The Washington PostDemocracy Dies in Darkness

You’re going to be asked to prove your vaccination status. Here’s how to do it.

Your smartphone can help you safely carry your coronavirus vaccination record, from a simple photo snap to a secure app. Just don’t call it a ‘vaccine passport.’

What are the best ways to carry your proof of vaccination with you? Here's what we found. (Washington Post illustration; iStock)

Congratulations, you’ve been vaccinated against the coronavirus. Maybe you’ve even been boosted already. Now you have to prove it, and your smartphone can help.

Across the world, concerns about the spread of the omicron variant are leading more businesses, schools and travel destinations to require vaccination. Like it or not, there’s a real chance that somewhere you want to go will ask to see proof of your shots.

Let’s say you are planning to visit Hawaii — you’ll need to be vaccinated or show a negative coronavirus test if you want to avoid quarantine. You’ll need proof to work in the federal government, at tech firms such as Google, Facebook and Uber, and a growing list of other companies. In New York and San Francisco, you’ll need it to go inside a bar, hit the gym, or take in a show on Broadway. And starting on January 15, residents of Washington D.C. must prove they have received at least one vaccine dose to dine indoors at local restaurants and bars.

“Mandates have the ability to help people who are not vaccinated to become vaccinated, and that is a huge public health benefit,” said D.C. Mayor Muriel E. Bowser (D) when announcing the requirement in December.

Help Desk: Ask us a tech question

So, how do you do that without carrying your white card from the Centers for Disease Control and Prevention everywhere you go?

There are a growing number of ways to store your vaccination record on your smartphone, though unfortunately no be-all-end-all app or system. We’re here to make sense of how different options approach your privacy, ensure security and try to spot counterfeits.

Disney announced on July 30 all its on-site salaried and non-union hourly U.S. employees would be required to be vaccinated against the coronavirus. (Video: Reuters)

Just know this technology is still evolving, and places are making up their own rules about what they’ll accept as proof as they go along. So you still might want to carry that physical card with you when you’re headed somewhere super important.

Whether businesses or governments should ask you to prove your vaccination status is a deeply personal — and political — topic. Apps known as “vaccine passports” helped fuel a long-running debate over personal freedom vs. public health, and some places banned them before they were even developed. The first state-sponsored app, New York’s Excelsior Pass, failed to pick up wide traction last year after infection rates dropped, among other concerns.

The term vaccine passport may be out of fashion, but you still might have more digital options than you realize. Now states including California, Colorado, Delaware, Louisiana, Massachusetts, New Jersey, New York, Utah and Virginia offer portals or apps to download fully authenticated vaccination information. And millions across the United States have access to digital records directly from Walmart, CVS, Walgreens and others.

Why bother going digital? One concern is that as mandates increase, so might fraudulent paper records. A bouncer can scan an app a lot quicker than validate a paper card. An app is harder to lose than one super-valuable piece of paper that could slip out of your pocket. And digital records can also protect your privacy by passing along only the required information — thumbs up or down — instead of all the personal details on those CDC cards.

What to do if you lose our vaccine card

But there are downsides to digital, too. Some of the apps we’ve seen are made by companies for whom creating secure health passes isn’t a sole focus. Others might try to get you to pay after you start using the app. Apps that are poorly or unscrupulously written could be used to violate your privacy. (We’ve grilled each of the services we name in this guide.)

The most secure digital systems can also be complicated, raising big concerns about access. For an upcoming trip to Hawaii, the all-digital vaccine proof process required us to navigate the state’s Safe Travels website and use an additional app. If you don’t have a smartphone, you can still rely on that paper CDC record, though some experts advise carrying a laminated copy rather than the real thing.

To help you sort through the tech, we’ve laid out your options below based on how secure it is, from snapping a photo of your card to storing your record in a secure digital health wallet.

Before you go any further, though, take a moment to see if your city or state recommends using a specific app or service. New Yorkers, in fact, have multiple options: New York City’s NYC covid Safe app lets people quickly create digital versions of their physical cards to store on their phones, while the state’s Excelsior Pass and Excelsior Pass Plus look up a person’s records in a state database before generating a digital pass for them. Just be mindful of the trade-offs: while covid Safe is faster to use, Excelsior Pass is harder to fake.

Of all the services we tested, the free Clear Health Pass was the most flexible and likely the most broadly useful right now. (We just wish it didn’t come from a company that’s also in the business of selling subscriptions to get through airport security.)

We want to hear about your experiences via our Washington Post Help Desk, and we’ll update this article and investigate problems.

Keep a shot of your CDC card in your photo album

Use this: The camera in your phone, plus the Apple or Google Photos apps.

Pros: Photos are easy to take, and they’re convenient to access when needed.

Cons: Storing these images securely is easier on some phones than others.

Simple enough, right? Fire up your phone's camera, make sure your vaccine card takes up as much space on your screen as possible without cutting anything off, and snap a photo.

Even if you wind up using other digital records, it’s always nice to have a backup. That said, it usually doesn’t take long before images get buried in your phone’s camera roll, so take a moment to put those vaccine card shots in dedicated albums for super-fast access.

On iPhones: Launch the Photos app, find the picture of your vaccination card, hit the Share button in the bottom-left corner, select “Add to Album,” tap “New Album” and give it a name.

On most Android phones: Launch Google Photos, find the picture of your vaccine card, tap the three-dotted menu sign in the top-right corner, tap “Add to album,” tap “New album” and give it a name.

You could stop right there if convenience is your main concern, but remember: Those images contain your date of birth and the location of your vaccination site. A hacker might not be able to break into your accounts with just that information, but it’s just personal enough to make it easier for that person. (That also means sharing images on social media — think: vaccination selfie — isn’t a good idea.)

iPhones don’t have the ability to “lock” photos, but you can prevent snoops from finding them by using iOS’s Hidden album. And if you would prefer to keep those images as secure as possible, you could always store your vaccination card in your iPhone’s Notes app. To start, open the app, create a new note and tap the camera icon at the bottom of the screen. From there you can “scan” it — once that’s done, just tap the menu button in the top-right corner and hit the “Lock” icon that appears.

Explaining HIPAA: No, it doesn’t ban questions about your vaccination status

Help Desk readers have also had luck storing photos of their vaccination cards in iOS’s built-in Notes app. To do that, open the Notes app, and tap the button in the lower-right corner to create a new entry. Then tap the camera icon in the bottom row, followed by “Scan Documents.” Once you aim your camera at your vaccination card, your iPhone should automatically capture an image — tape “Save” and “Done” and you’re all set. (For added protection, view that note and tap the menu button in the top-right corner and select “Lock”.)

Meanwhile, many of Samsung’s Android phones include a helpful “Secure Folder” right out of the box. (You can find the full instructions here.) And Google launched a similar “locked folder” feature for its Photos app, which lets you securely store images on devices running Android 6 or newer.

Store your scanned CDC card in an app

Use this: Clear, VaxYes and Airside.

Pros: They’re fast and work in places without digital records.

Cons: It’s still mostly an honor system, and it’s hard to tell where they’ll be accepted.

Better than just keeping a snapshot, a digital record can be whipped out as needed.

The three broadly available options we looked into — VaxYes, Airside Digital Identity and Clear — have a few things in common. All three let you carry your digital vaccine cards free. They also all require you to upload images of your CDC card and government ID, and you’ll need to manually type in details about where and when you got your jabs.

VaxYes, created by a start-up called WellPay, converts your card into a fancy bar code known as a QR code. It offers different levels of “verification”: You’ll hit Level 1 just by uploading the files it asks for, which doesn’t do much to prove they’re legit. You’ll continue to achieve higher levels of verification as VaxYes continues its checks.

Airside is more straightforward and does a better job of spelling out who your selfie and ID will be shared with early on. (You can also revoke that consent at any time.) Once you give the company what it asks for, you’re given a digital version of your card that lives inside the Airside app — no scannable QR codes here.

Meanwhile, Clear offers the most comprehensive option: It uses your phone’s camera to check that you’re a living, breathing person, and makes it easy for venue staff to tell the difference between people who just scanned their paper card and people who uploaded a fully authenticated digital record. (More on that below.)

All three have potential issues. Clear is the only service we tested that works just as well on Android phones as it does on iPhones. It’s hard to tell where the proof from these apps will be accepted. VaxYes, which says it has more than 1 million users, told us it’s focusing on states such as Kansas, Texas and South Carolina. And while Clear and Airside’s health passes should pass muster anywhere your paper card does, acceptance still depends on each destination.

Download an official digital health record

Use this: CommonPass, Excelsior Pass, Clear.

Pros: It’s 100 percent verified and can help if you’ve lost your physical CDC card.

Cons: Every state and provider does it differently, and setup can be complicated.

Most states and health-care providers have databases of who has received the vaccine. Increasingly they’re opening them up to citizens so they can download a digital record — a.k.a. one that can’t be easily faked.

These records can take the form of a link to your pharmacy’s website or a QR code you download. California helped lead the way by introducing digital health records in June 2021, and now they’re available from at least seven states (and counting) as well as at Walmart, CVS and Walgreens and health-care providers using medical records from Epic and Cerner.

Once you have this digital record, though, what do you do with it? In some cases, like with the Excelsior Pass used by New York businesses, it might be enough to simply show the app with your record on it.

In other cases, you’ll need extra health verification or wallet apps such as CommonPass and Clear, which can confirm your information and store it so you can share it as needed. (Clear is unique in that it accepts either a scan of the CDC card or digital records.) Meanwhile, Apple’s iPhones gained the ability to store these certified vaccine records as of the iOS 15.1 update, which was released in October 2021.

How to add a vaccination record to your iPhone’s Wallet app

  • Pull up the QR code given to you by your state government or vaccine provider
  • Open your iPhone’s Camera app and point it at the QR code — you should see a tiny yellow pop-up labeled “Health”
  • Tap “Add to Wallet & Health”

These apps can take different approaches to security: CommonPass keeps your data on your phone, while Clear sends it to its cloud (which it says it has locked down).

We’re going to level with you: The all-digital approach can be a lot of work. Take flying to Hawaii, which last July began accepting vaccination proof as a way to avoid its quarantine. If you’re coming from California, first, you have to download your QR code record from the state website. Then you download the CommonPass app to scan your record so it can check you against Hawaii’s requirements. Then you enter a special code from the CommonPass app into Hawaii’s Safe Travel website to get verified.

The alternative is just to photograph your CDC card and upload it to Hawaii’s website. Either way, you should bring your physical card when you travel just in case there are any technical issues.

The good news: After you set up all of this once, you can access it more quickly in the future. And as the many different players smooth out links between these systems, having digital proof at hand promises to become more useful.

Help Desk: Making tech work for you

Help Desk is a destination built for readers looking to better understand and take control of the technology used in everyday life.

Take control: Sign up for The Tech Friend newsletter to get straight talk and advice on how to make your tech a force for good.

Tech tips to make your life easier: 10 tips and tricks to customize iOS 16 | 5 tips to make your gadget batteries last longer | How to get back control of a hacked social media account | How to avoid falling for and spreading misinformation online

Data and Privacy: A guide to every privacy setting you should change now. We have gone through the settings for the most popular (and problematic) services to give you recommendations. Google | Amazon | Facebook | Venmo | Apple | Android

Ask a question: Send the Help Desk your personal technology questions.