mdoc / mDL Validator
Validate an ISO 18013-5 mobile document: the issuer signature, the MSO, disclosed item integrity and the chain to a demo IACA root.
Free and informational, not a qualified validation service under eIDAS. Each mode below states what happens to your input.
The DeviceResponse is sent to the Tessio verifier service, processed in memory, and not stored.
What this checks
- Parses the CBOR DeviceResponse and its single document.
- Verifies the
issuerAuthCOSE_Sign1 signature against the x5chain Document Signer certificate. - Checks the Mobile Security Object validity window.
- Recomputes each disclosed item's digest and confirms it matches the signed
valueDigests. - Anchors the Document Signer chain on the tool's demo IACA root. No national IACA roots are loaded, so a real mDL reads untrusted.
Frequently asked
What is an mdoc / mDL?
An mdoc is an ISO/IEC 18013-5 mobile document, such as a mobile driving licence (mDL), used across the EU Digital Identity Wallet. It is CBOR-encoded, and its issuer data is signed as a Mobile Security Object (MSO) by a Document Signer certificate.
Does this send my mdoc anywhere?
Yes. mdoc is CBOR and COSE binary, so decoding runs server-side. The DeviceResponse you paste is sent to the Tessio verifier service, processed in memory, and not stored.
What does it check?
The issuerAuth signature via the x5chain Document Signer certificate, the MSO validity window, the integrity of each disclosed item against the signed digests and whether the Document Signer chains to the tool's demo IACA root. That demo root is the only one trusted, so a real mDL reads untrusted.
Does it verify holder binding?
No. Device authentication binds the holder to a specific OpenID4VP session (nonce, response URI), which a paste and inspect tool does not have. This validates the issuer-signed side; holder binding is only checkable in a live presentation.