How does an eSIM work? From QR code to signal.
Scanning the code does not send you a SIM. It asks a server to build one for the exact chip inside your phone.
An eSIM is a digital SIM you download. That sentence is accurate and it explains nothing. This page walks through the chip, the server, the code you scan, and what each one is doing while your phone sits on Activating.
How an eSIM works, in one paragraph
An eSIM works by downloading a carrier profile onto a secure chip already built into your phone, called an eUICC. Scanning a QR code tells the phone which server to contact. That server builds a profile locked to your specific chip, sends it over an encrypted connection, and the phone then attaches to a mobile network using it.
GSMA, the industry body that writes the standard, calls that chip an eUICC and defines it as a removable or non-removable UICC that allows profiles to be managed remotely and locally in a secure way. UICC is the formal name for a SIM card, so the only thing the letter e adds is that the chip is embedded.
eSIM stands for embedded SIM, and the embedded part is literal, because the computer hardware is soldered to the board rather than slotted into a tray. So the hardware has been there all along. What changed is that the carrier credential now arrives over the internet instead of in an envelope, a process GSMA names remote SIM provisioning and defines as the downloading, installing, enabling, disabling and deleting of a profile on an eUICC.
Every section below fills in that outline, covering what the profile contains, which server builds it, what the code you scan actually holds, and what your phone and that server exchange while the progress bar sits there. The specification behind all of it is GSMA SGP.22, and our explainer on what an eSIM is covers the plain definition if you want that first.
None of this is new technology either. GSMA published the first version of its consumer architecture specification, SGP.21, in December 2015, and the consumer technical specification has run through three major versions since. An eUICC now ships in most new mobile phone models sold anywhere.
Four parts make an eSIM work
Four things have to line up before a travel eSIM gives you data. Three of them you never see, and the fourth is the QR code in your order email. Taking them in order makes the failures later on look obvious rather than random.
Start with the chip, the eUICC
Your phone already contains the hardware. GSMA’s consumer specification calls it an eUICC, and defines it as a removable or non-removable UICC that allows profiles to be managed remotely or locally in a secure way. UICC is the formal name for what everyone calls a SIM card, short for Universal Integrated Circuit Card.
That chip is not blank when it leaves the factory. The chip maker personalises a security domain called the ECASD, loading the eUICC’s own private signing key, its certificate, and the root public keys it will later use to check who it is talking to. A phone can therefore prove which chip it is before any carrier is involved.
Each profile sits in its own GlobalPlatform security domain, and SGP.22 requires that no profile can reach another profile’s applications or data. Ordinary SIM cards use the same isolation to keep payment applets apart.
Where the profile comes from, the SM-DP+
On the other side sits a provisioning server called an SM-DP+, short for Subscription Manager Data Preparation. It prepares profile packages, protects each one with a key, keeps them in a repository, and allocates them to specific chip identifiers.
The server does not publish a generic profile and let whichever handset turns up claim it. It binds the protected package to your particular eUICC through a key agreement with the chip, producing what the specification calls a Bound Profile Package.
That binding is the reason an eSIM cannot be forwarded to a friend, and the reason a photo of a QR code is only worth anything to the first phone that redeems it.
What is really inside the QR code
An activation code is a short line of text with a fixed layout. A format digit set to 1, a dollar delimiter, the fully qualified domain name of the SM-DP+ server, another delimiter, then a matching ID. Optional fields for a server identifier, a confirmation-code flag and a certificate-authority hint can follow.
GSMA’s own worked example in SGP.22 reads 1$SMDP.EXAMPLE.COM$04386-AGYFT-A74Y8-3F815. Printed as a QR code, the same string carries an LPA: prefix so the phone knows what it is scanning. Length is capped at 255 characters in the ordinary case.
So the code holds no carrier credentials whatsoever. It holds an address and a one-time reference, and the matching ID is restricted to capital letters, digits and hyphens precisely so it survives both QR encoding and being typed in by hand.
How the download runs
Your side of the exchange is software called the LPA, or Local Profile Assistant. It provides the download function, the discovery function, and the screen you tap through, and it is the thing that reads the activation code.
The LPA pulls the server address out of that code and opens an HTTPS connection, with TLS in server-authentication mode. Both ends then prove who they are. The chip signs a challenge with the private key loaded at manufacture, and the server presents a certificate chaining back to an eSIM root authority.
Only once that mutual check passes does the server build the bound package and send it down. Your phone installs it, reports the outcome back as a notification, and the eUICC is now holding a live subscription.
What an eSIM profile holds, and what switching one on does
Most explanations stop at the idea that a digital SIM gets downloaded. What actually lands on the chip is closer to a small filing system with cryptographic keys in it. Knowing that explains several behaviours that otherwise look arbitrary.
Inside a carrier profile
GSMA defines a profile as a combination of data and applications provisioned onto an eUICC in order to provide services. The kind you buy is an operational profile, meaning operator data and applications that back a subscription and let the device connect to a mobile network.
Its components are itemised in the specification. One mobile network operator security domain holding the operator’s over-the-air keys, further security domains, applets, a file system, one or more network access applications, and profile metadata carrying the operator’s policy rules.
Network access application is the formal name for the piece that authorises the handset onto a cellular network. That component is doing the job most people have in mind when they say “the SIM”.
Why a profile cannot be moved by copying it
Since the package was cryptographically bound to one chip at download time, there is no copy operation to perform. Moving a number to a new handset goes back through the servers instead, which is why Apple ships a dedicated eSIM Quick Transfer flow and why the specification carries an entire Device Change procedure. Moving a subscription between two devices is a server-side transfer, and setting up a new phone takes the same route.
That also answers whether an eSIM is more secure than a physical SIM card. A plastic SIM can be pulled out of a stolen phone and dropped into another one. A profile bound to a soldered chip cannot travel that way.
What enabling and disabling a profile really does
Enabling a profile runs a real sequence of commands. The LPA sends an enable command to the chip, the chip issues a REFRESH to the phone’s baseband, and the baseband then runs a network attach using the credentials inside that profile.
Disabling runs the same machinery backwards. The chip has to make the profile’s file system and applications unselectable, and the device has to discard cached file content and any state belonging to the profile that was enabled a moment ago.
With nothing else enabled, the LPA reports to the baseband that there is no enabled profile, and the phone stops attaching to that carrier. Nothing is suspended at the network end, and the credential stops being reachable.
How many profiles can run at the same time
A chip can store multiple profiles at once. GSMA’s consumer overview page says you can hold multiple operator profiles and switch between them remotely, though only one can be used at a time, and that described the original design accurately.
Version 3 of the technical specification moved past it. SGP.22 v3.1 defines MEP-capable chips, on which more than one profile can be enabled at once, and MEP-capable devices that can use those profiles in parallel. The overview page and the technical specification disagree on this point, and the specification is the newer document.
In practice this is what dual SIM behaviour on a modern smartphone rests on, and why a travel plan and a home line can both sit on one eUICC. Keeping several profiles on a single chip is how a handset with no second tray still behaves like a dual SIM phone.
That is also the practical shape of most trips. You leave your home subscription in place, add a local eSIM for where you are going, and connect to a local network without carrying multiple SIM cards or swapping anything in and out.
Where the IoT specification splits off
Two families of document exist. SGP.21 and SGP.22 cover consumer devices, while SGP.31 and SGP.32 cover IoT, and GSMA published version 1.3 of both IoT documents on 22 May 2026.
IoT needed its own specification because the consumer flow assumes a person is standing there. GSMA splits the LPA into an IPA on the device and an eIM remote manager off it, and says the eIM stands in for the user-intent step, since a sensor in a field has nobody available to tap Confirm.
None of that changes anything for a traveller. It does show how much of the consumer design assumes a person who is present, connected, and able to tap through a screen.
What happens at each step when you set up an eSIM
Nothing here replaces the instructions your provider sends, because menu labels move between manufacturers and between versions of the Android operating system. What follows maps each tap to what the handset and the server are doing underneath it.
Step 1. Get online before you need to be online
The handset has to reach the provisioning server over IP, and at that moment it has no mobile service on the new plan to do it with. Apple states the requirement flatly, saying on its travel guidance that the iPhone must be connected to a Wi-Fi network or hotspot, with an exception in some countries and regions for eSIM-only models.
Samsung gives the same instruction for Galaxy phones, asking you to check the handset is on Wi-Fi or a mobile data network before adding the plan. Tethering off a second phone counts, and so does airport Wi-Fi, but something has to carry the session.
Step 2. Open the right menu for your handset
On iPhone, Apple’s setup page gives Settings, then Cellular, then Set Up Cellular or Add eSIM. On a Google Pixel, Google’s Pixel documentation gives Settings, then Network & internet, then SIMs, then Add SIM, then Set up an eSIM. On a Samsung Galaxy, Samsung gives Settings, then Connections, then SIM card manager, then Add mobile plan.
Google adds that the process differs slightly depending on your carrier. Treat any menu path you read anywhere as approximate and follow what is actually on your screen.
Step 3. Scan the code, or type it in
Scanning hands the LPA the activation code string described above, nothing more. Every platform also offers manual entry, because the code is only text, a server address followed by a matching ID. Either way you download an eSIM profile over the internet rather than receiving anything physical.
If your provider set a confirmation code, the activation code carries a flag telling the phone to ask for it. The server will refuse to release the profile without it.
Step 4. Wait through the part that looks like nothing
This is the handshake and the download. The chip and the server authenticate each other, the server assembles a package bound to your chip, and your phone installs it and sends a result notification back up the chain.
Retry limits live here too. Too many failed confirmation-code attempts, or too many failed downloads, push the order into an error state at the server rather than leaving it available to retry indefinitely.
Step 5. Decide what each line is for
Installing a profile does not enable it, and enabling it does not settle what it is used for. On a dual SIM handset you then choose which line carries mobile data, which one sends messages, and which is the default for calls.
Your home number stays on its own profile throughout. Installing a travel eSIM does not touch it, which is why the usual arrangement is to leave the home line enabled for calls and texts while data runs over the travel plan.
Set it up this way before you fly and you stay connected the moment you land at your destination. You skip the shop visit, the counter queue, and the business of fiddling a new SIM into a tray with the wrong end of a paperclip.
Where eSIM installs go wrong, and why
Leaving the install until arrival, which is the one moment you have no way to get online
A profile download is an HTTPS session to the provisioning server, and until it finishes there is no mobile data on that profile to carry it. The connection has to come from somewhere else. Apple states the Wi-Fi or hotspot requirement outright for iPhone setup, and Samsung gives the same instruction for Galaxy phones.
Install and check the profile while you are still on a connection you trust, then leave it disabled until you land. Enabling a profile that is already on the chip is a purely local operation between the LPA, the eUICC and the baseband, and it needs no internet at all.
At the server, an order moves from Released to Downloaded to Installed, and an installed profile is finished business. Returning it to a downloadable state is an optional transition that depends on a delete notification the operator has to act on. Deleting an eSIM from your phone is not a reliable way to get a fresh download out of the same QR code.
Apple says Add eSIM, Google says Set up an eSIM, and Samsung says Add mobile plan. Google adds that the flow varies by carrier as well. Any guide giving one universal path for Android is describing one handset rather than the platform.
Why eSIM-only handsets raise the stakes
Apple’s SIM-type page lists iPhone Air as eSIM-only in every region, and iPhone 14, iPhone 15 and iPhone 16 models bought in the United States as eSIM-only as well. The latest iPhone generations widen that further, with the iPhone 17 and iPhone 18 Pro families listed as eSIM-only across more markets, including Canada, Mexico, Japan and several Gulf states. If the models you are choosing between in the US are eSIM-only, the tray is not coming back.
On those iPhone models there is no tray to fall back on. A failed install abroad leaves you looking for another internet connection and a support desk rather than a kiosk selling plastic SIM cards.
What to have ready if an install fails
Apple’s troubleshooting sequence runs through toggling Airplane Mode off and on, turning the line off and back on in Cellular settings, restarting the handset, and checking for a carrier settings update under Settings, General, About.
If it still will not take, Apple says to contact the carrier with your phone number, the IMEI and EID, and the exact error message. The EID identifies your chip specifically, and it is the identifier the provisioning server has been working against the whole time.
How eSIM providers differ, and where eSIMply fits
eSIM benefits are mostly practical rather than technical, and they are the same whoever you buy from. eSIMply sells travel eSIMs, so this section comes with that disclosure attached. Everything above applies to travel eSIMs in exactly the same way whichever provider you buy from, because every one of them issues activation codes against the same GSMA specification and every one of them is handing your phone a profile to install.
What differs between providers is the ordering experience and the plan sitting behind the profile. eSIMply emails the QR code straight after you order, so you can install on your home Wi-Fi rather than hunting for a connection at an arrivals hall. There is no KYC step, so no ID upload, and the eSIM connects automatically once you land.
Support runs 24/7 over chat or email, and an optional mobile app handles data usage checks and top-ups. Plans cover more than 200 destinations, and if you want to see how a single destination is priced and which local network carries it, our Japan guide works through one market in detail.
Questions people ask about eSIMs
Most of what people want to know about eSIM technology comes down to three worries: whether their number survives, whether their phone supports it, and what to switch off so nobody gets billed twice.
Yes. A travel eSIM is a second profile added alongside your existing one, and your home number lives on its own separate profile on the same chip. Nothing in the install touches it.
What you get is a second line with its own number attached to the travel plan. Most people never use that number and simply run data over it.
Your telephone number belongs to the profile it was issued against, so it moves only when that subscription moves. Adding or deleting a travel profile has no bearing on it. Changing carrier no longer means waiting on a card in the post either, since you simply download a new profile instead.
No. The handset needs an eUICC and the LPA software to drive it, which in practice means a reasonably recent smartphone that its maker lists as eSIM-compatible. Apple, Google and Samsung each publish their own device lists.
Carrier locking is a separate question from eSIM support. A locked handset may refuse a profile from another operator even though the hardware is perfectly capable, so check that before you buy an eSIM plan for travel.
For the travel line, data roaming usually needs to be on, because a travel eSIM plan generally reaches the local network through a roaming agreement rather than as a native local subscription.
What you want turned off is data roaming on your home line, so your home carrier does not quietly bill you while the travel profile does the work. Both lines are controlled separately in Cellular settings.
You do not have to. Disabling a profile is a local command to the chip, and it makes that profile’s applications unselectable so the baseband stops attaching with it.
Most travellers leave the home line enabled for calls and texts, switch its data roaming off, and set the travel eSIM as the line for mobile data. That keeps you reachable on your usual number without paying roaming fees on data.
On a handset that still has a tray, yes. Enabling and disabling profiles on the eUICC is a local operation that needs no internet connection at all, and a physical SIM in the tray is treated as another line alongside them.
Moving a subscription from a physical SIM onto an eSIM is a different job. That is a fresh provisioning session with the carrier rather than a local toggle. A profile that has been removed from your device is gone, so delete one only when you are certain, because adding a new SIM afterwards means going back through the servers.
Nothing. Installing a profile writes to the embedded chip and leaves the tray alone, so a nano-SIM sitting in it keeps working exactly as before.
You end up with two lines on the phone and a choice to make about which one handles data, messages and calls. That choice is made in your phone’s SIM settings, not by the eSIM itself.
Against physical theft, yes, and for a specific reason. The profile is bound to one eUICC during download, so it cannot be lifted out of a stolen handset and used in another one the way a plastic SIM can.
The download path is protected too. The LPA talks to the SM-DP+ over HTTPS with TLS, and the chip and the server authenticate each other with certificates before any profile data moves. That verification runs in both directions, so neither end takes the other on trust.
None of that protects you against someone who has your unlocked phone in their hand. eSIM technology raises the cost of SIM swapping, but it does not remove the need for a screen lock.
The chip costs nothing extra, because it is already built into your device. What you pay for is the plan on the profile, and travel eSIMs are usually sold as a data plan with a fixed amount of data over a set number of days.
Prices for the same data plan vary by destination far more than they vary by provider. eSIMply’s own plans are listed per destination on its country pages.
A single-country eSIM data plan costs the least. Regional and global plans run higher because they work across multiple countries, which suits frequent travellers visiting multiple destinations more than it suits one week away.
Plenty beyond phones. Cellular tablets, many smartwatches, some laptops and a growing number of connected devices carry an eUICC and take eSIMs, and GSMA’s design was aimed at exactly that spread from the start.
Devices with no screen use a different specification. SGP.32 hands profile management to a remote manager because there is no user present to confirm anything.
eSIM stands for embedded SIM. A traditional SIM card is a physical card you slide into a tray, while an eSIM is a digital SIM card written onto hardware that is already part of the handset.
Both carry the same thing, a carrier credential, and what changes is only how it reaches you. A traditional plastic SIM is posted out or handed across a counter. An eSIM profile is downloaded.
Working without a physical card in the phone means there is nothing to lose, nothing to snap in half, and nothing to leave behind in a hotel drawer.
Check the manufacturer’s own device list rather than a third-party chart. Apple publishes which models support eSIM technology, Google lists which Pixel phones support it, and Samsung Electronics keeps a list for Galaxy smartphones.
On most Android handsets you can also look for an EID under the device information screen, because only a phone with an eUICC has one. If your device supports it, the eSIM option shows up in the SIM settings with no extra software to install.
Once you have confirmed your device is eSIM-compatible, the rest follows the same path on every handset. Almost all eSIM-compatible phones released in the last few years handle this identically, since eSIMs work to one shared specification rather than to each maker’s own scheme.
Where these facts come from
Everything on this page about how remote SIM provisioning works comes from the GSMA eSIM specification itself, specifically SGP.22 version 3.1, the consumer technical specification published on 1 December 2023. Definitions, the activation code layout, the profile lifecycle at the server and the enable and disable procedures are all drawn from that document.
- Protocol and terminology: GSMA SGP.22, plus the GSMA eSIM consumer and IoT overview for the split between the consumer and IoT specification families.
- Handset behaviour and menu paths: Apple’s eSIM setup documentation, Google’s Pixel eSIM help, and Samsung’s Galaxy eSIM guide, each quoted for its own platform rather than generalised into one universal path.
- Failure modes: Apple’s page on eSIM setup failures, and the retry and error states defined in SGP.22.
- Device availability: Apple’s SIM-type reference for which iPhone models ship without a SIM tray.
eSIMply sells its own travel eSIM, so this page is written by a company with a product in this market. No claim above rests on our own testing. Where GSMA’s overview page and its technical specification contradict each other on simultaneous profiles, that disagreement is spelled out in the article rather than smoothed over.
Links to eSIMply product pages may earn us a commission.
Jamie has worked in telecommunications for more than 8 years across mobile, SMS, eSIM, apps, and adjacent technology. He now writes for eSIMply as the tech content writer, analysing the top eSIM providers and breaking down what travellers actually need to know.
While we do our best to ensure accuracy, prices and plan availability are subject to change. Last updated by Jamie Cole.
