At the height of the COVID-19 pandemic, Portugal needed a fast, reliable solution for validating health certificates. Caixa Mágica Software, commissioned by INCM (Imprensa Nacional-Casa da Moeda), developed the official Portuguese Covid Pass App. The application allowed airlines, event organisers, employers, and venue operators to verify vaccination, recovery, and testing status in real time. Downloaded by over one million users, the Covid Pass App became a critical piece of Portugal’s public health infrastructure during one of the most demanding periods in the country’s recent history.
The Covid Pass App Challenge
An Urgent Public Health Need
With the emergence of the COVID-19 pandemic, a pressing need arose for a tool that could quickly and reliably validate the health certificates being issued by clinics, hospitals and national health authorities. Airlines needed to verify passenger status before boarding. Organisers of cultural events, corporate gatherings, sports competitions and family celebrations, such as weddings and baptisms, required a simple, standardised way to confirm that attendees had been vaccinated, had recovered from infection or had tested negative before entry.
Before the Covid Pass App existed, certificate validation was largely manual, inconsistent and vulnerable to fraud. Paper certificates could be falsified. Digital certificates from different sources used different formats. There was no single, authoritative tool that event staff, security personnel or transport operators could trust to give them a definitive answer in seconds.
Extreme Timeline and High Criticality
Beyond the functional challenge, the Covid Pass project was defined by its constraints. Specifically, the timeline for delivery was extremely compressed, the application had to be ready for public use within weeks, not months. Moreover, the stakes were extraordinarily high. An application bug, a validation error or a security vulnerability would not merely inconvenience users; it could undermine public trust in the entire certificate validation system at a moment when that trust was essential to Portugal’s pandemic response.
Furthermore, the application had to work reliably across an enormous range of devices, from high-end smartphones to the oldest, most limited Android handsets still in common use across the Portuguese population. Excluding low-end devices was not an option for a public health tool intended for the entire country.
How the Covid Pass App Works
Design Principles
Caixa Mágica Software approached the Covid Pass App with a clear set of design priorities. First, simplicity: the application had to be usable by anyone, regardless of technical ability, with minimal training. Second, reliability: certificate validation had to be accurate, consistent and fast. Third, privacy: under the General Data Protection Regulation (GDPR), storing users’ health data was not permissible. Therefore, the application had to validate certificates without retaining any personal information.
These three principles, simplicity, reliability and privacy by design, shaped every decision in the development process.
Application Architecture
Caixa Mágica developed native applications for both Android and iOS, ensuring optimal performance across both major mobile platforms. Rather than building a single cross-platform application, the team chose native development to guarantee the best possible performance and reliability on each platform’s specific hardware and operating system characteristics.
The application is user-friendly, consisting of an onboarding process, a QR code scanner, a certificate validation screen, and a screen displaying application updates. Upon entering the application, the user would always go through the onboarding process, which explained how the app works and how to validate certificates. This onboarding could be revisited at any time, making it easy to get help while using the app.
User Experience
When opening the Covid Pass App, every user encountered a structured onboarding process. This onboarding explained clearly how the application worked and how to validate certificates correctly. Importantly, users could revisit this onboarding at any time if they had questions during use, a deliberate design decision to support less technically confident users.
The core validation flow was straightforward. A validator opened the app, pointed their phone camera at the certificate’s QR code and received an immediate result. A green stamp indicated a valid certificate. A red stamp indicated an invalid one. Additional information, the type of certificate, its issuer and its validity period was displayed alongside the result, giving validators the context they needed to make informed decisions.
Additionally, the application included a practical accessibility feature: the ability to activate the device’s flashlight directly within the app. This enabled validators to scan certificates in low-light conditions, an essential capability for concert venues, evening events and poorly lit spaces where QR code scanning would otherwise be unreliable.
Certificate Validation Technology
The technical foundation of the Covid Pass App was the EU Digital COVID Certificate (EU DCC) standard. A cryptographic certificate format standardised across all 27 European Union member states. Under this standard, each certificate was digitally signed by the issuing national health authority, using asymmetric cryptography. Validation therefore required the app to verify the certificate’s digital signature against a set of trusted public keys.
Caixa Mágica integrated the app with the EU DCC trust infrastructure, which maintained an up-to-date registry of trusted signing keys from all participating EU member states. As a result, the app could validate not only Portuguese certificates but also those issued by any EU country, essential for Portugal’s tourism industry and international travel connections.
Privacy by Design
One of the most important technical and legal constraints on the Covid Pass App was the requirement to comply fully with GDPR. Under European data protection law, health data is classified as a special category of personal data subject to the strictest protections. Storing health certificate data, even temporarily, would have required explicit consent, data processing agreements and significant legal overhead.
Instead, Caixa Mágica implemented a privacy-by-design approach in which no health data was ever stored on the device or transmitted to any server. Each validation was stateless: the certificate was scanned, verified cryptographically and the result displayed, after which no record of the transaction was retained. This approach not only ensured GDPR compliance but also simplified the application significantly, contributing to its speed and reliability.
Covid Pass App: Impact and Results
National Deployment
The Covid Pass App was deployed as the official national validation tool for Portugal, covering the entire country from its launch. Airlines operating from Portuguese airports integrated it into their check-in procedures. Sports venues, concert halls, restaurants and corporate campuses adopted it as their standard validation tool. Government institutions used it for access control at public buildings.
Over one million users downloaded the application, a remarkable figure for a country of ten million people and a testament to both the scale of deployment and the trust placed in the tool by organisations across Portugal. Validators ranged from airline check-in staff and event security personnel to restaurant managers and hospital administrators.
Overcoming the Timeline Challenge
Perhaps the most significant achievement of the Covid Pass project was delivering a reliable, secure, nationally deployed application within an extremely compressed timeframe. Caixa Mágica’s ability to move from brief to production-ready application in weeks, while maintaining the quality and security standards required for a national public health tool, demonstrated the agility and technical depth that defines the company’s approach to critical software delivery.
This experience also underscored the value of Caixa Mágica’s prior work on national digital infrastructure, particularly the Citizen Card Middleware. The cryptographic expertise, government integration experience and understanding of Portuguese digital identity infrastructure that the team had developed over years of middleware work translated directly into the capability to deliver the Covid Pass App at speed and at scale.
Future Prospects
Although the Covid Pass App was developed in response to the specific circumstances of the COVID-19 pandemic, its underlying architecture — cryptographic certificate validation, privacy-by-design, EU standards compliance has broader applicability. Specifically, the technology demonstrates a viable model for certificate validation in any context where trusted, privacy-compliant verification of credentials is required. As a result, the project has opened discussions around future applications in healthcare, professional credentials and event access management.
