Let’s say you are planning to visit Hawaii — you’ll need to be vaccinated or show a negative coronavirus test if you want to avoid quarantine. You’ll need proof to work in the federal government, at tech firms such as Google, Facebook and Uber, and a growing list of other companies. And in New York and San Francisco, you’ll need it to go inside a bar, hit the gym, get a seat at some restaurants or take in a show on Broadway.
So, how do you do that without carrying your white card from the Centers for Disease Control and Prevention everywhere you go?
There are a growing number of ways to store your vaccination record on your smartphone, though unfortunately no be-all-end-all app or system. We’re here to make sense of how different options approach your privacy, ensure security and try to spot counterfeits.
Just know this technology is still evolving, and places are making up their own rules about what they’ll accept as proof as they go along. So you still might want to carry that physical card with you when you’re headed somewhere super important.
Whether businesses or governments should ask you to prove your vaccination status is a deeply personal — and political — topic. Apps known as “vaccine passports” helped fuel a long-running debate over personal freedom vs. public health, and some places banned them before they were even developed. The first state-sponsored app, New York’s Excelsior Pass, failed to pick up wide traction this spring after infection rates dropped, among other concerns.
The term vaccine passport may be out of fashion, but you still might have more digital options than you realize. Now states including California, Colorado, Louisiana, New Jersey, New York and Utah offer portals or apps to download fully authenticated vaccination information, and more are on the way. And millions across the United States have access to digital records directly from Walmart, CVS, Walgreens and others.
Why bother going digital? One concern is that as mandates increase, so might fraudulent paper records. A bouncer can scan an app a lot quicker than validate a paper card. An app is harder to lose than one super-valuable piece of paper that could slip out of your pocket. And digital records can also protect your privacy by passing along only the required information — thumbs up or down — instead of all the personal details on those CDC cards.
But there are downsides to digital, too. Some of the apps we’ve seen are made by companies for whom creating secure health passes isn’t a sole focus. Others might try to get you to pay after you start using the app. Apps that are poorly or unscrupulously written could be used to violate your privacy. (We’ve grilled each of the services we name in this guide.)
The most secure digital systems can also be complicated, raising big concerns about access. For an upcoming trip to Hawaii, the all-digital vaccine proof process required us to navigate two different websites and a third app. If you don’t have a smartphone, you can still rely on that paper CDC record, though some experts advise carrying a laminated copy rather than the real thing.
To help you sort through the tech, we’ve laid out your options below based on how secure it is, from snapping a photo of your card to storing your record in a secure digital health wallet.
Before you go any further, though, take a moment to see if your city or state recommends using a specific app or service. New Yorkers, in fact, have multiple options: New York City’s NYC Covid Safe app lets people quickly create digital versions of their physical cards to store on their phones, while the state’s Excelsior Pass looks up a person’s records in a state database before generating a digital pass for them. Just be mindful of the trade-offs: while Covid Safe is faster to use, Excelsior Pass is harder to fake.
Of all the services we tested, the free Clear Health Pass was the most flexible and likely the most broadly useful right now. (We just wish it didn’t come from a company that’s also in the business of selling subscriptions to get through airport security.)
We want to hear about your experiences via our Washington Post Help Desk, and we’ll update this article and investigate problems.
Keep a shot of your CDC card in your photo album
Use this: The camera in your phone, plus the Apple or Google Photos apps.
Pros: Photos are easy to take, and they’re convenient to access when needed.
Cons: Storing these images securely is easier on some phones than others.
Simple enough, right? Fire up your phone's camera, make sure your vaccine card takes up as much space on your screen as possible without cutting anything off, and snap a photo.
Even if you wind up using other digital records, it’s always nice to have a backup. That said, it usually doesn’t take long before images get buried in your phone’s camera roll, so take a moment to put those vaccine card shots in dedicated albums for super-fast access.
On iPhones: Launch the Photos app, find the picture of your vaccination card, hit the Share button in the bottom-left corner, select “Add to Album,” tap “New Album” and give it a name.
On most Android phones: Launch Google Photos, find the picture of your vaccine card, tap the three-dotted menu sign in the top-right corner, tap “Add to album,” tap “New album” and give it a name.
You could stop right there if convenience is your main concern, but remember: Those images contain your date of birth and the location of your vaccination site. A hacker might not be able to break into your accounts with just that information, but it’s just personal enough to make it easier for that person. (That also means sharing images on social media — think: vaccination selfie — isn’t a good idea.)
iPhones don’t have the ability to “lock” photos, but you can prevent snoops from finding them by using iOS’s Hidden album. And if you would prefer to keep those images as secure as possible, you could always store your vaccination card in your iPhone’s Notes app. To start, open the app, create a new note and tap the camera icon at the bottom of the screen. From there you can “scan” it — once that’s done, just tap the menu button in the top-right corner and hit the “Lock” icon that appears.
Meanwhile, many of Samsung’s Android phones include a “Secure Folder” right out of the box. (You can find the full instructions here.) And Google announced a similar “locked folder” feature for its Photos app, which should arrive on Android phones soon.
Store your scanned CDC card in an app
Pros: They’re fast and work in places without digital records.
Cons: It’s still mostly an honor system, and it’s hard to tell where they’ll be accepted.
Better than just keeping a snapshot, a digital record can be whipped out as needed.
The three broadly available options we looked into — VaxYes, Airside Digital Identity and Clear — have a few things in common. All three let you carry your digital vaccine cards free. They also all require you to upload images of your CDC card and government ID, and you’ll need to manually type in details about where and when you got your jabs.
VaxYes, created by a start-up called WellPay, converts your card into a fancy bar code known as a QR code. It offers different levels of “verification”: You’ll hit Level 1 just by uploading the files it asks for, which doesn’t do much to prove they’re legit. You’ll continue to achieve higher levels of verification as VaxYes continues its checks.
Airside is more straightforward and does a better job of spelling out who your selfie and ID will be shared with early on. (You can also revoke that consent at any time.) Once you give the company what it asks for, you’re given a digital version of your card that lives inside the Airside app — no scannable QR codes here.
Meanwhile, Clear offers the most comprehensive option: It uses your phone’s camera to check that you’re a living, breathing person, and makes it easy for venue staff to tell the difference between people who just scanned their paper card and people who uploaded a fully authenticated digital record. (More on that below.)
All three have potential issues. Clear is the only service we tested that works just as well on Android phones as it does on iPhones. It’s hard to tell where the proof from these apps will be accepted. VaxYes, which says it has more than 1 million users, told us it’s focusing on states such as Kansas, Texas and South Carolina. And while Clear and Airside’s health passes should pass muster anywhere your paper card does, acceptance still depends on each destination.
Download an official digital health record
Pros: It’s 100 percent verified and can help if you’ve lost your physical CDC card.
Cons: Every state and provider does it differently, and setup can be complicated.
Most states and health-care providers have databases of who has received the vaccine. Increasingly they’re opening them up to citizens so they can download a digital record — a.k.a. one that can’t be easily faked.
These records can take the form of a link to your pharmacy’s website or a QR code you download. California helped lead the way by introducing digital health records in June, and now they’re available from at least six states (and counting) as well as at Walmart, CVS and Walgreens and health-care providers using medical records from Epic and Cerner.
Once you have this digital record, though, what do you do with it? In some cases, like with the Excelsior Pass used by New York businesses, it might be enough to simply show the app with your record on it.
In other cases, you’ll need extra health verification or wallet apps such as CommonPass and Clear, which can confirm your information and store it so you can share it as needed. (Clear is unique in that it accepts either a scan of the CDC card or digital records.) The iPhone’s Health app will gain the ability to hold vaccination records with this fall’s iOS 15 update.
These apps can take different approaches to security: CommonPass keeps your data on your phone, while Clear sends it to its cloud (which it says it has locked down).
We’re going to level with you: The all-digital approach can be a lot of work. Take flying to Hawaii, which in July began accepting vaccination proof as a way to avoid its quarantine. If you’re coming from California, first, you have to download your QR code record from the state website. Then you download the CommonPass app to scan your record so it can check you against Hawaii’s requirements. Then you enter a special code from the CommonPass app into Hawaii’s Safe Travel website to get verified.
The alternative is just to photograph your CDC card and upload it to Hawaii’s website. Either way, you should bring your physical card when you travel just in case there are any technical issues.
The good news: After you set up all of this once, you can access it more quickly in the future. And as the many different players smooth out links between these systems, having digital proof at hand promises to become more useful.