Introduction to UR Codes

Learn about UR Codes and how they can be used for safe, secure, and low-cost Two-Party Remote Identity Verification at scale.

What are UR Codes?

They may look familiar, but these QR codes contain digitally signed, biometric data and enable privacy-preserving Identity Verification. UR Codes allow codeholders to prove, with high confidence, their legal identity, age, and right to access their accounts or privileges, both in-person and remotely. Because they store unique, signed face data, personal info, and legal identity data, UR Codes enable secure, low-cost, two-party identity verification at unlimited scale.

UR Codes can be used in ANY identity-related scenario and from ANY Issuing Authority (DMVs, passport issuers, schools, employers, etc.) to immutably bind Anyone to their Identity Data.

UR® Driver License	UR® Passport	UR® Business Card	UR® Student ID

UR Codes provide privacy-protecting, biometric security similar to e-Passports, but without the usability/durability problems or the exorbitant costs associated with scannable NFC chips. For more information on UR Codes, please see the FaceTec PDF Intro to UR Codes.

When a UR Code contains trusted data from a Legal Identity Issuing Authority, and the digital signature is verified, it means the trusted biometric data is bound to the legal identity. This process is called Biometric Binding, and it is why Photo IDs have existed for nearly 100 years. 

Typically, when your Identity is verified using your Physical Identity Document, another human looks at you and then looks at your document. They decide if the document looks legitimate, and if you match the face on the document. UR Codes work the same way, but instead of a human looking at your document and deciding if it is real or not, UR Codes have a digital signature that verifies that the Identity Data was issued, as encoded, by the listed Issuing Authority. 

Then, all you need to do is match your live 3D face, via a selfie, to the trustworthy biometric data that is in the UR Code, and just like that, you have established that you match the biometric data in the UR Code, and the Identity Data, like the name, address, birth date, driver license number, and any other data personal to you, belongs to you.
 

It is important that the newly collected biometric face data, the data that is going to be matched against the trusted face data previously stored in the UR Code, be collected from a Live Human User and that there is a very high degree of confidence it was collected in real-time from the Live Person. The process of “Liveness Detection” is critical to the security of the process, and Liveness must be established before the matching model can determine the likelihood that you are the right person.

How are UR Codes Created?

UR Codes are generated by Issuing Authorities using secure encoding software that runs inside the firewall of those Issuing Authorities. Using a unique Public/Private Encryption Key pair, the software cryptographically signs each UR Code, making them provably immutable.

An Issuing Authority can be any organization that Relying Parties choose to accept Identity Data from. Ex. The DMV, the State Department, a School, or a Non-Profit.

The Issuing Authority provides the identity information and the face photo of the person being issued the UR Code. A Digital Signature is derived and added to the data that is then encoded in the UR Code. This code can now be scanned with any smart device or webcam.

How are UR Codes Validated?

Look for the UR seal in the center of the code, then scan with a smartphone camera (or a webcam using the UR Code Scan+Match App or the UR Code Scan+Match SDK).

UR Codes contain a digital signature that can be used to verify the contents of a UR Code and to confirm that the UR Code originated from the appropriate Issuing Authority.

The Public Key for verifying the Digital Signature is hosted on the Issuing Authority's Website. For more information, please see the Public Key Distribution Guide.
 

UR Codes for Proving Age

Issuing Authorities can encode age data, such as birth date, birth month & year, or years of age at the time of encoding, along with trusted face data. During the Digital Signing Process, that data is fused together, and a UR Code is generated, which allows the codeholder to prove their age to Relying Parties who trust the Issuing Authority of that UR Code.

Offline UR Code Verification

Offline Functionality is available in the UR Code Scan+Match App. The UR Code Scan+Match App has its own QR and UR Code Libraries, as well as its own Public Key for UR Codes generated with the FaceTec UR Code Generator App. By using these resources, the UR Code Scan+Match App can operate in an offline capacity.

UR Codes Advantages vs. Legacy KYC?

For over a decade, online identity verification (IDV) has required users to upload a photo of their ID card or take a picture with their camera. Their sensitive, personally identifiable information (PII) usually goes to a third-party, Know-Your-Customer (KYC) service that literally guesses about the document's authenticity. This scheme is not suitable for the post-Gen AI world, and users, identity issuers, and relying parties are in dire need of a real long-term solution. Previously, the most notable attempt to address identity security has been the biometric e-Passport NFC chip, released in 2005. While secure, they are not widely used in typical ID documents because of usability and durability issues, as well as prohibitively high costs.

UR Codes store digitally signed, immutable face data and biometrically bind the codeholder to their identity data, while also being scannable by everyday devices. This privacy-protecting, biometric security technology empowers secure, two-party remote identity verification at infinite scale.