URCodes.com
Digitally Signed Biometric Barcodes
What are UR® Codes?
They may look familiar, but these QR codes contain digitally signed biometric data and enable privacy-preserving Identity Verification. UR Codes enable codeholders to prove, with high confidence, their legal identity, age, and right to access their accounts or privileges, both in-person and remotely. Because they store unique, signed face data, personal info, and legal identity data, UR Codes enable secure, low-cost, two-party identity verification at unlimited scale.
UR Codes can be used in ANY identity-related scenario and from ANY Issuing Authority (DMVs, passport issuers, schools, employers, etc.) to immutably bind Anyone's biometric data to their identity info.
 UR® Driver License
|  UR® Passport
|  UR® Business Card
|  UR® Student ID
|
UR Codes provide similar privacy-protecting biometric security to e-Passports, but without the usability/durability problems, or the exorbitant costs of scannable NFC chips. UR Codes can also store additional biometric data, along with the face data, including fingerprint data or iris data.
Encode your own Demo UR Codes Here: encode.urcodes.com
More information on UR Codes can be found here: FaceTec.com/Intro_to_UR_Codes.pdf
Additional Technical Information can be found here: dev.urcodes.com
Try the UR Code Scan + Match App
Developers - Review the Documentation and request the Encoder Software Here: dev.urcodes.com
UR Codes are generated by Issuing Authorities using secure UR Encoder software that runs inside the firewall of that Issuing Authority. Using a unique Private Encryption Key, the software cryptographically signs each UR Code, making them provably immutable with a Public Key-enabled check. Developers can find out more and request to download the Encoder Software here: dev.urcodes.com
Demo of UR Code being encoded online in the sample encoder and matched to the codeholder, and an imposter being rejected:
Face Vector |
|
Identity Data |
|
Digital Sig |
|  |
A UR Code Issuing Authority can be any organization that relying parties choose to accept as an arbiter of identity. This could be a Driver License issuer like the DMV, a passport issuer like the State Department, or a school, nonprofit, or employer. Any group, anywhere in the world, with members and the permission and authority to legally collect face images, can be a UR Code Issuing Authority.
The Issuing Authority encodes the identity information and feature vector data from the face photo of the person who is being issued the UR Code, aka the codeholder. A digital signature is then derived and also encoded. This UR Code, in universal QR format, can be scanned with any smart device or webcam.
How do UR® Codes Prove Identity?
When a UR Code contains trusted data from a Legal Identity Issuing Authority, and the digital signature is verified, it means the encoded biometric data was sourced from a face photo that is stored for that legal identity. This process is called Biometric Binding, and it is how all Photo ID documents have provided value for over 100 years.
Typically, when you use your physical document to prove your identity, another human looks at you and then looks at your document. They decide if the document appears authentic and if your face matches the face printed on the document.
UR Codes work in a similar way, but instead of a human looking at your document and deciding if it's real or not, UR Codes have a digital signature that verifies that the identity data was encoded by that Issuing Authority. Then, you match a human via a face image to the trustworthy biometric face data stored in the UR Code. Just like that, you have established that the person highly matches the trusted biometric data in the UR Code and that the PII, like the name, address, birth date, driver's license number, and any other encoded personal data, belong to that identity.
Remote Identity Verification Steps:
In remote IDV scenarios, it’s very important that the newly collected biometric face data, the image(s) that will be matched to the face data stored in the UR Code, be collected in real-time from the Live person. The process of “Liveness Detection” is critical to the security of the process, and Liveness must be established before the matching model can determine the likelihood that you are the right person.
What's inside a UR® Code?
Typical UR® Code: 61x61 Matrix
Digital Signature = 85B
Encoded Face Data = 72B
URL = Average Length ~15B
Unique URID# = 11B
URL Protocol (https://) = 8B
Encoded Date = 5B
Encoder Version = 2B
Required UR Code Bytes = ~198
Characters Available for User PII = ~123
(Name, Address, Driver License #, Passport #, Email, 2nd face data, etc.)
If fewer than 73 Characters of User PII are required, the UR® Code will be 57x57 (v10). If more storage is required it will be set to 61x61 (v11) and store up to ~123 Characters of PII.
UR® Codes - Biometric Face Verification
How are the contents of UR® Codes Validated?
Look for the UR seal in the center of the code, then scan with a smartphone camera (or a webcam running the UR Code Scanner SDK)
UR Code SDKs can contain a library of registered Public Keys from UR Issuing Authorities.
New Public Keys will be added to every new UR Code SDK library release, so updating your UR Matcher SDKs is the easiest way to ensure continual seamless Digital Signature validation.
IF a UR Code’s corresponding URL Public Key is not in the UR Matcher library, the Public Key can be retrieved from https://EncoderURL.com/UR/UR_Code_Public_Key.txt. The UR_Code_Public_Key.txt is a file that is exported by the UR Encoder Software and then hosted in the /UR/ directory on the encoder's website.
UR® Codes - Digital Signature Validation
The UR Code Encoder software uses Elliptic Curve Digital Signature Algorithms (ECDSA) to sign the contents of the UR Codes with the UR Code Issuing Authority's Private Key. The UR Code is validated against the corresponding Public Key to validate the Digital Signature. This ensures that the UR Code was generated by the owner of the Private Key corresponding to the Public Key, and ensures the contents of the UR Code have not been modified.
There are currently two curves supported for the Digital Signature embedded in UR Codes.
secp256k1 curve (the same curve used to secure Bitcoin, and referenced in NIST SP 800-186).
ed25519 curve (another curve recommended by NIST).
To learn more about these curves, please see UR Codes - Supported Curves.
It is also possible to support different curve types based on security opinions. However, most curves generate larger Digital Signatures, which could make the UR Code unusable due to the size of the code matrix required.
Try the UR Code Scan + Match App
Developers - Review the Documentation and request the Encoder Software Here: dev.urcodes.com
Frequently Asked Questions:
Who can Scan & Match UR® Codes?
ANY organization, Government, Private Sector, for-profit or not-for-profit, and even any individual can scan and match almost any 2D Face Photo UR Codes. All required software is included in the UR Code Scan/Match SDK and is free to use, unlimited, even in commercial applications.
Who can Issue UR® Codes?
A UR Code Issuing Authority can be any organization that relying parties choose to accept as arbiters of identity for their purposes. Any group, anywhere in the world, with members and the permission and legal authority to collect face images and publish the face data, can be a UR Code Issuing Authority. This could range from a Driver License issuer like the DMV, a passport issuer like the State Department, or to a school, nonprofit, or employer.
Where can UR® Codes Be Printed or Displayed?
Legal Identity Document Issuers can print UR Codes on the back of Photo IDs or use adhesive stickers to add UR Codes to Passport pages.
 |  |
UR Codes can also be shown on screens, which enables any image file to store the data necessary for you to prove your Legal Identity. Any digital storage method for Identity is also supported, such as mobile Driver License or Identity wallet. Adding UR Codes removes the dependency on NFC, OCR, and IDV tech that requires guessing if identity information is authentic.
How are UR® Codes used with Multiple Faces?
UR® Codes can store enough data so that multiple people can have their faces encoded, and it can be digitally signed. This allows the biometric binding to join multiple people together, such as business partners, married spouses, parents & children, and many other joint custody and ownership scenarios.
 |  |  |  |  |
How are UR® Codes used to prove Age?
Issuing Authorities can encode age data, such as birth date, birth month & year, or years of age at the time of encoding, along with trusted face data. During the digital signing process, that data is fused together, and a UR Code is generated, which will allow the codeholder to prove their age to relying parties who trust the Issuing Authority of that UR Code.
Can UR® Codes store the face data of children?
Face data from photos of children over the age of 5 can be be encoded in most cases. The face data encoded cannot be reconstituted back into a human-viewable face photo, so the face data stored is privacy preserving. Terms of Use of UR Codes require the legal approval of a parent or guardian of the child. All Local laws regarding the biometric data collection and storage of Minors must be followed by UR Encoders and Scanners/Matchers per the Terms and Conditions.
Why UR® Codes will be the global standard for Remote IDV
FaceTec is providing the tech for the UR Code platform, and FaceTec has had over 1.8 billion installations of the FaceTec Device SDKs. Within just a few months, all of those installed SDKs will natively support UR Codes and will be able to both scan a UR Code and Verify the Live individual presenting it.
FaceTec currently has over 110 Distribution partners in over 50 countries, and each will be empowered to share the UR Code technology with the identity issuing authorities in their regions.
Besides having a huge installed base of native Apps and universal scannability to verify in web/mobile browsers, FaceTec is shipping all UR Code dedicated SDKs/libraries with FaceTec’s best 2D face encoding/matching algorithms. There is no cost to use the face-matching AI models, and any liveness check can be performed, not just a FaceTec Liveness check. Any liveness check that the relying party wants to trust can be employed, and any 2D photo collected can be matched to the face data encoded in the UR Code, and therefore: no vendor lock-in to FaceTec.
Why don’t UR® Codes have any costs for Encoding* or Matching?
Cost and evergreen access and perpetual licensing are also important factors that will lead to the global standardization of UR Codes for remote and in-person IDV.
UR Code Face Matcher Software is free to use for all relying parties, no matter the organization's mission. For-profit, not-for-profit, state or federal government agencies, etc, can all use the UR Code Matcher software for free forever, subject to compliance with the Terms of Use.
UR Code Encoder software will always be free to use, unlimited for Government / Not-for-profit issuing authorities, schools, humanitarian organizations, etc. Only commercial entities will need to have a minimal commercial agreement with FaceTec in place to encode UR Codes.
How accurate is the Free Face Matching Model in the UR® Code Matcher software?
UR Codes can be matched to any 2D Photo of sufficient size and face pose. ICAO compliant photos will achieve 2D:2D encoding:matching of 1/100,000 FAR @ <1% FRR.
UR Codes can also be encoded with data from FaceTec’s proprietary 3D FaceMaps and achieve even higher accuracy levels when matched to either 2D photos and 3D FaceMaps. (Fees may apply)
*Commercial for-profit entities must have a minimal commercial agreement to encode UR Codes, but most will not need to do that, and will only need to use the free matching software.
Why UR® Codes Don’t Require Vendor Lock-in.
ANY organization, Government, Private Sector, for-profit or nonprofit, and even any individual can scan and match to any 2D face photo UR Code with a 2D face photo. All required software is included in the UR Code Scan+Match SDKs, which are free to use, unlimited, even in commercial applications (as long as the end user or relying party is not being charged).
There is no cost to use the face-matching models (provided free by FaceTec), and any type of liveness check can be performed, not just a FaceTec 3D Liveness Check. Any liveness check that the relying party chooses to trust can be used, and that 2D face photo can be matched to the face data encoded in the UR Code. There is no vendor lock-in to FaceTec.
Can UR® Codes Be Revoked by the Issuing Authority?
Yes, UR Codes that have associated privileges, such as Driver Licenses and Passports, or UR Codes with identity data that has been legally changed (by marriage, for example) can be revoked by the Issuing Authority.
The process requires the Relying Party to check the URID # in the UR Code against the Issuing Authority's Revocation list, which can be done at the same time as and on the same URL as retrieving the Public Key for Digital Signature validation. The UR Code Matcher software can be configured to scan the Issuing Authority URL under /UR/Revoked_URIDs.txt, and if the URID is present on the list, then the Issuing AUthority has revoked the UR Code associated with that URID #.
Privacy is preserved by the Revocation List method because the presence of the URID # on the Revocation list is used to determine if the UR Code has been revoked, not the legal name or permanent ID number.
Revoked lists can be used in conjunction with Expiration Dates to limit the need for expired UR Codes to be listed in the URID Revocation List.
Revocation Lists can be used to remove the privileges assigned to the identity that was issued the UR Code, but the ability to scan and match the face to the UR Code for identification purposes remains intact. More information can be found at dev.urcodes.com/ur-codes-security#revocation-lists
When will the UR® Code Matcher & Encoder Software be Available?
You can encode your own UR Code Demos now at: encode.urcodes.com
These demo UR Codes open to UR.co when scanned, and perform 3D Liveness + 3D:2D face match.
After Sept, 2024, the FaceTec Server SDK includes v1 APIs that enable UR Encoding.
Native support for UR Codes is currently being added to the FaceTec Device SDKs.
Standalone Software Packages:
In Q1 2025, the Standalone UR Code Encoder software will be released with Free perpetual licenses for Identity Issuers, Nonprofits, and similar Not-for-Profits. Commercial entities who are contracted to Encoder UR Codes on behalf of a Government Identity Issuers, Nonprofits, and similar Not-for-Profits, can also receive a free perpetual license for the UR Encoder software to use on behalf on the non-commercial entity. (Commercial entities will need a basic partnership relationship with FaceTec to encode UR Codes for commercial applications)
In Q1 2025, the standalone UR Code Scan + Match SDKs will be released with FREE, perpetual licenses for Identity Issuers, Nonprofits, and commercial entities.
Technical information is available here: https://dev.urcodes.com
Do UR® Codes Replace mDL & Identity Wallets?
In most cases, no, because UR Codes still must be shown or stored on or in a document or wallet. However, UR Codes can be displayed via digital identification Apps like mobile driver licenses (mDL) and digital wallets. Since UR Codes are free to encode for Identity Issuers, data minimization, and selective disclosure are possible via multiple UR Codes for a single individual. This means that a person sharing just what is seen on their device’s screen can share reduced levels of data with different UR Codes.
 |  |
The UR Code Matcher software allows a relying party to scan a UR Code displayed on a physical document, an mDL (in-person & remotely) shown on the screen of another device, or even just an image of an mDL, or a physical ID Document, should they be printed with UR Codes & Face Photos.
Is an Internet Connection required to scan UR® Codes?
Remote IDV requires an internet connection, but in-person presentation & matching of a codeholder to their UR Code can be performed completely offline if the agent scanning the UR Code is trusted. If no strong Liveness check is required because a present human agent will oversee the process, the offline face matching can be performed without a connection to the internet.
UR® Code Contents & Specs:
Scope: Cryptographically Signed Biometric 2D Barcodes
Functional Requirements: Smart Devices & Webcam Native, Opens URL, 2-Party IDV
Tech Requirements: ISO/IEC 18004:2015 - QR Code barcode symbology specification
Dimensions & Print Quality: ¾” x ¾” or 2cm x 2cm @ 300 DPI
Error Correction %: Scanning resilient to up to 7% of data loss.
Character Sets: Latin-1 - Alphanumeric + Special Characters
Face Matching Accuracy: 2D:2D = 1/100,000 FAR 3D:2D = 1/2,000,000 FAR 3D:3D = 1/125m
Face Matching Algorithms: FaceTec: 2D:2D, 3D:2D, & 3D:3D NN Models
Barcode Print Area: AAMVA DL/ID:2020 - Annex A, A.7.6 Zone 4 a/o 5
Security Features: Digital Signature validation with Public Key
Vendor Lock-In: No, supports all 2D face images & universal QR scanners
Developers - Review the Documentation and request the Encoder Software Here: dev.urcodes.com
Questions or Comments? Contact FaceTec
- Numerous Patents Pending -
“FACETEC” is a trademark of FaceTec, Inc. and is registered in the United States.
“UR” is a trademark of FaceTec, Inc. and is registered in the European Union and United Kingdom.