mdoc / mDL Validator
Validate an ISO 18013-5 mobile document: the issuer signature, the MSO, disclosed-item integrity, and IACA trust.
Free and informational, and not a qualified validation service under eIDAS. Each mode below states what happens to your input.
The DeviceResponse is sent to the Tessio verifier service, processed in memory, and not stored.
What this checks
- Parses the CBOR DeviceResponse and its single document.
- Verifies the
issuerAuthCOSE_Sign1 signature against the x5chain Document Signer certificate. - Checks the Mobile Security Object validity window.
- Recomputes each disclosed item's digest and confirms it matches the signed
valueDigests. - Anchors the Document Signer chain on a trusted IACA root.
Frequently asked
What is an mdoc / mDL?
An mdoc is an ISO/IEC 18013-5 mobile document, such as a mobile driving licence (mDL), used across the EU Digital Identity Wallet. It is CBOR-encoded, and its issuer data is signed as a Mobile Security Object (MSO) by a Document Signer certificate.
Does this send my mdoc anywhere?
Yes. mdoc is CBOR and COSE binary, so decoding runs server-side. The DeviceResponse you paste is sent to the Tessio verifier service, processed in memory, and not stored.
What does it check?
The issuerAuth signature via the x5chain Document Signer certificate, the MSO validity window, the integrity of each disclosed item against the signed digests, and whether the Document Signer chains to a trusted IACA root.
Does it verify holder binding?
No. Device authentication binds the holder to a specific OpenID4VP session (nonce, response URI), which a paste-and-inspect tool does not have. This validates the issuer-signed side and issuer trust; holder binding is only checkable in a live presentation.