nav: home_link: "/" home_text: IRMA usage_link: "#usage" usage_text: Usage explanation_link: "#explanation" explanation_text: Explanation faq_link: "#faqs" faq_text: FAQs start_link: "/irma-start" start_text: Integrate IRMA links_link: "#links" links_text: Links banner: headline: Choose IRMA
Put a digital passport on your own mobile ios: IRMA for iOS ios_url: https://apps.apple.com/nl/app/irma-authenticatie/id1294092994 android: IRMA for Android android_url: https://play.google.com/store/apps/details?id=org.irmacard.cardemu product_shot_src: "/uploads/non-free/screenshot-en.png" product_shot_alt: Product Shot usage: id: usage login_headline: Logging in login_alt: Login login_content: With IRMA it is easy to log in and make yourself known, by disclosing only relevant attributes of yourself. For instance, in order to watch a certain movie online, you prove that you are older than 16, and nothing else. sign_headline: Signing digitally sign_alt: Signing sign_content: With IRMA you can also sign documents digitally. You use only relevant attributes of yourselves in a digital stamp. In this way you can sign with IRMA as a medical doctor, or as citizen, or in some other role. trust_headline: Certainty trust_alt: Certainty trust_content: Data in IRMA come from trusted sources and are cryptographically protected. Thus, the attributes that you disclose to make yourself known are genuine and are really about you. slogan: id: start heading: With IRMA your data lies in your hands. explanation: id: explanation getstarted_headline: Get started with IRMA getstarted_alt: Get started with IRMA getstarted_content: Everyone can freely download the IRMA app (Android and iOS) and fill it with their own data. For instance, store your email address and possibly mobile number as attribute in your IRMA app. At municipalities in The Netherlands you can log in and collect basic attributes (name, address etc) about yourself. With such attributes people can make him/herself known online. tool_headline: IRMA is a means, not a goal in itself tool_alt: IRMA is a means, not a goal tool_content: Having to use many passwords is a hassle for everyone. Yet, websites need to know who they are dealing with. IRMA provides certainty. With IRMA you can do what you wish to do online, with ease and certainty. For instance, watching or buying a movie. usecases_headline: What can I do with it now? usecases_alt: What can I do with it now? usecases_content: Websites are now appearing where users can log in with IRMA (visit https://privacybydesign.foundation/usage/ for an overview). IRMA-meet offers video calling with certainty about who you are talking to. In The Netherlands, medical doctors log in to access patient files at the website helder. In local government and healthcare in particular, IRMA usage is growing. In order to get an impression of possibilities, you can try out some IRMA demos yourself. faq: id: faqs headline: Frequently asked questions and answers item1: question: How do I use IRMA to log in on a website? answer: Websites that support IRMA typically have a button that says Log in with IRMA. If you don't have the IRMA app on your phone yet, you will have to install it first and fill it with your attributes. If you do have the IRMA app already, there two different situations:
It may happen that you haven't collected yet the attributes that the website requests. In that case, you first have to load them before you can log in. item2: question: I live outside the Netherlands; can I still use IRMA? answer: The IRMA app is available internationally, but only a few attributes are available globally, namely email and some data from social media (which are not very reliable). The real challenge for your country is to organise interesting local sources of attributes that wish to issue data to IRMA apps. The Privacy by Design Foundation has concentrated so far on The Netherlands, where it has organised connections of IRMA to instance the government's national citizen administration, but also to medical and academic registers. Similar connections need to be organised in other countries, in order to make IRMA really useful there. Local help and support is needed for this. So do join the effort and help out, if you are interested.

Another issue is that the IRMA app itself (and its documentation) is available so far only in English and in Dutch. Since the source code for the IRMA app is available online, volunteers from other countries can contribute by translating the relevant texts into their own language.

You can see how IRMA is used around the world on the online dashboard. item3: question: Which attributes can I load into my IRMA app, now and later? answer: You can load your email address where-ever you are in the world. You can also load attributes from some social media accounts. When you have European mobile phone registration, you can also get your mobile phone number as IRMA attribute. In the Netherlands you can obtain more attributes, for instance from municipalities, like name, address, date of birth, citizen registration number ("BSN"), but also age limits like whether you are older than 18 or 65. Students and staff can add their academic registration. Health care professionals can add their professional registration ("AGB"). With these attributes people can make themselves known in many situations.

It is expected that many other attribute sources will join the IRMA ecosystem, for users in general, but also for special groups of individuals. item4: question: Can I install IRMA on a second phone or tablet? answer: Certainly, on every separate (Android and iOS) device you can open a separate IRMA account and fill it with your attributes. It might even be wise to do so, since if you loose one device, you can still use the other one to log in. item5: question: In which sense is IRMA privacy-friendly and secure? answer: Your personal attributes are stored exclusively in the IRMA app on your phone and nowhere else. They are protected via the PIN of the IRMA app. You disclose only those attributes that are relevant and required in a particular situation (data minimalisation, as required by the General Data Protection Regulation). For instance, in order to get a certain discount, you may have to prove that you are a student; with IRMA you can do so without disclosing your name or your field of study.

Your attributes in the IRMA app are digitally signed by the source (issuer) of these attributes. A website receiving attributes can cryptographically check that they are authentic (really coming from the source). This exchange of personal attributes happens directly, between your phone and the website. No-one else can register that you make yourself known there. This is completely different from the (privacy-unfriendly) login mechanism of Facebook (and others), used for instance at an online store. In that case the data exchange happens differently: you first have to log in at Facebook, and then Facebook tells the store who you are. In this way Facebook can build up detailed profiles of who logs in where and when. item6: question: Where are my IRMA attributes stored? answer: The attributes about yourself that you collect in the IRMA app on your phone are stored in the IRMA app only, and nowhere else. In particular, they are not stored somewhere in the cloud. When you remove attributes from your IRMA app, they are really gone. You are asked to give permission explicitly before any of these attributes in your phone are disclosed, from the app to a website. item7: question: For how long are IRMA attributes valid, and how can I refresh them? answer: Within the IRMA app you can see on each card with attributes when they expire. The validity period depends on the stability of the attributes at hand. For instance, in The Netherlands, your name and date-of-birth attributes are valid for five years, whereas your address attribute is valid for only one year. The issuer (source) of attributes decides about expiry times. The validity of IRMA attributes may thus run out. The app warns you about this. You can always renew (refresh) them, even without warning, by reloading them from the source, just like you did the first time. For instance, after your 18th birthday you can renew your attributes from your (Dutch) municipality and then obtain an older-than-18 attribute. item8: question: What should I do when I buy a new phone? answer: On a new phone you can install a new IRMA app, open a new (empty) account, and reload your attributes from the various sources onto your new phone. Currently, there is no possibility to transfer attributes from one phone to another. This is work in progress, which involves some delicate security issues. Fortunately, it is not so difficult to load your attributes again onto your new phone. It does take a bit of time. item9: question: What should I do when I lose my phone? answer: The IRMA app on your phone is protected with a PIN, just like internet banking apps. Therefore, when you lose your phone, someone else cannot abuse your IRMA app and pretend to be you (commit identity fraud). So you do not need to worry, assuming your PIN is non-trivial.

There are still better ways to protect yourself: upon opening your IRMA account, you had the option to register an email address. If you have done this, you can block your old IRMA account via the MyIRMA environment. Then it really cannot be used anymore. If you have not registered an email address, you can still do so via MyIRMA. This is recommended. item10: question: I have a question about IRMA; where should I go? answer: When you have a question about logging in with IRMA at webshop The Trendy Chicken, you can best address your question at The Trendy Chicken itself. Also when that website asks you to install the IRMA app and that fails, you can best talk to them. Often such pages contain additional info and allow you to ask questions.

If, in the end, you have a question about IRMA itself, you can send an email to the address irma@privacybydesign.foundation. Please explain clearly what your point is, and provide your phone's model and supply screen shots if possible when something goes wrong. item11: question: What happens to my data when I log in with IRMA? answer: When you log in with IRMA at a website your phone talks directly to that website. No-one is in between, monitoring that exchange. The IRMA organisation cannot see your attributes — because they are exclusively on your phone — and can also not see which attributes you disclose to which website. item12: question: Who is behind IRMA? answer: IRMA is produced and run by the Privacy by Design Foundation. In 2016 this foundation grew out of the Digital Security research group from Radboud University at Nijmegen, The Netherlands. It is an independent non-profit foundation. Since 2019 it has a strategic cooperation with (SIDN), the foundation that runs the .nl domain. This cooperation contributes to IRMA's stability and continuity. item13: question: How can IRMA be free? answer: IRMA is free for users and also free for websites that use IRMA for login: everyone can request attributes from the IRMA app, and will receive them after the user has given consent. But it is not free to issue attributes. Not everyone can put attributes in other people's phones, since that would quickly become a mess.

Issuing involves a fee and also a contract, in which the issuer commits itself to put only accurate (authentic) data in the IRMA app of the right person.

Additionally, a contract is available, both for verifiers and issuers, that gives availability guarantees (an "SLA") via SIDN. Since IRMA is a decentralised system, in which attributes are stored only on user's phones, the organisation behind IRMA has a relatively light task. Because, in addition, this organisation has no profit goals, IRMA as a whole is a cheap system. item14: question: IRMA is open source; what does that mean? answer: The IRMA software is deliberately open source. This means that the way that IRMA works can be inspected by anyone: the software is available online, see GitHub. This also means that people outside the foundation can contribute. Indeed, several other organisations are contributing software and designs to the IRMA ecosystem. Of course, you do have to know a bit about computer programs in order to really understand IRMA's software, but the principle is important: IRMA has no secrets and works in a transparent manner. This contributes to trust in IRMA. There are no uneasy discussions about hidden backdoors in IRMA, like for instance in 5G telecommunications. The Privacy by Design foundation is of the opinion that all software in infrastructure with a public role should be open source. item15: question: I like to know more about IRMA; where can I go? answer: Extensive background information about how IRMA works is described by the Privacy by Design foundation at this page. People who wish to understand the real technicalities can check out IRMA's documentation page and GitHub repository.

The big picture behind IRMA is described in a IRMA Manifest which is available only in Dutch, so far. item16: question: Can I install IRMA on Android without Google Play Store? answer: Yes, you can download the IRMA app here: https://irma.app/irma.apk. If you install IRMA this way, the app will not recieve updates automatically. We are working on adding the app to F-Droid. footer: id: links irma_alt: IRMA logo irma_headline: Privacy by Design Foundation irma_content: "IRMA is produced and run by the Privacy by Design Foundation in close cooperation with SIDN. The foundation provides extensive explanations. Follow IRMA on Twitter for the latest developments:
@irma_privacy" doc_headline: Developers doc_content: Developers who wish to work with IRMA can check out IRMA's technical documentation. People who wish to inspect IRMA's software or wish to contribute to IRMA development can go to IRMA's GitHub page. github_headline: Stakeholders github_content: The Privacy by Design Foundation is constantly working on new features and applications. This is done in close collaboration with partners and stakeholders. Visit our Trello roadmap to learn more about where IRMA is heading.