How Mobile Driver's Licenses Turn Your Phone's QR Code Into an ID

What it is

A mobile driver's license (mDL) QR code isn't a data file you can screenshot or copy. It's a one-time connection token. Scanning it opens an encrypted session between your phone and a verifier's reader, and your identity information only moves after that session is authenticated. There's no personal data in the QR code itself — it just tells the two devices how to start talking securely.

That's a different job than the QR codes you scan for a restaurant menu or Wi-Fi network, which just encode a static link. Below: how the mDL handshake actually works, where you'll run into it through 2026, and how it differs from the codes you create and scan every day.

How it actually works

The QR code is the handshake, not the data. On a screen without an NFC chip, the verifier displays a QR code and your phone scans it to kick off device engagement — an exchange that sets up connection parameters, not identity fields. Your license data flows over a separate encrypted channel only after that setup completes. Where a reader has NFC hardware, the same handshake happens over a tap instead. See our NFC vs. QR code breakdown for when each gets used.

Public-key signatures do the heavy lifting here, replacing "does this photo look real" with something you can actually verify. Your state DMV signs your credential with a private key that lives in your phone's secure hardware and never leaves it. A verifier checks that signature against the state's public key, cryptographically confirming the license is genuine and unaltered — something a photo can't prove, no matter how good the camera is. A Mobile Security Object then lets a reader confirm just the requested fields are untampered without decrypting your whole record.

Selective disclosure and biometric gating tie it together. Your wallet only releases the fields a verifier requested — a bar can get a yes/no on "over 21" without learning your address. Every presentation requires a face or fingerprint unlock first, and session-binding checks block replay attacks that reuse an intercepted exchange against a different reader.

None of this works across state lines without a shared standard. ISO/IEC 18013-5, approved in 2021, lets a credential from one state work at a reader built by a different vendor in another — Apple Wallet and Android's Jetpack both support it natively. A few early non-US implementations predate the standard and stay domestic-only, so a QR code alone doesn't guarantee interoperability.

Where you'll see it

TSA checkpoints are the single biggest driver of adoption. More than 20 states plus Puerto Rico now run mDL programs accepted at airport security, and enrollment is climbing fast — New York alone has logged over 200,000 Mobile ID sign-ups.

California shows how fast this is moving. Governor Newsom signed SB 169 in July 2026, quadrupling the cap on the state's Mobile Driver License Pilot Program from 15% to 60% of licensed drivers after 3.5 million residents had already applied under the old cap. Banks are a secondary use case, pushed along by "know your customer" rules and rising deepfake-based fraud.

Worth a quick disambiguation: many physical IDs and boarding passes already use PDF417, a different 2D barcode format, for their printed barcodes. An mDL QR code and that printed barcode solve different problems — don't confuse the two.

Tips, gotchas, and a quick how-to with QRDock

Before you scan any QR code claiming to be an "ID verification" prompt outside an official kiosk or app, don't assume it behaves like an mDL handshake. Most everyday QR codes — menus, Wi-Fi logins, event tickets — are static links with zero cryptographic protection, and phishing scams increasingly borrow "verify your identity" language to look official.

That's the gap QRDock is built to close for everyday scanning: it checks a QR code's destination for phishing risk before you open it, without logging what you scan. Curious about the broader privacy angle? See our guide to picking a QR scanner that doesn't track you.

One concrete next step: if your state offers a mobile driver's license, it lives in your state's dedicated app or in Apple Wallet, Google Wallet, or Samsung Wallet — not in a general-purpose scanner like QRDock, built for the codes you create and scan every day, not for issuing government-backed credentials.

Frequently Asked Questions

Does the QR code on a mobile driver's license contain my personal information?

No. It only carries connection parameters for an encrypted session — your name, birth date, and photo aren't in the visible pattern. Data moves only after you approve it with a face or fingerprint scan.

What's the difference between an mDL QR code and just showing a photo of my ID?

A photo is a static image anyone can screenshot or edit. An mDL QR code triggers a cryptographic handshake, checking a digital signature from your DMV that confirms the credential is genuine — something a photo can never prove.

Can a verifier see my full driver's license through the QR code?

Only if you approve it. Selective disclosure lets your wallet release just one field — like a yes/no on being over 21 — without your address or license number. ISO/IEC 18013-5 wallets support this by design.

Which states support mobile driver's licenses in 2026?

More than 20 US states plus Puerto Rico now run mDL programs accepted at TSA checkpoints, with California, Colorado, New York, and Virginia among the highest-enrollment states and North Carolina's launch expected by year end.

Do I need a special app to scan someone else's mobile driver's license?

Depends on context. TSA and law enforcement use dedicated ISO/IEC 18013-5 reader hardware; for everyday age checks, businesses typically use a verified reader app rather than a generic QR scanner.

Conclusion

The QR code on a mobile driver's license is a secure handshake trigger, not a data container — the real security lives in signed credentials, selective disclosure, and biometric gating underneath it. As more states cross into TSA-accepted status through 2026, expect this same pattern to keep spreading to passports and other government-issued credentials next.