The EUDI Wallet will change how people log in to online services by replacing passwords and fragmented login methods with a single, secure digital identity stored on their smartphone. Instead of creating accounts and managing credentials for every platform, users present verified identity attributes from their wallet each time a service requests them. This article explains how that works, what it means for organizations, and what steps to take now.
What does the EUDI Wallet actually replace in a login process?
The EUDI Wallet replaces the traditional combination of username, password, and often a second factor such as an SMS code or authenticator app. Instead of entering credentials that a service checks against a stored database, users present cryptographically signed identity attributes from their wallet. No more password resets, no more credential databases to protect.
Beyond passwords, the wallet also replaces the need to fill in registration forms. Today, when someone creates a new account, they typically type in their name, date of birth, address, and email address. With wallet-based login, that information is already verified and can be shared in a single interaction. The user selects what to share and approves the request on their device.
This also removes the reliance on social login buttons such as “Sign in with Google” or “Sign in with Facebook.” Those options are convenient but come at the cost of sharing behavioural data with large platforms. The EUDI Wallet achieves the same convenience without routing your identity through a commercial third party.
How does wallet-based authentication work technically?
Wallet-based authentication uses verifiable attestations and public key cryptography. When a user wants to log in, the service sends a presentation request to the wallet using OID4VP. The wallet responds with a digitally signed presentation of the relevant identity attributes in mdoc or SD-JWT VC format, which the service verifies through a set of distinct checks. The user’s private key never leaves the Wallet Secure Cryptographic Device.
Verification involves three separate steps. First, the verifier checks the issuer’s signature against the relevant national trusted list, which is part of the EU List of Trusted Lists (LOTL). This check can be performed offline. Second, the verifier checks the revocation status of the attestation using status information provided by the issuer, which requires contact with the issuer’s infrastructure. Third, the verifier validates the wallet unit attestation to confirm that the presenting wallet is running on a certified wallet solution. Writing that an attestation can be verified entirely without contact with any external party is therefore not accurate.
The process follows a three-party model: an issuer (such as a government body or employer), a holder (the user and their wallet unit), and a verifier (the relying party requesting proof of identity). The issuer signs the attestation at the point of issuance using OID4VCI. The holder presents it when needed. The verifier performs the checks above to confirm the presentation is genuine and tamper-evident.
Four Large Scale Pilots ran from April 2023 to 2025 and tested exactly this flow across the EU. They involved over 350 entities across 26 Member States and generated real-world feedback on how the system performs in practice. The Architecture and Reference Framework (ARF), developed by the eIDAS Expert Group, contains the technical elaboration of the requirements set out in the implementing acts. The open-source reference implementation developed under the EU Digital Identity Wallet programme makes it possible for Member States and private parties to build compatible wallet solutions.
What data can organizations request during a wallet login?
Organizations can request only the specific attributes they need for a given interaction. The EUDI Wallet is built around the principle of selective disclosure, meaning a user can share their age without revealing their date of birth, or confirm their nationality without exposing their full address. Age verification without a date of birth can be achieved through selective disclosure of an attribute such as “age over 18,” without requiring zero-knowledge proofs. What an organization can request is governed by the purpose of the interaction, the scope registered under CIR (EU) 2025/848, and applicable regulations.
Examples of attributes that can be shared during a wallet login include:
- Name and date of birth
- Nationality or country of residence
- Age confirmation (for example, confirming someone is over 18)
- Professional qualifications or certifications
- Employment status or organizational affiliation
- Health insurance information
- Mobile driving licence details
Organizations cannot request attributes beyond the scope they have registered with their national authority. Under CIR (EU) 2025/848, a relying party must register per intended use which attributes and attestations it will request, and the wallet checks incoming requests against that registered scope. The data minimization principle under GDPR also applies. Users see exactly what is being requested before they approve it, and they can decline to share attributes that go beyond what is necessary. Approving a request in the wallet is a separate act from giving consent as a legal basis under the GDPR; a relying party must have its own GDPR legal basis for processing the data it receives.
How is EUDI Wallet login different from existing SSO and federated identity?
The key difference between EUDI Wallet login and existing single sign-on (SSO) or federated identity systems is that the wallet does not rely on a central identity provider being online to complete every transaction. With traditional SSO, a provider such as an employer’s identity platform or a social login service must confirm your identity in real time. With the EUDI Wallet, the attestation is held by the user and the issuer’s signature can be verified against the national trusted list without the issuer being contacted for that specific transaction, though revocation status and wallet unit attestation checks do require external contact.
Federated identity systems such as SAML or OpenID Connect are powerful but operate within ecosystems that require trust agreements between specific parties. A corporate SSO works inside a company. A national eID scheme works within its own country. Cross-border recognition has historically been inconsistent, which is precisely the gap that eIDAS 2.0, Regulation (EU) 2024/1183 amending Regulation (EU) 910/2014, was designed to close.
The EUDI Wallet takes a different architectural approach. Because attestations are signed at the point of issuance and verified at the point of presentation, the system is designed to work across borders and sectors. Any relying party registered under the applicable national framework can accept a wallet presentation from an EU citizen holding a certified wallet from another Member State, though sector-specific legal requirements continue to apply.
This also changes the privacy model. With federated identity, the identity provider can often observe which services a user logs in to and when. With wallet-based authentication, the issuer is not involved in the presentation transaction, so there is no central party logging your activity across services. Governance of the EUDI Wallet ecosystem is a shared responsibility distributed across the European Commission, Member States, national competent authorities, wallet providers, issuers, qualified trust service providers, and relying parties. No single central European authority operationally manages all EUDI Wallets.
Which sectors and use cases will be affected first?
The sectors that will be affected first are those already subject to strong identity verification requirements: financial services, government, healthcare, and telecommunications. These are also the sectors where the Large Scale Pilots were most active, generating the earliest real-world data on how wallet-based identity performs in practice.
The pilots tested use cases across several consortia. POTENTIAL covered government services, opening a bank account, SIM card registration, mobile driving licence, remote qualified signing, and e-prescriptions. DC4EU focused on education credentials and social security. EWC tested digital travel credentials, payments, and organisational digital identity. NOBID concentrated on payments. A second wave of pilots started in 2025: WE BUILD focuses on business wallets and payments, and APTITUDE covers travel, ticketing, vehicle registration, and payments.
The use cases most likely to reach production earliest include:
- Opening a bank account using wallet-verified identity instead of manual document checks
- Accessing government services such as tax filing, passport applications, and social security
- SIM card registration to reduce fraud for mobile network operators
- Claiming prescriptions at pharmacies using verified health attestations
- Signing contracts online with identity-linked qualified electronic signatures
- Education certification for verifying diplomas and degrees during job applications
For financial services organizations, the wallet creates a path toward more efficient identity verification in onboarding. KYC reuse across services is governed by AML regulation, not by eIDAS 2.0 itself, so the practical scope of reuse will depend on applicable AML rules. For healthcare providers, it opens the door to cross-border access to patient attestations and prescriptions, though the practical availability of specific cross-border use cases will depend on national rollout progress and applicable sector legislation in each Member State. For government agencies, it means citizens can access digital public services with a single, portable identity.
What should organizations do now to prepare for wallet-based login?
Organizations should start by auditing their current identity and authentication infrastructure to understand where wallet-based login will need to integrate. The most important immediate step is to assess which services require identity verification and how those verification flows are currently built. From there, organizations can identify where wallet integration will create the most value and where the technical gaps are.
Key preparation steps include:
- Reviewing current onboarding and authentication flows to identify where passwords and manual identity checks are still used
- Assessing compliance requirements under eIDAS 2.0 and understanding which services will be required to accept wallet-based identity
- Engaging technical teams to evaluate readiness for OID4VP and related wallet presentation protocols, including the High Assurance Interoperability Profile (HAIP)
- Reviewing the Architecture and Reference Framework and the outputs from the Large Scale Pilots
- Planning for a phased rollout that starts with the highest-value or highest-risk identity touchpoints
- Registering as a relying party with the relevant national authority under CIR (EU) 2025/848 before requesting wallet data
24 December 2026 is the legal deadline by which Member States must make EUDI Wallets available to citizens, residents, and businesses, and by which public sector bodies must accept notified wallets for online services requiring electronic identification. From 24 December 2027, Article 5f of eIDAS 2.0 requires relevant regulated private sector organizations, including those in financial services, healthcare, telecommunications, energy, transport, and related sectors, to accept the EUDI Wallet where strong user authentication is legally or contractually required. Micro and small enterprises, defined as organizations with fewer than 50 employees and an annual turnover or balance sheet total of no more than 10 million euros, are exempt. Very large online platforms are subject to a separate provision under Article 5f, which applies where the platform requires user authentication, on the user’s voluntary request, and limited to the minimum necessary data. These deadlines are legal obligations, not predicted launch dates, and certification, notification, and operational interoperability will develop in phases and may vary in maturity from country to country. Organizations in regulated sectors should treat this as an active implementation timeline. The resources available from EU institutions and pilot consortia are already substantial, and the technical specifications are mature enough to support integration planning today.
How TrustTech helps with EUDI Wallet login and authentication
The ID Connector is an integration that lets relying parties accept every certified European wallet, whatever Member State issued it, for identification, login and qualified signing. EUDI Wallet acceptance comes first; the same interface also carries other IDs, such as national eIDs, bank IDs and identity documents, inside and outside the EU.
For organizations preparing for wallet-based authentication, the ID Connector handles the technical complexity of wallet acceptance directly. This includes:
- Accepting wallet presentations from any notified EUDI Wallet, regardless of the issuing Member State
- Verifying issuer signatures against national trusted lists consolidated in the EU List of Trusted Lists
- Checking revocation status using issuer-provided status information
- Validating wallet unit attestations to confirm the presenting wallet runs on a certified wallet solution
- Enforcing the registered attribute scope so that only attributes declared in the relying party registration are requested
- Supporting qualified signing workflows through a connected qualified trust service provider
Organizations in financial services, healthcare, and government face the earliest and most concrete obligations under eIDAS 2.0. The ID Connector provides the infrastructure to meet those obligations without rebuilding existing systems from the ground up. Explore our identity solutions or get in touch to discuss your organization’s wallet integration.