificate-council-adopts-recommendations/
[7]: https://github.com/ehn-dcc-development/eu-dcc-hcert-spec
[8]: https://github.com/ehn-dcc-development/eu-dcc-schema
[9]: https://medium.com/@dajiaji/verifying-eu-digital-covid-19-certificate-with-python-cwt-fd3d5de27eed

1. [EU Digital COVID Certificate — European Commission][1]
2. [Electronic Health Certificate Specification (HCERT) — ehn-dcc-development][2]
3. [EU digital COVID certificate: how it works — Council of the EU][3]
4. [European Commission and WHO launch landmark digital health initiative — WHO, 2023][4]
5. [Commission Implementing Decision (EU) 2021/1073 — EUR-Lex][5]
6. [Towards a global digital health certificate: Council adopts recommendations — Council of the EU, 2023][6]
7. [ehn-dcc-development/eu-dcc-hcert-spec — GitHub][7]
8. [ehn-dcc-development/eu-dcc-schema — GitHub][8]
9. [Verifying EU Digital COVID-19 Certificate with Python CWT — Medium][9]

## Deployments

_No country reports mention this standard by name._

## Regions / aggregations not mapped to a single country

- EU