vacdec

Python script to decode the EU Covid-19 vaccine certificate, as specified by the EU.

This script takes an image with a QR code of a vaccine certificate as the parameter and will show the certificate's content. It will not validate the signature.

A fork of this script with signature verification exists.

The code is very short and should provide an easy way to understand how these certificates are encoded:

• The QR code encodes a string starting with "HC1:".
• The string following "HC1:" is base45 encoded.
• Decoding the base45 leads to zlib-compressed data.
• Decompression leads to a CBOR Web Token structure.

setup

You will need the python pillow, pyzbar, cbor2 and base45 packages. Additionally, you need zbar. For Mac OS X, it can be installed via brew install zbar, on Debian systems via apt install libzbar0. Source If you want to install cbor2 on Windows, you might get an error that you need the Microsoft Visual C++ Extension installed. This is only required if you want to have the cbor2 optional C extension installed. You can skip it by setting the environment variable CBOR2_BUILD_C_EXTENSION=0 before installing it via pip.

You can install them via your distribution or via pip:

pip install base45 cbor2 pillow pyzbar

usage

Run:

./vacdec [image]

[image] can be an image in any format pillow supports, including of course PNG and JPG.

A test certificate can be found here.

author

Written by Hanno Böck.