The Swiss e-ID is safer than the ID photo you upload today

Open a bank account online in Switzerland, or prove your age to a rental platform, and you will often be asked for a photo of your ID card. Front and back, every field on it, and nobody can tell you what happens to it afterwards. The Swiss e-ID is the answer to that photo, and on most counts it is safer than the debate around it suggests.

The September 2025 vote passed with 50.39 percent, about as close as it gets. A lot of the no votes came from fear for personal data. That fear is understandable. It is mostly aimed at the wrong thing.

What data the Confederation already has on you

Article 15 of the e-ID Act lists what goes into the e-ID: official surname and given names, date of birth, sex, place of origin, place of birth, nationality, a facial image and the AHV number, plus technical fields such as the e-ID number and an expiry date.

None of it is new. The e-ID is created from the passport, ID card or foreign national’s permit you already have, and the state has held the data behind those for years. You scan the document, record a short video of your face, and the system compares both with what is already on file.

So what changes is not what is stored but where. That is the point at which the e-ID beats what we do today.

Where the e-ID lives in the swiyu wallet, and who sees where you use it

The e-ID sits in the swiyu wallet on your phone, not in a database someone could break into to take everybody’s at once. That is the big difference from the 2021 law, which would have had private companies issue it and was voted down.

When you present the e-ID, it happens between you and the verifier. The Confederation, which issued it, is not told. It runs a registry that lets verifiers check that an e-ID is genuine and not revoked, but it keeps no log of who identified themselves where.

On top of that comes what the government calls unlinkability. The wallet does not receive one e-ID but a batch of technically different ones, and each is presented only once. When they run out, new ones arrive automatically. Two shops where you proved your age cannot pool their records and work out that it was you both times.

That only covers what you do not hand over yourself. Show a verifier your name and it knows your name. And every connection produces metadata such as an IP address, which the government says openly. Unlinkable means it cannot be linked through the cryptography. It does not mean invisible.

Why the e-ID is safer than a copy of your ID

The comparison that matters is not the e-ID against nothing. It is the e-ID against the photo of your ID card already sitting with banks, landlords and online shops.

The fourth row matters most. An e-ID is bound to a key held in your phone’s hardware. I read the source of the Android wallet, which is public on GitHub, to check: the file CreateJWSKeyPairInHardwareImpl.kt generates the key pair in the Android Keystore and marks the binding as HARDWARE, and on an iPhone the Secure Enclave does the same job. Where the phone supports it, the private key never leaves the chip. Copy an e-ID and you have a file without the key that makes it valid.

Nor is it one key for everything. Every e-ID in the batch gets a key of its own, and each is shown only once. When only a fifth are left, the wallet creates new keys and fetches a new batch, which is what RefreshBatchCredentialsImpl.kt does. The card in your wallet shows everyone the same number, for years.

The fear that an e-ID gets stolen fits the ID photo better, the one that may already be sitting with several companies today.

What happens if your phone is stolen

To misuse your e-ID, someone needs your phone and has to unlock both the device and the swiyu app. That is the same barrier that already sits in front of your banking app.

Revoking it is simple: order a new e-ID. As soon as it is issued, the old one becomes invalid on whatever device it is on. While ordering, you can load the e-ID onto up to eight devices, and not afterwards. That is deliberate, because otherwise a fraudster could phish you into moving your e-ID onto their phone.

The cost of that design: a lost e-ID cannot be restored. A federal backup service was planned and was put on hold in February 2026 to save money, along with the option of keeping the e-ID in a wallet other than swiyu. Lose the phone and you order again.

What remains a real risk with the e-ID

One problem is not solved, and the government says so itself. The launch was planned for 1 December 2026. On 30 June 2026 the Federal Office of Justice postponed it, with no new date. The reason is online issuance: current AI tools can fake a face video, and malware on the phone could feed such a video to the check. The government wants to make both harder before the first real e-ID is issued.

That is where an attacker could get an e-ID in someone else’s name. And a government that would rather move the date than take that risk is, to me, the best argument for the project.

The second risk is verifiers asking for more than they need. The law only allows a request where it is necessary. Since February 2026 there is more: verifiers must register their requests and purpose in a public federal registry in advance, the wallet warns you about excessive requests, and only those with a legal basis can ask for an AHV number. The wallet blocks the rest automatically. These are announced measures, and how well they hold up only shows after launch.

All of it is being tested in public. A federal bug bounty for swiyu has run since July 2025, open to everyone since April 2026. By then twelve vulnerabilities had been found and paid for, one of them rated high. That sounds bad and is the whole point: those twelve will not be found after launch.

What this means for you

You do not need to do anything today, and you never have to take the e-ID. When it arrives, one habit is worth having: read what a verifier wants to see before you approve. The wallet shows you, and “over 18” is a different question from name, date of birth and AHV number.

If you run a business, know this: the infrastructure behind the e-ID is expected to go live in the first half of 2027, whether or not the e-ID itself is ready. From then on any organisation can issue and check its own digital credentials, such as membership cards or diplomas. Whether that replaces an ID photo in your own process is a product development question, and the same question of collecting less comes up with local AI models and Swiss data protection.